Verirun gives a coding agent an agent-independent way to prove that the software it just built actually behaves correctly — by launching the app, driving it, and collecting its own evidence (UI tree, filesystem, SQLite, process state, logs), then producing a verdict-of-record the agent cannot fabricate through the MCP/API surface.

The agent connects to Verirun as an MCP (stdio) client. It is treated as an untrusted planner: it may request actions and relay requirements, but every receipt, observation, and verdict is stamped by Verirun itself. A requirement the agent relays carries no authority — a CONFIRMED verdict comes only from Verirun's own invariants (e.g. "the target must not crash or hang") or from a requirement the user authored directly.

What it is (and is not)

Is: independent evidence collection + an auditable verdict-of-record. When the UI says "Saved" but the file was never written, Verirun catches it from the filesystem — not from the app's own claim (receipt ≠ effect).
Trust boundary (V0, stated honestly): the run record is protected against fabrication via the MCP/API surface. It does not detect out-of-band tampering by another same-user process with file-write access. This is a TCB limitation, published as-is — not a marketing claim.

Requirements

Windows 10/11.
Node.js ≥ 22. On an LTS Node, the native dependency (better-sqlite3) installs from a prebuilt binary — no C++ build tools needed. On a brand-new non-LTS Node a prebuild may not exist yet; use an LTS Node or install the Windows build tools if the install falls back to compiling.

Quick start

# Run the MCP server (stdio). Point your coding agent's MCP config at this.
npx verirun mcp

# Environment self-check.
npx verirun doctor

Before publishing a release, run a manual pre-publish smoke: npm ci → npm test → npm pack → install the tarball on a clean prefix → verirun doctor. Publish by hand with npm publish --provenance and 2FA.

Claude Code — .mcp.json
Codex — MCP server config
Cursor — mcp.json

How a run works

verify_begin — declare the workspace + the scope paths this run may touch. Over-broad scope (drive root, user profile, workspace root) is refused.
target_launch — Verirun launches the app and starts a supervised watcher.
Drive the app: ui_inspect, ui_act (tiered input), wait_until.
Assert on evidence: observe_filesystem, observe_sqlite, observe_logs, assert_evaluate — the evaluator collects its own evidence; cherry-picked agent references cannot steer the result.
verify_finalize — Verirun writes the verdict-of-record (report.md + verdict.json) and tears the run down.

Inspect any run's evidence chain, trust-tagged by origin:

npx verirun show <run-id>

Input tiers (Windows)

Tier A — UIA patterns (invoke / set-value): targeted, no synthetic input.
Tier B — post-message keyed input: HWND-targeted, no focus steal (cannot type into most text boxes — measured).
Tier C — send-input / click: OS-wide, steals focus, can interleave with your typing. Off unless VERIRUN_ALLOW_INPUT_INJECTION=1 (a user-side setting, never agent-declarable), with a focus pre-check and abort-on-focus-loss.

Telemetry

Opt-in only. Nothing is collected or transmitted by default. verirun telemetry on starts local metric capture you can inspect with verirun telemetry show; V0 has no network sink.