Verification Engine

AI code verification tools

Review AI-written changes with Zof’s local static checks and portable evidence. Evaluate broader verification and production controls against your own workflow.

Read the local tool setupReview scope and limits
Who this is for

For engineering and QA teams deciding how to check AI-written code before merge. A generated change still needs independent review, tests and an explicit release decision.

What Zof does

  • An independent check

    Zof is an independent verification and control layer between AI and production. Start by checking the change, recording what was checked, and keeping missing evidence visible to the reviewer.

  • Released local tools

    The CLI, MCP server, VS Code extension and GitHub Action provide local static analysis. They inspect supported source changes and report findings without requiring a Zof account. Static verification does not run your application.

  • Platform evaluation

    The Verification Engine is the platform path for broader testing and control. Confirm the checks, connectors, evidence retention and approval enforcement available in your proposed deployment. Installing the CLI does not connect it to the hosted platform.

In your workflow

From a change to a review decision

  1. 01

    Select a change

    Choose a supported repository and an explicit diff or changed files. Keep existing code review, unit tests and CI checks in place.

  2. 02

    Inspect the result

    Run a released local tool. Read findings, changed-file scope and incomplete execution. A clean static report means only that its checks found no matching issue.

  3. 03

    Make the decision

    Review the report alongside executed tests. Configure your CI rules explicitly if a result should block merge. A local report alone does not enforce a production gate.

Try the released synthetic fixture

npm install --ignore-scripts --save-exact @zof-ai/cli@0.1.2
npx --no-install zof verify --root node_modules/@zof-ai/cli/examples/clean --changed math.ts --json

Run in a new empty directory after reviewing the package. Version 0.1.2’s clean fixture returns a static-analysis pass with tests: []. This is a tool smoke check, not a customer result or proof that tests ran.

Reviewable records

What evidence you get

  • Static findings

    The CLI reports check results with severity and file locations. Its JSON evidence identifies static analysis separately from runtime tests.

  • Execution status

    For zof verify, exit 0 means a completed static check, 1 a finding at the configured severity, and 2 invalid, missing or incomplete verification. An incomplete check is not a pass.

  • Portable reports

    The GitHub Action produces JSON, Markdown, SARIF and portable evidence. Review the exact report and tool version before wiring a result into a merge rule.

Prerequisites and limits

  • CLI prerequisites: Node.js 22 or 24; Linux or macOS with Python 3.10 or newer for file operations. Git is needed for revision analysis. Windows file operations fail closed.
  • Supported static checks cover JavaScript, TypeScript and Python patterns. They can miss defects and do not prove functional correctness, security or compliance.
  • Running trusted configured tests through the CLI requires explicit --allow-exec. That command is not a sandbox. The static example below never executes application code.
  • No verified public hosted API client or automatic upload path is included in these local releases. Validate platform integration in a scoped evaluation.