Skip to content

Verum v0.1.3

Choose a tag to compare

View all tags
@IBMark IBMark released this 19 Aug 15:20
· 67 commits to main since this release
v0.1.3
3182c91

Deterministic, whole-program code analyzer. cargo install verum, cargo binstall verum, docker run ghcr.io/ibmark/verum, or grab a binary below.

New in 0.1.3

  • SARIF output - verum report . --format sarif emits SARIF 2.1.0, so findings upload to GitHub code scanning and show up as pull-request annotations and in the Security tab.
  • MCP tool annotations - every tool is marked read-only / idempotent / non-destructive, so agent clients can safely auto-approve and cache calls.
  • More install paths - cargo binstall verum fetches the prebuilt binary, and a container image is published to ghcr.io/ibmark/verum.
  • Added a pre-commit hook and Dependabot config.

What it does

Maps a codebase (PHP, Rust, JS/TS, Python, Go, Java + Kubernetes/Docker/Terraform) into one IR and runs dead-code, duplicate, taint-security, complexity, naming, dependency, and infrastructure analyses with byte-identical, reproducible output. CLI, library, and MCP server.

Prebuilt binaries: Linux (gnu/musl), macOS (x86_64/arm64), and Windows.

Assets 8
Loading