Verificate MCP is a pre-merge verification service for AI-generated code, provided as a hosted MCP server. Its positioning is: to move "a demo that runs" forward to a product that can go live, reviewing AI-written changes before they enter the codebase.
Purpose Used to review AI-written changes after an AI coding assistant produces code and before merging into the codebase, catching placeholder code, tests that never fail, unsupported completion claims, and nonexistent API calls, and returning fixes. It is officially described as playing the role of a "senior review team": using 17 deterministic reality gates (with veto power) combined with enterprise-grade review by frontier models (ISO/IEC 25010: performance, scalability, reliability), running before every AI change reaches the codebase.
Main capabilities
- Deterministic reality gates: 17 rule gates with veto power, any one of which can veto.
- Frontier model review: enterprise-grade scored review of code that passes the gates.
- Two-phase separation: reality and quality are separated, avoiding code that is structurally beautiful but fakes a refund path being averaged into "acceptable".
- Provides MCP tools, prompts, and resources:
- Tools include two gates that return a verdict, an advisor that does not return a verdict, and a generator (apart from validate, the specific tool names are not listed one by one in the other materials).
- Prompts: gate_my_changes / review_my_plan, one-click workflows, looping "verify → fix → verify again" until passing.
- Resources: verificate://gates (what each of the 17 deterministic gates focuses on) and verificate://example-verdict (a real rejection record).
- A real rejection example officially given: 12 lines of AI-written payment code, judged REJECTED, score 30.8/100, vetoed by code_reality_gate, with findings including N+1 synchronous API calls, an invalid Stripe SDK resource (stripe.Inventory), and a floating-point rounding issue (the Stripe API requires integer cents).
- Officially stated after comparative testing: when frontier models self-check "can this be merged", 0 out of 6 times did they find reward hacking (tests that only do assert True) and hallucinated APIs (stripe.Refund.create_partial); the Verificate gates deterministically caught it 6 out of 6 times, with 0 false positives on clean code.
- Officially stated that within 5 weeks it completed 2,581 audit verifications (66 rejections, 270 marked as unqualified), and guarded a write path for a knowledge base with 21 million entities and source citations (98.6% have citations, 268 sources 100% licensed); reproducible via scripts/, with the full comparison in COMPARISON.md.
How to use General method: configure the MCP server address in an MCP client. Officially stated that each machine has 25 free verifications, with no account, bank card, or key required.
- Cursor / VS Code: one-click install.
- LM Studio and Goose: the one-click button is at https://verificate.ai/mcp（GitHub strips its custom protocol link).
- Windsurf / any MCP client (JSON): Cursor configuration is at ~/.cursor/mcp.json; Windsurf configuration is at ~/.codeium/windsurf/mcp_config.json.
- After configuration, ask the assistant "validate this function with verificate", and a structured verdict is returned within seconds; the free tier shows the remaining verification count in each response and what the gates caught for you.
After exceeding the free 25 times At https://verificate.ai/auth/signup Registration (30-day trial, no credit card required, then $30/month), add the token to the same configuration; or add "headers": { "Authorization": "Bearer YOUR_TRIAL_TOKEN" } to the JSON configuration.
Make verification the default behavior The materials point out that tools callable by agents will be skipped under pressure, so it is recommended to add persistent rules (use CLAUDE.md for Claude Code; a rules file for Cursor). The prompts for one-click installation of these rules are in PROMPTS.md; CI can also be integrated as a merge gate, see examples/.
Local running (stdio bridge) This repository is also a runnable, zero-dependency MCP server: a stdio bridge that locally provides initialize / tools/list and forwards tool calls to the hosted gateway. Suitable for clients that prefer stdio servers, and also supports the Docker approach. Without VERIFICATE_TOKEN, introspection is still available, and tool calls will return instructions for obtaining a trial token.
FAQ (official answers)
- Will it slow down the agent? Each verification takes a few seconds, within the step, before presenting the work results; compared with discovering defects in CI or production and then switching context to fix them, adding a gate is net faster for any important change.
- Which languages are supported? Verification is language-independent; analysis covers mainstream languages (Python, JS/TS, C++, SQL, Swift, etc.). Pass context.language for the best results.
- Can it stop my agent? Yes, that is exactly the purpose. A REJECTED verdict will make the agent go back and fix the problem instead of submitting defective work; persistent rules determine how hard this stop is.
- What about false positives? Verdicts come with specific findings and the basis for calculation, auditable within seconds, and do not require you to trust a blank score.
Security and privacy
- Requests are authenticated using your personal token; keys are single-user and rate-limited, including key-sharing detection.
- Code is used only to generate verdicts, not to train models.
- initialize / tools/list are public (to facilitate client and directory introspection); every tools/call requires your key.
Pricing 30-day free trial, then $30/month (launch offer: 50% off for the first 3 months). Volume and academic pricing: info@verificate.ai.
Developers and license Built by Verificate Pty Ltd (Sydney, Australia), and is an IBM Business Partner. This repository (stdio bridge, client configuration, and CI examples) is MIT licensed and can be used freely; the Verificate verification engine and its connected hosted gateway are commercial services: 17 protection gates and frontier model review run server-side and are not part of this repository.
Limitations
- The free quota is 25 verifications per machine, after which registration and payment are required.
- The local repository contains only the stdio bridge and examples; the core verification engine and hosted gateway are commercial services and are not in the repository.
- The specific supported MCP clients, the full set of tool names, and the details of each gate are not listed one by one in the materials; refer to the official page verificate://gates and https://verificate.ai/mcp for details.
- Other platforms, prices, and performance data not provided in the materials are not yet available.
