Skip to content

Verum v0.1.2

Choose a tag to compare

View all tags
@IBMark IBMark released this 19 Aug 14:24
· 72 commits to main since this release
v0.1.2
ba21e7b

Verum is a deterministic, whole-program code analyzer. The same source tree always produces byte-identical ids, findings, and score, so it works as a CI gate you can diff.

Install

cargo install verum

Or download a prebuilt binary for your platform below. This release links TLS with rustls instead of OpenSSL, so it builds and installs cleanly on musl/Alpine and aarch64 as well.

What it does

  • Languages: PHP, Rust, JavaScript, TypeScript, Python, Go, Java, plus Kubernetes YAML, Dockerfiles, and Terraform.
  • Analyses: dead code, duplicates, taint-based security (SQLi/XSS/path traversal), complexity, naming, dependency audit, and infrastructure checks.
  • Three ways to use it: the verum CLI, a library (verum on crates.io), and an MCP server that serves the analysis to coding agents as a token-cheap fact layer.
  • CI-ready: verum gate exits non-zero on threshold failure; verum baseline fails only on findings new since a snapshot.

Prebuilt binaries: Linux (gnu/musl), macOS (x86_64/arm64), and Windows.

Assets 8
Loading