Verum v0.1.4

Deterministic, whole-program code analyzer. cargo install verum, cargo binstall verum, docker run ghcr.io/ibmark/verum, or grab a binary below.

0.1.4 - false-positive hardening

Validated by running the analyzer across ~90 real-world repositories and fixing every false positive it surfaced:

• Taint: parameterized ORM/driver methods no longer count as SQL sinks; interprocedural flows skip ambiguously-named callees (a sort()/count() name-collision was reporting phantom SQLi/path-traversal); Express res.send/res.write removed from XSS sinks.
• Length-prefix: recognizes validation helpers/macros (ensure_size!, validate_*, ...) as bound checks and treats u16-and-narrower counts as bounded. (IronRDP: 20 findings -> 2; the genuine unbounded-allocation bugs still flag.)
• Hardcoded secrets: web-asset dirs (public/, static/, assets/, plugins/) and vendored code are auxiliary; templated/interpolated values are skipped.
• BlockingInAsync no longer flags tokio's async .lock().await.
• The fixtures carve-out is scoped to Verum's own suite, so a real project's test corpus is auxiliary again.

Added

• VERUM_PROFILE prints per-pass timing to stderr.

Prebuilt binaries: Linux (gnu/musl), macOS (x86_64/arm64), and Windows.

Verum v0.1.3

Deterministic, whole-program code analyzer. cargo install verum, cargo binstall verum, docker run ghcr.io/ibmark/verum, or grab a binary below.

New in 0.1.3

• SARIF output - verum report . --format sarif emits SARIF 2.1.0, so findings upload to GitHub code scanning and show up as pull-request annotations and in the Security tab.
• MCP tool annotations - every tool is marked read-only / idempotent / non-destructive, so agent clients can safely auto-approve and cache calls.
• More install paths - cargo binstall verum fetches the prebuilt binary, and a container image is published to ghcr.io/ibmark/verum.
• Added a pre-commit hook and Dependabot config.

What it does

Maps a codebase (PHP, Rust, JS/TS, Python, Go, Java + Kubernetes/Docker/Terraform) into one IR and runs dead-code, duplicate, taint-security, complexity, naming, dependency, and infrastructure analyses with byte-identical, reproducible output. CLI, library, and MCP server.

Prebuilt binaries: Linux (gnu/musl), macOS (x86_64/arm64), and Windows.

Verum v0.1.2

Verum is a deterministic, whole-program code analyzer. The same source tree always produces byte-identical ids, findings, and score, so it works as a CI gate you can diff.

Install

cargo install verum

Or download a prebuilt binary for your platform below. This release links TLS with rustls instead of OpenSSL, so it builds and installs cleanly on musl/Alpine and aarch64 as well.

What it does

• Languages: PHP, Rust, JavaScript, TypeScript, Python, Go, Java, plus Kubernetes YAML, Dockerfiles, and Terraform.
• Analyses: dead code, duplicates, taint-based security (SQLi/XSS/path traversal), complexity, naming, dependency audit, and infrastructure checks.
• Three ways to use it: the verum CLI, a library (verum on crates.io), and an MCP server that serves the analysis to coding agents as a token-cheap fact layer.
• CI-ready: verum gate exits non-zero on threshold failure; verum baseline fails only on findings new since a snapshot.

Prebuilt binaries: Linux (gnu/musl), macOS (x86_64/arm64), and Windows.