AI coding agents are changing how we build software. They can generate features, fix bugs, write tests, and help developers move faster.
But there's a question I keep thinking about:
How do we know an AI coding agent changed what we intended it to change?
An agent might implement a feature correctly but also modify unrelated files. It might produce code that looks convincing while leaving some requirements unverified.
Passing tests is important, but it doesn't automatically prove that every intended constraint was respected.
That's the problem I'm exploring with VeriCore.
GitHub: Vericore
What is VeriCore?
VeriCore is an open-source, local-first verification layer for AI coding agents, currently focused on Java and Kotlin repositories.
Its core idea is simple:
Prepare the change boundary before editing. Verify against it afterward.
Instead of relying only on reviewing the final diff, VeriCore establishes a repository-bound change contract before the developer or AI agent starts making changes.
The workflow looks like this:
- Analyze the repository and gather engineering evidence.
- Prepare a change contract describing the intended change and planned files.
- Let your usual AI coding agent implement the change.
- Verify the repository against the original contract.
- Produce a verification result with supporting information.
The coding agent can continue using its normal workflow. VeriCore adds a separate verification layer around it.
Why is this useful?
Imagine asking an AI agent to add input validation to a payment service.
The agent implements the validation, but it also changes an unrelated configuration file.
Your tests might still pass.
However, you asked for a specific change, and the agent made a broader one.
VeriCore's change-safety workflow is designed to detect changes outside the prepared scope and identify problems such as a missing, stale, or mismatched verification contract.
The goal isn't to prevent AI agents from changing code. It's to make the boundaries of those changes explicit and checkable.
Three principles behind VeriCore
- Deterministic evidence first
Repository facts should come from inspecting the repository, not from a language model guessing what the code contains.
VeriCore builds deterministic engineering evidence before optional AI-assisted interpretation.
- Verify against the original contract
VeriCore persists the change contract before editing begins.
Verification should use that original contract rather than silently creating a new one from the already-modified repository.
- Be honest about what has been verified
A tool shouldn't claim that a requirement has been satisfied when it lacks the evidence to evaluate it.
VeriCore distinguishes successful checks from failures and criteria that remain inconclusive or unevaluated.
It is not a replacement for tests, code review, or engineering judgment. A successful verification result does not prove that arbitrary software is semantically correct.
How can you try it?
VeriCore is open source, and the repository includes installation instructions, a CLI, local MCP integration, a REST interface, and a reusable GitHub Action.
Start with the repository:
The basic workflow is:
vericore init
vericore scan --path .
vericore inspect --path .
Before making a change:
vericore prepare "add payment validation" \
--path . \
--planned-path src/main/kotlin/com/example/PaymentService.kt
After the coding agent finishes:
vericore verify --path .
Replace the example file path and change description with the paths and task in your own project. Run your normal tests and review the diff as well.
For installation details and the complete workflow, see the project's documentation.
*What I'd love feedback on
*
I'm interested in feedback from developers who use AI coding agents in real projects.
- How do you detect changes outside an agent's intended scope?
- Would you use a separate verification step in your local workflow or CI pipeline?
- What evidence would you need before trusting a verification result?
- Which integrations would make a tool like this useful in your development environment?
I'm building VeriCore in the open and would appreciate honest feedback, bug reports, and contributions.
The broader idea is simple: as AI agents become more capable of writing software, we also need better ways to verify the changes they make.
AI can write the code. Let's make its changes easier to verify.
Top comments (0)