If you use an AI coding agent long enough, you will see this: the agent says "Done - all tests pass", and it's true only because a test was skipped, deleted, or quietly weakened in the same change.
It's a known failure mode (see anthropics/claude-code#7074). Asking the agent nicely in CLAUDE.md doesn't fix it, because the agent is the one grading its own work.
The idea: don't trust "done", verify it
I built BuildProof around one rule: the agent's claim is never accepted on its word. A separate check decides, and it fails closed - if it can't prove the work is good, the change is rejected.
After Claude Code finishes a turn (as a hook), or on a pull request (as a GitHub Action), it:
- Re-runs the real test suite - not the agent's summary of it.
- Checks the tests really ran - zero tests executed is a failure, not a pass.
- Diffs the tests themselves - any test that was skipped, deleted, or had assertions weakened in the same change blocks it.
- Checks for regressions against the previous state.
- Rolls back rejected changes automatically.
- Signs accepted changes with an ed25519 certificate, so "this passed" is something you can verify later, not just a log line.
What it looks like
The demo page shows real output - a change that "passes" by weakening a test, and how it gets rejected:
👉 https://buildproof.mgrprosnetwork.com/demo
Try it
npm install -g buildproof
Package: https://www.npmjs.com/package/buildproof
Full disclosure: I'm the maker. It's a commercial tool with a 14-day free trial, not open source.
I'd really like feedback from people who run agents on real codebases: what other ways have you seen an agent "fake" a green build? Every trick you've seen becomes a new check.
Top comments (2)
One we see in UI automation: the agent reports "submitted" because the click call returned OK, but the click landed on a modal or the wrong window and the form never sent. Same cure as yours: check the end state, not the tool's own return value.
Does BuildProof also catch tests that pass because they mock the exact code the change touched? (From the Auten team, we build a computer-use MCP.)
Diffing the tests themselves is the part I’d want most, since the agent’s own summary can’t be the evidence. I get at the same problem from a different side: a second model from another family reviews the diff read-only, and the author has to give each finding a verdict. Of 128 findings so far, 120 were real and 6 were false alarms. It doesn’t re-run anything though, so a gate like yours would catch what a read-only review only suspects. Does yours count a test as weakened when an assertion is loosened but not removed?