Verirun MCP server

Read from the package source without running it. The installed server may list more.

• assert_evaluate

  Register an assertion (provenance is FORCED to AGENT_RELAY — relayed requirements carry no CONFIRMED authority) and have the evaluator collect ITS OWN evidence to a PASS/FAIL/INCONCLUSIVE verdict. Timing lives in a nested `temporal` object — `{kind, ..., temporal: {within_ms, settle_ms, after_ref}}`: within_ms polls positives, negatives only FAIL after settle_ms fully elapses, after_ref anchors th

• fixture_prepare

  Prepare fixture files inside the granted scope. Before-state is backed up into the run record; compensating restore runs at teardown even if this process dies (sweep).

• observe_filesystem

  Observe a file or directory inside the granted scope: existence, size, mtime, optional SHA-256, dir listing. Recorded as OBSERVER evidence.

• observe_http

  Read a declared http(s) endpoint and record what the SERVER returned — status, size, sha256, body and the addresses the host resolved to — as OBSERVER evidence. This is the evidence layer for web apps whose effect lands on a server rather than on disk. Read-only: GET/HEAD only, no credentials, and redirects are NOT followed (a 3xx comes back as data so a redirect cannot carry the read outside the

• observe_logs

  Tail a text log file inside the granted scope. The tail arrives fenced as untrusted app text.

• observe_screenshot

  Capture the target window as PNG evidence stored in the run record (outside the workspace).

• observe_sqlite

  Read-only SQLite observation inside the granted scope. Only row-returning single statements (SELECT/WITH); rows are fenced as untrusted app data.

• replay_propose

  Propose a verbatim replay of this run's recorded actions. Replay is NON_REPLAYABLE by default — the agent can only propose; execution needs user authorization (REPLAY_AUTHORIZED_BY_USER) out-of-band. Authorization ≠ safety.

• requirement_register

  Register a requirement RELAYED by the agent. It is recorded with AGENT origin and carries no verification authority by itself.

• run_stopwrite action

  Stop the run: state-machine-owned teardown (kill target tree), watcher health consulted (a dead watcher forces fail-closed INTERNAL_ERROR), resolution written.

• scope_request

  Request additional scope mid-run. Request ≠ Grant: V0 records the request and returns PENDING_USER — no runtime grant, never retroactive.

• target_launch

  Launch the target app process and wait for UI readiness. Returns pids/hwnd receipt.

• ui_act

  Act on the target UI. Tier A: invoke/set_value (UIA patterns, no injection). Tier B: send_keys via post-message (HWND-targeted; cannot type into most text boxes — measured). Tier C: send_keys via send-input or click (OS-wide, needs allow_input_injection on the user side; focus pre-check + abort-on-focus-loss enforced).

• ui_inspect
• ui_search

  Find elements by name/automationId text (or semantic slug) ANYWHERE in the target tree, at any depth. Use this when ui_inspect returns depthCapped or an element is not in the inspected tree: web/Chromium content nests past any fixed depth (measured: a 40-level page keeps its button below depth 32, where this search still finds it). Returns up to 50 matches with slugs; app text arrives fenced as UN

• verify_begin

  Begin a verification run. Declared scope paths and endpoints are validated and bounded (over-broad declarations are refused). Returns run_id. One active run per server.

• verify_finalize

  Finalize the run: evaluator-derived verdict-of-record (CONFIRMED only from SYSTEM_DEFAULT invariants in V0), report.md/verdict.json rendered with untrusted-text escaping, per-target anti-gaming counts, then state-machine teardown.

• wait_until

  Wait for an element to appear/disappear or reach a value. This is the observation primitive for effects — receipt ≠ effect.

• Code scan85 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancerepository not readable: repo not found3/15
• Maintainer identityno repository or website to verify2/10

Verirun: common questions

Is Verirun MCP server safe?

With care: it is graded C, so read the findings first (65/100). Read the Verirun safety report

How do I install Verirun?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Verirun need an API key?

No secret keys are declared. It reads 3 settings from the environment.

Is Verirun maintained?

The latest release is v0.2.1-dev.

What can I use instead of Verirun?

Servers from other publishers that do the same job: MCP server, ContextStream MCP Server and Orcareplay MCP server. Compare all Verirun alternatives.