Verificate MCP — your vibe-coded MVP, all the way to production

Real output from the live server: 12 lines of AI-written payment code — rejected, fixed, approved, in seconds.

You vibe-coded the demo. This ships it. Between a working demo and a launched product used to stand an experienced CTO and a senior dev team — the people who catch the mock refund path, the invented SDK call, the loop that dies at real traffic. Verificate MCP is that review team as an MCP server: 17 deterministic reality gates with veto power, fused with a frontier-model enterprise review (ISO/IEC 25010: performance, scalability, reliability), run on every AI-written change before it reaches your codebase. The AI writes; the gate holds the bar; you ship. Hosted, zero-install, binary verdict in seconds — in Claude Code, Cursor, Windsurf or any MCP client.

Not another linter wrapper. The code-quality shelf on every MCP directory is two things: scanners (ESLint, Semgrep and SonarQube bridges — deterministic rules, no judgment) and prompt relays that pipe your repo to your own LLM key (self-review with extra steps). Verificate is neither: the gates hold veto power that no model output can override.

Your coding assistant writes a mock and calls it done. It invents an SDK call that doesn't exist. It ships an N+1 loop that passes every test and dies under load. Verificate MCP runs the deep review pass on every AI output — deterministic reality gates first (any one can veto), then an enterprise-grade review scores what survives — before the code reaches your codebase.

A real rejection (verbatim)

12 plausible lines of AI-written payment code were sent through the production gateway. Verdict: REJECTED — score 30.8/100, vetoed by code_reality_gate, with findings including:

"N+1 synchronous API calls … For 100 items, this results in 100 sequential HTTP roundtrips, taking ~10–20 seconds and blocking the event loop/worker thread … will trigger Stripe rate limiting (100 req/sec limit)." "stripe.Inventory is not a valid Stripe SDK resource." "Floating-point representation issues lead to rounding errors in financial transactions; Stripe API requires integer cents."

Each of those is an afternoon of production debugging, caught in seconds.

Measured — vs. asking the model to review its own code

A frontier model asked "is this OK to merge?" in a natural workflow missed reward-gaming (a test that only does assert True) and a hallucinated API (stripe.Refund.create_partial) in 0 of 6 runs each. Verificate's gate caught both 6 of 6 — deterministically, with 0 false positives on clean code.

Battle-tested: 2,581 audited validations over 5 weeks (66 rejected, 270 flagged unfit), including guarding the write-path of a 21M-entity source-cited knowledge base (98.6% cited, 100% licensed across 268 sources). Reproduce it: scripts/ · full write-up: COMPARISON.md.

Tools

Each tool has one job — two gates that return verdicts, one advisor that doesn't, one generator:

Beyond tools

The server also ships prompts and resources for a richer client experience:

• Prompts gate_my_changes / review_my_plan — one-click workflows that loop validate → fix → re-validate until approved.
• Resources verificate://gates (what each of the 17 deterministic gates watches for) and verificate://example-verdict (a verbatim production rejection).

Quick start — no signup, no token, 30 seconds

Every machine gets 25 free validations — no account, no card, no key. Add the URL and go:

Claude Code

claude mcp add --transport http verificate https://mcp.verificate.ai/mcp

Cursor / VS Code — one-click install:

LM Studio and Goose one-click buttons are at https://verificate.ai/mcp (GitHub strips their custom-protocol links).

Windsurf / any MCP client (JSON)

{

  "mcpServers": {

    "verificate": {

      "url": "https://mcp.verificate.ai/mcp",

      "transport": "http"

    }

  }

}

Cursor: ~/.cursor/mcp.json. Windsurf: ~/.codeium/windsurf/mcp_config.json.

Then ask your assistant to "validate this function with verificate" — a structured verdict comes back in seconds, and every free-tier response shows how many validations you have left and what the gate has caught for you.

Keep going after the free 25

Sign up at https://verificate.ai/auth/signup (30-day trial, no card — then $30/mo) and add your token to the same config:

claude mcp add --transport http verificate \

  https://mcp.verificate.ai/mcp \

  --header "Authorization: Bearer YOUR_TRIAL_TOKEN"

or in the JSON config add "headers": { "Authorization": "Bearer YOUR_TRIAL_TOKEN" }.

Make gating the default

Tools an agent may call are tools it will skip under pressure. Add a standing rule (Claude Code: CLAUDE.md; Cursor: a rule file):

Before presenting any substantive code change as complete:

1. Call validate_ai_output on the change.

2. If the verdict is REJECTED, fix the findings and re-validate.

3. Never claim tests pass or systems are deployed without proof.

One-paste setup prompts that install these rules for you: PROMPTS.md. Or wire it into CI as a merge gate — see examples/.

How it decides

AI output ──► Reality gates (deterministic, any one vetoes)

              • mock/placeholder in the wire path

              • invented/hallucinated APIs

              • claimed-complete without proof

              • gaming & bypass detection

                       │ survivors only

                       ▼

              Enterprise review (ISO/IEC 25010 + MLOps)

              performance · scalability · reliability · tech debt

                       │

                       ▼

              Verdict: score /100 + severity-ranked findings

              (REJECTED = agent fixes findings and re-validates)

The two stages are deliberately separate: if reality and quality were blended into one score, a beautifully structured function that fakes its refund path could still average out to "acceptable." A veto architecture makes that impossible.

The category, honestly

Everything else on the MCP code-quality shelf is free — and that's fair, because a wrapper should be free. What you can't get for free is judgment with authority: