Veridu
VS Code

How to check GitHub Copilot's code changes in VS Code before you commit.

Install Veridu in VS Code with one click and add one line to your Copilot instructions asking it to send each change to Veridu, fix the findings that hold up and check again. You can also just ask in agent mode: "verify this change with Veridu". Either way you can see what is still open before anything is committed.

Install in VS CodeInstall in VS Code Insiders
1 · Add Veridu to VS Code

You need GitHub Copilot set up in VS Code (the free plan works); MCP servers run in Copilot Chat's agent mode.

The buttons above open VS Code and ask to install the server. If nothing happens (some browsers block app links), add it by hand: run MCP: Add Server, choose HTTP and enter https://api.veridu.io/mcp, or put this in .vscode/mcp.json (it has no secret, so it is safe to commit): 

{
  "servers": {
    "veridu": {
      "type": "http",
      "url": "https://api.veridu.io/mcp"
    }
  }
}

The first time the server starts, VS Code asks to let it authenticate to Veridu: choose Allow, then sign in and approve in your browser. Your browser may then ask to open VS Code; allow it, or close the tab (sign-in is already done). Copilot's portable .mcp.json takes the same entry under mcpServers. If sign-in doesn't work for you, Connect your editor makes a token and the config for your user mcp.json (never the project's, which may be committed).

2 · Tell Copilot when to use it

Add this line to .github/copilot-instructions.md. Copilot treats it as guidance, so it may still skip a check; ask for one when it matters. 

Before committing, call Veridu's verify_change. Review and fix valid findings, then run it again to check what is still open.

In Copilot Chat, use Agent mode, and ask "verify this change with Veridu". VS Code asks before it runs a tool from a new server; choose Allow (or always allow Veridu's tools). No repository to connect.

3 · What happens on each change
  1. 1
    Copilot sends the change. When it follows the rule (or you ask it to), it calls verify_change with the diff, the full content of the files it changed and a sentence on what the change is for. Independent reviewers check it in an isolated sandbox with no internet access, usually in one to two minutes.
  2. 2
    It gets findings it can act on. An outcome (pass, review or block) and findings with the file, line, severity and evidence. Veridu tries to keep each finding's id the same across follow-ups, matching on the file, the code and the nearby lines.
  3. 3
    It fixes what holds up and checks again. When it checks the fixed change, Veridu links the follow-up to the first check automatically. The follow-up reports which findings persist, which are new (possibly introduced by the fix) and which are no longer reported, which is not proof of a fix. The first two linked follow-ups are free.
What it doesn't do

It sees only the files Copilot sends, not your whole repository. For the code a change affects elsewhere, review the pull request too: how to review AI-generated pull requests.

Questions
Does sign-in work in VS Code?

Yes. It is tested in VS Code 1.124 with GitHub Copilot: VS Code signs in to Veridu in your browser and returns through a local address on your computer.

What if VS Code's sign-in fails?

VS Code signs in through a local address on port 33418, or through vscode.dev when that port is busy; Veridu accepts both. If sign-in still fails, use a token instead: Connect your editor makes one and gives you the config for your user mcp.json.

Does Veridu read my whole repository?

No. Copilot sends the diff and the full content of the files it changed, and Veridu reviews only those, in an isolated sandbox with no internet access. For PHP it also traces callers and overrides within the files it was sent. Results are advisory for that reason.

Do I need an OpenAI or Anthropic API key?

No. Only a Veridu sign-in, or an MCP-only token from the Tokens page.

Does it use my Copilot plan?

Only for the ordinary tool calls that send the change and read the result. Veridu's reviewers run on Veridu's own OpenAI and Anthropic API access, which Veridu pays for, and a new change counts against your Veridu reviews.

Does a finding that disappears mean it was fixed?

No. A follow-up says whether the flagged line changed, but a reviewer can also simply not mention it again, so "no longer reported" is not proof of a fix. Read the diff before you commit.

What does it cost?

Each new change uses one review. The first two follow-ups linked to it are free, and resending the exact same request within seven days returns the earlier result at no cost. The free tier includes up to 20 reviews a month with no card. A change linked to a private repository needs a paid plan.

What are the limits?

Text files only (no binaries, renames, mode changes or symlinks). The diff can touch up to 60 files and be up to 256 KB. The files sent with it can be up to 120, at most 256 KB each and 512 KB in total.

Using another agent?

The same loop works in Claude Code, Codex, Cursor and PhpStorm.

Try it freeRead the docs