Find what can run
Lockfiles, manifests, scripts, framework entry points, and committed test settings define the plan. Verity stops if they disagree.
Source beta 0.1.0-beta.2 is available
Know what actually runs.
Verity reads the files that define how a project runs, checks an isolated copy, and signs a local receipt only when the required tests and run checks pass.
No loginNo telemetryMPL-2.0
InputA copy of your repository
CheckWhat passed on this machine
OutputA signed local receipt
LimitNot a security certificate
See why each command ran.
Verity does not copy commands from a README or guess how a project should run. It uses committed project files, records the machine environment, and keeps the result with the receipt.
Execute an isolated snapshot
The repository fingerprint is recorded before execution. Escaping links and source changes invalidate the run instead of being silently accepted.
Check real behavior
Declared tests, health checks, browser behavior, or committed smoke tests must pass. A running process or open port is not enough.
Sign the result
The receipt ties the result to the repository copy and machine environment with a local Ed25519 signature. You can check it again without sharing logs or source.
Support varies by stack.
Finding a target does not mean every check is ready. Verity reports whether the plan is complete, whether the target can run on this machine, and how strong the final check is.
Web and application stacks
Node.js, Deno, Bun, static web, Python, Go, Java, Kotlin, .NET, PHP, Ruby, and Docker Compose.
detected from committed runtime evidenceNative and toolchain stacks
Rust, Tauri, Godot, C, and C++ use container execution or an explicitly confirmed native snapshot when required.
native execution is never a malware boundaryWhat "verified" does and does not mean
Trusted source only
Verity is not designed to contain hostile code or decide that unknown software is safe.
Snapshot bound
A repository change after the recorded run makes the receipt stale for the current files.
Local signature
The signature detects tampering for this installation. It is not remote attestation or third-party certification.
Local data
Raw receipts, paths, logs, source, and command output remain on the current machine.
Read the code behind the result.
The Desktop app, CLI, adapters, runner, and receipt code are open source under MPL-2.0. Download the source beta or inspect it on GitHub.