Verificate MCP

Verificate MCP — your vibe-coded MVP, all the way to production

Real output from the live server: 12 lines of AI-written payment code — rejected, fixed, approved, in seconds.

You vibe-coded the demo. This ships it. Between a working demo and a launched product used to stand an experienced CTO and a senior dev team — the people who catch the mock refund path, the invented SDK call, the loop that dies at real traffic. Verificate MCP is that review team as an MCP server: 17 deterministic reality gates with veto power, fused with a frontier-model enterprise review (ISO/IEC 25010: performance, scalability, reliability), run on every AI-written change before it reaches your codebase. The AI writes; the gate holds the bar; you ship. Hosted, zero-install, binary verdict in seconds — in Claude Code, Cursor, Windsurf or any MCP client.

Not another linter wrapper. The code-quality shelf on every MCP directory is two things: scanners (ESLint, Semgrep and SonarQube bridges — deterministic rules, no judgment) and prompt relays that pipe your repo to your own LLM key (self-review with extra steps). Verificate is neither: the gates hold veto power that no model output can override.

Your coding assistant writes a mock and calls it done. It invents an SDK call that doesn't exist. It ships an N+1 loop that passes every test and dies under load. Verificate MCP runs the deep review pass on every AI output — deterministic reality gates first (any one can veto), then an enterprise-grade review scores what survives — before the code reaches your codebase.

A real rejection (verbatim)

12 plausible lines of AI-written payment code were sent through the production gateway. Verdict: REJECTED — score 30.8/100, vetoed by `code_reality_gate`, with findings including:

*"N+1 synchronous API calls … For 100 items, this results in 100 sequential HTTP roundtrips, taking ~10–20 seconds and blocking the event loop/worker thread … will trigger Stripe rate limiting (100 req/sec limit)."*

*"stripe.Inventory is not a valid Stripe SDK resource."*

*"Floating-point representation issues lead to rounding errors in financial transactions; Stripe API requires integer cents."*

Each of those is an afternoon of production debugging, caught in seconds.

Measured — vs. asking the model to review its own code

A frontier model asked *"is this OK to merge?"* in a natural workflow missed reward-gaming (a test that only does assert True) and a hallucinated API (stripe.Refund.create_partial) in 0 of 6 runs each. Verificate's gate caught both 6 of 6 — deterministically, with 0 false positives on clean code.

Battle-tested: 2,581 audited validations over 5 weeks (66 rejected, 270 flagged unfit), including guarding the write-path of a 21M-entity source-cited knowledge base (98.6% cited, 100% licensed across 268 sources). Reproduce it: scripts/ · full write-up: COMPARISON.md.

Tools

Each tool has one job — two gates that return verdicts, one advisor that doesn't, one generator:

Beyond tools

The server also ships prompts and resources for a richer client experience:

• Prompts gate_my_changes / review_my_plan — one-click workflows that loop validate → fix → re-validate until approved.
• Resources verificate://gates (what each of the 17 deterministic gates watches for) and verificate://example-verdict (a verbatim production rejection).

Quick start — no signup, no token, 30 seconds

Every machine gets 25 free validations — no account, no card, no key. Add the URL and go:

Claude Code

claude mcp add --transport http verificate https://mcp.verificate.ai/mcp

Cursor / VS Code — one-click install:

*LM Studio and Goose one-click buttons are at https://verificate.ai/mcp (GitHub strips their custom-protocol links).*

Windsurf / any MCP client (JSON)

{

"mcpServers": { "verificate": { "url": "https://mcp.verificate.ai/mcp", "transport": "http" } } }

Cursor: ~/.cursor/mcp.json. Windsurf: ~/.codeium/windsurf/mcp_config.json.

Then ask your assistant to *"validate this function with verificate"* — a structured verdict comes back in seconds, and every free-tier response shows how many validations you have left and what the gate has caught for you.

Keep going after the free 25

Sign up at https://verificate.ai/auth/signup (30-day trial, no card — then $30/mo) and add your token to the same config:

claude mcp add --transport http verificate \

https://mcp.verificate.ai/mcp \ --header "Authorization: Bearer YOUR_TRIAL_TOKEN"

or in the JSON config add "headers": { "Authorization": "Bearer YOUR_TRIAL_TOKEN" }.

Make gating the default

Tools an agent *may* call are tools it will skip under pressure. Add a standing rule (Claude Code: CLAUDE.md; Cursor: a rule file):

Before presenting any substantive code change as complete:

1. Call validate_ai_output on the change.
2. If the verdict is REJECTED, fix the findings and re-validate.
3. Never claim tests pass or systems are deployed without proof.

One-paste setup prompts that install these rules for you: PROMPTS.md. Or wire it into CI as a merge gate — see examples/.

How it decides

AI output ──► Reality gates (deterministic, any one vetoes)

• mock/placeholder in the wire path • invented/hallucinated APIs • claimed-complete without proof • gaming & bypass detection │ survivors only ▼ Enterprise review (ISO/IEC 25010 + MLOps) performance · scalability · reliability · tech debt │ ▼ Verdict: score /100 + severity-ranked findings (REJECTED = agent fixes findings and re-validates)

The two stages are deliberately separate: if reality and quality were blended into one score, a beautifully structured function that fakes its refund path could still average out to "acceptable." A veto architecture makes that impossible.

The category, honestly

Everything else on the MCP code-quality shelf is free — and that's fair, because a wrapper should be free. What you can't get for free is judgment with authority:

That second layer is the part you pay for: a frontier agent doing the deep review — production arithmetic, failure modes, SDK reality — with a deterministic floor under it that the agent itself cannot argue away.

Run locally (stdio bridge)

This repo is also a runnable, zero-dependency MCP server: a stdio bridge that serves initialize/tools/list locally and forwards tool calls to the hosted gateway. Use it with clients that prefer stdio servers:

VERIFICATE_TOKEN=<your-token> npx github:Verificate-Dev/verificate-mcp-quickstart

Or with Docker:

docker build -t verificate-mcp .

docker run -i -e VERIFICATE_TOKEN= verificate-mcp

Without VERIFICATE_TOKEN, introspection still works and tool calls return instructions for getting a trial token.

FAQ

Does it slow the agent down? Each validation takes seconds, inside the loop, before work is presented. Compare with a defect found in CI or production plus the context switch to fix it — gating is net-faster for any change that matters.

Which languages? Validation is language-agnostic; analysis covers mainstr