Scanners judge a tool on the day you add it. Verfy notices the day it changes, blocks it, and keeps a record anyone can check.
Verfy pins the SHA-256 of each tool's exact definition when you approve it. If the server changes it later, the tool is blocked on every machine and the pull request fails in CI until a person reviews the diff.
How Lock worksEvery decision becomes a receipt, signed on the device with Ed25519 and chained with SHA-256. Anyone can check it with verfy verify, and it exports as a standard SCITT signed statement.
How Receipts worksShell commands, file writes, web requests, SQL and payments are checked against your policy. Every answer is allow, ask or deny, with the rule and the reason.
How Guard worksFlags hidden instructions, unpinned packages, plain-HTTP servers and leaked keys before you approve a tool. Use it next to any other scanner: a scan looks once, the lock keeps watching.
How Scan worksVerfy decides on your machine, without waiting for the network. The web platform collects evidence; it is never in the way.
Guard runs the same deterministic rules on shell commands, file writes and web requests. Type a command to see what it would decide.
Lock the servers in your repository's .mcp.json, commit verfy.lock, and let CI fail any pull request in which a tool changed. Set up the GitHub Action.
$ pip install verfy
$ verfy lock check --update # review and lock today's tools
$ git add verfy.lock && git commit -m "Lock MCP tools"
$ verfy lock check # in CI: exit 2 if a tool changedEvery receipt is linked to the one before it, so changing a record after the fact breaks the check exactly where it was changed. Once receipts reach Verfy Team, the server keeps their hashes and refuses a rewritten history, even one signed with the device's own key.
allownpm testprev none → hash 2423b5verifiedaskgit push --force origin mainprev 2423b5 → hash 82a78bverifiedaskcat ~/.aws/credentialsprev 82a78b → hash b10106verifieddenyrm -rf ~prev b10106 → hash 30ce71verifiedPublish rules once, approve tool changes for the whole team, revoke a lost laptop, and give auditors evidence they can check without trusting you.
Illustration with sample data. Your dashboard only shows your organization's real records.
Verfy replays sample agent actions against the new rules, and refuses a policy that would block everyday work.
Safe to publish.
Its description gained a hidden instruction. The tool is blocked on every device until an admin approves or rejects it.
npm test#41git push --force origin main#42rm -rf ~#43Verfy only claims what it can show. The security model lists every limit in detail.
A scanner reads a tool once. Verfy pins the exact definition you approved and checks it again on every connection and in CI. A tool that turns malicious after you approved it, a "rug pull", is blocked even though it passed the scan. Keep using any scanner you like alongside it.
No. Every verdict comes from deterministic rules: the same input always gets the same answer, and you can read, test and change the rules. No language model is ever asked whether something is allowed.
It fails safe. A broken policy, an unreadable lock file or an internal error becomes "ask" (or "deny", if you choose). Verfy never lets an action through because something went wrong.
No. Checks run locally and never wait for the network. If you join a team, only receipts are uploaded, and by default they hold hashes of the arguments, not the arguments. Private keys never leave the device.
No. Verfy checks what passes through its hook or gateway. For untrusted code, use it together with OS-level isolation such as a container or a virtual machine.
Not one record at a time: any edit, deletion or reordering makes the check fail at that spot. But whoever holds a device's private key could build a whole new chain from scratch and sign it, and that chain would check out on its own. That is why receipts sync to Verfy Team: the server keeps the hash of every receipt it has received and refuses a different one in the same place. A ledger that never left the machine has no such outside copy.
Today everything is free: the CLI and the GitHub Action under the MIT license, and the self-hosted Verfy Team on your own Vercel and Supabase projects. A hosted Verfy Team (shared policy, receipt archive and audit-ready evidence exports) is planned at $19 per seat per month. It is not on sale yet.
Free to start. The CLI is MIT-licensed, and Verfy Team runs on your own Vercel and Supabase projects.