How to check Codex's code changes before you commit.
Codex writes the change. Veridu checks it independently, Codex fixes the findings that hold up and checks again, and you can see what is still open before anything is committed.
Add Veridu to the Codex CLI and sign in once in the browser:
codex mcp add veridu --url https://api.veridu.io/mcp codex mcp login veridu
Then add this line to your AGENTS.md:
Before committing, call Veridu's verify_change. Review and fix valid findings, then run it again to check what is still open.
Or ask for a check when you want one: "verify this change with Veridu". No repository to connect.
- 1Codex sends the change. It calls verify_change with the diff, the full content of the files it changed and a sentence on what the change is for. Independent reviewers check it in an isolated sandbox with no internet access, usually in one to two minutes.
- 2It gets findings it can act on. An outcome (pass, review or block) and findings with the file, line, severity and evidence. Veridu tries to keep each finding's id the same across follow-ups, matching on the file, the code and the nearby lines.
- 3It fixes what holds up and checks again. Codex passes the first check's id as parent_change. The follow-up reports which findings persist, which are new (possibly introduced by the fix) and which are no longer reported, which is not proof of a fix. The first two linked follow-ups are free.
It sees only the files Codex sends, not your whole repository. For the code a change affects elsewhere, review the pull request too: how to review AI-generated pull requests.
Does Veridu read my whole repository?
No. Codex sends the diff and the full content of the files it changed, and Veridu reviews only those. For PHP it also traces callers and overrides within the files it was sent. Results are advisory for that reason.
Do I need an OpenAI API key?
No. Only a Veridu sign-in: codex mcp login opens the browser once.
Can I use it in CI or without a browser?
Yes. Create a token with the MCP only scope on the Tokens page and send it as an Authorization: Bearer header. Full-access tokens are not accepted by the MCP server.
Does a finding that disappears mean it was fixed?
No. A follow-up says whether the flagged line changed, but a reviewer can also simply not mention it again, so "no longer reported" is not proof of a fix. Read the diff before you commit.
What does it cost?
Each new change uses one review. The first two follow-ups linked to it are free, and resending the exact same request within seven days returns the earlier result at no cost. The free tier includes up to 20 reviews a month with no card. A change linked to a private repository needs a paid plan.
What are the limits?
Text files only (no binaries, renames, mode changes or symlinks). The diff can touch up to 60 files and be up to 256 KB. The files sent with it can be up to 120, at most 256 KB each and 512 KB in total.
The same loop works there: verify Claude Code changes. Other MCP clients are covered in the docs.