Quickstart

$ pip install verfy
$ pip install "verfy[fast]"      # optional: faster signing
$ verfy init
$ verfy check "git push --force"   # exit 1: needs approval

$ verfy hook install            # print the settings change
$ verfy hook install --write    # save it (backup kept)
$ verfy ledger show
$ verfy verify

$ verfy scan --discover                       # static: how servers are launched
$ verfy wrap ~/.cursor/mcp.json --write       # put servers behind the gateway
$ verfy lock status                           # after first use, tools are locked
$ verfy lock diff filesystem                  # if a definition drifted
$ verfy lock approve filesystem               # review, then accept

$ verfy lock check --update     # shows each definition and its scan findings, then writes verfy.lock
$ git add verfy.lock .mcp.json && git commit -m "Lock MCP tools"

name: Verfy Lock
on: [pull_request, push]
permissions:
  contents: read
jobs:
  lock:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.13"
      - uses: anvarbekovjavohir277-dot/verfy@main   # not public yet; see the note below
        with:
          config: .mcp.json
          lock: verfy.lock

$ verfy scitt export --out statements/ --issuer https://acme.example/devices/laptop-1
$ verfy key --json > signer.json
$ verfy scitt verify statements/*.cose --pub signer.json

$ verfy team enroll --url https://verfy.example.com --code atle_…
$ verfy sync            # run it from cron or CI; never inside the hook
$ verfy team pull       # team policy and approved locks

{
  "on_ask": "deny",
  "fail_mode": "ask",
  "tools": {
    "deny": [
      "github/delete_*"
    ],
    "ask": [
      "merge_pull_request"
    ]
  },
  "network": {
    "allow": [
      "github.com",
      "*.python.org"
    ],
    "unknown": "ask"
  },
  "rules": [
    {
      "id": "no-prod-db",
      "pattern": "prod-db",
      "verdict": "deny",
      "message": "Production is off-limits."
    }
  ],
  "lock": {
    "on_new": "ask"
  },
  "receipts": {
    "include_args": false
  }
}