Execution-backed verification · local-first

AI writes code fast. It leaves it unverified.

CodeVetter binds the requested task to the exact change, runs your repository's own checks, and keeps a pass, fail, or unverified verdict with the evidence and limits behind it.

Run a verification Get the macOS build

Apple silicon · open source (ISC) · no CodeVetter account

CodeVetter desktop review workbench showing a local review result, finding list, evidence status, and code inspection panel — Repository-tracked capture of the desktop workbench

The contract

The unit of trust is the whole chain.

A finding or a green command alone is not proof. CodeVetter keeps task identity, execution, evidence, and uncertainty connected, so another engineer, or another agent, can re-check the result.

Task and change, bound: The requested outcome and the exact agent revision travel together, so the verifier cannot quietly grade an easier task.
Checks decide: Repository-owned tests, builds, browser flows and API checks set the verdict boundary. A model can suggest what to test; execution decides.
Unknown stays unknown: Missing or irrelevant evidence produces unverified, not a confidence score dressed up as success.

Failures stay attached

Point at the line the verdict is about.

A failing check is linked back to the exact change that caused it, with the command, the bounded output and the limitation, so a reviewer can confirm it in seconds instead of re-running everything.

Bundled CLI

Run the exact change from your repository.

The Apple-silicon release bundles the codevetter CLI and a local MCP sidecar inside the app. Provider-backed review needs a supported local agent CLI; repository-owned checks remain the verdict boundary.

zsh — ~/work/auth-service

# bundled at /Applications/CodeVetter.app/Contents/MacOS/codevetter$ codevetter check     --range main...HEAD     --task "Reject expired sessions"     --json✗ fail        pnpm test auth/session.test.ts✓ pass        pnpm typecheck? unverified  browser refresh journey

Published evidence

Proof that survives the next question.

The public corpus measures a narrow recognition task. It is not evidence of production-wide accuracy or adoption, and the page says so.

27 synthetic cases: Inputs and scorer are inspectable.
29 labelled findings: Bounded recognition evidence.
No hosted verifier: Execution and state stay local.

Available today

Models can suggest. Execution decides.

No placeholder plans, unsupported installers, or hosted-service promises. Optional model review goes straight to the provider you configure.

macOS · Apple silicon: The current GitHub release publishes an aarch64 DMG and updater archive. Other platforms are not published yet.
Local, no account: Product state and verification evidence live on your machine. Model review uses the Anthropic, OpenAI or OpenRouter credentials you configure.
Open source · ISC: The repository, benchmark cases, scorer, docs, and release workflows are public on GitHub.

Understand the boundary.

Scope, evidence, and availability, answered plainly.

What is CodeVetter?

An execution-backed verification and evaluation system for coding agents. It connects a requested task and exact agent change to executable checks, retained evidence, explicit limitations, and a pass, fail, or unverified verdict.

Is it another AI code reviewer?

Review is one input, not the authority. A model can identify suspicious code and suggest what to test, but CodeVetter treats task-relevant execution evidence as the verdict boundary.

Does my repository go to a CodeVetter server?

No hosted verification backend is required. Product state and execution evidence stay local. If you start an optional provider-backed review, selected prompt and code context go directly to the provider you configured.

Does it work offline?

Local checks, stored evidence, and the desktop viewer work without a CodeVetter service. Reviews that call Anthropic, OpenAI, or OpenRouter still need network access to that provider.

What does a verdict prove?

Only the declared task and evidence boundary. A pass does not prove behavior that was never checked, and missing or irrelevant evidence stays unverified instead of becoming confidence.

What can I download today?

The current GitHub release has an Apple-silicon macOS DMG and updater archive. Source is ISC-licensed. Other platform installers and a Homebrew cask are not published yet.

“Looks good” is not a verdict.

Inspect the evidence contract first, then download the current local desktop build from the GitHub release.

Open the latest release Inspect the public benchmark

No CodeVetter account · local SQLite state · ISC license