What Verfy does, and where it stops

verfy.lock pins the SHA-256 of each tool's canonical name, description and input schema.

Drift

A tool whose definition changed is hidden from the agent and its calls are denied (VFY-TOOL-004) until someone approves the change.

New tools

A tool added to an already locked server needs approval by default (VFY-TOOL-006).

Review

verfy lock diff shows a readable diff with invisible characters spelled out; verfy lock approve records who accepted it.

CI

verfy lock check starts the servers in .mcp.json and compares them with the committed verfy.lock. Run it in CI and every pull request in which a tool changed fails the check.

Team

Devices propose changes; an admin approves once in the dashboard and every device picks it up with verfy team pull.

Notifications

Slack or Telegram messages when a call waits for approval, a tool definition changes, calls are denied, or a device stops uploading receipts for a day.

Approval queue

With "on_ask": "team", a gateway call that needs approval waits in the dashboard for an owner or admin, then runs or is refused. Only a hash of the arguments is sent.

Every decision becomes a verfy.receipt/1 record, signed with Ed25519 and chained with SHA-256.

Contents

Sequence number, previous hash, time, agent, session, server, tool, action kind, salted SHA-256 of the arguments, verdict, rule IDs, policy hash, tool digest and outcome.

Privacy

Arguments and results are stored as hashes by default. Storing redacted arguments is an explicit local setting.

Verification

verfy verify checks every signature and link offline. Verfy Cloud checks them again on upload and on demand.

Standard format

verfy scitt export writes each receipt as an IETF SCITT signed statement (COSE_Sign1 with CWT claims), so a SCITT transparency service or any COSE library can check it. Verfy does not run a transparency service.

A deterministic pre-check for every tool call, through a Claude Code PreToolUse hook or the MCP gateway.

Shell

Recursive deletes of home, root or the project, disk formatting, fork bombs, force-push, publishing and deploy commands, sudo, curl-to-shell, reading secrets in a command that also uses the network.

Files

Writes to protected paths (~/.ssh, /etc, git hooks, shell profiles, the Verfy folder), sensitive files such as .env and private keys, writes outside the project.

Network

Cloud metadata endpoints, tunnels and request bins, credentials in URLs, an allow list for everything else.

Data and money

Destructive SQL without a WHERE clause, payment limits, daily budgets, unknown recipients, secrets in arguments.

Your rules

Tool deny/ask lists, custom regex rules per tool or argument, disabled rules, all in one JSON policy. Start from a template: strict, read-only or ci.

Secrets in output

The MCP gateway replaces API keys, tokens and private keys in tool results with [REDACTED:rule] before the agent reads them. Output of Claude Code's built-in tools is not changed.

Self-protection

The agent cannot switch Verfy off with its own tools: changing the hook settings, verfy.lock, the policy or the Verfy install is denied, and so is running verfy lock approve or uninstalling Verfy. Changes to MCP configs need approval.

Finds MCP servers in Claude Code (.mcp.json, ~/.claude.json), Cursor and Claude Desktop configs, and checks tool definitions.

Config checks

Unpinned npx/uvx packages, curl | sh launchers, plain-http remote servers, remote servers without auth, secrets written into configs, privileged containers.

Tool checks

Hidden instructions and tool poisoning, instructions that change how other tools behave (shadowing), invisible Unicode, long encoded blobs, secrets, misleading read-only hints.

Results

Each finding has a rule ID, severity, where it was found and what to do. --json output and exit codes for CI.