Aurite Agent Verifier
Find security gaps, code quality issues, and risky agent patterns before code ships.
- Source repo
- Aurite-ai/agent-verifier
- Stars
- ★ 45
- Last updated
- 11d ago
- License
- MIT
- FA score
- 52/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free, no paid service needed
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A team asks its coding assistant to check source code for hardcoded secrets, external input validation, and exposed error details before merging or release.
- Not a fit if
- Teams that require deterministic parser results on every run
- Teams expecting the verifier to bypass their coding assistant’s data policy
- Source review
- 52/100 · Major gaps
What does this agent do, and when should you use it?
Aurite Agent Verifier is a set of verification skills for coding assistants including Claude Code, Cursor, Windsurf, Roo Code, and Codex. The verification orchestrator runs security, agent-pattern, quality, and language checks when you invoke “verify agent”; individual checks can be run separately. It examines project files and prompt content for issues such as secrets, input validation, loop and retry limits, tool references, context size, and practices for Python, TypeScript, and Go. It returns a structured report with passes, warnings, issues, locations, and suggested fixes. It runs in standalone mode by default; installing Kahuna enables organization rules and additional context.
After installation, invoke the full verification suite in your coding assistant with “verify agent,” or use “verify agent security,” “verify agent patterns,” “verify agent quality,” or “verify agent language” for focused checks. The skills read project code, dependency configuration, prompts, and tool definitions available to the assistant. They check security and quality rules, loop and retry safety, consistency between tool references and registered tools, prompt context size, and documented framework patterns for LangGraph, CrewAI, AutoGen, and LangChain. The result groups passes, warnings, and issues by category and includes locations and suggestions. The coding assistant performs the checks; reports distinguish pattern-matched checks from heuristic checks, which may vary by model or run.
- A team asks its coding assistant to check source code for hardcoded secrets, external input validation, and exposed error details before merging or release.
- A developer building a LangGraph, CrewAI, or AutoGen agent checks loop safety, retry limits, and whether referenced tools match the definitions.
- An engineer on a Python, TypeScript, or Go project checks type annotations, strict typing, error handling, and dependency version declarations.
- A developer investigating oversized prompts or tool descriptions runs a focused pattern check and reviews the suggested fixes.
- A team that wants organization-specific coding rules installs Kahuna and uses enhanced mode to query its knowledge base and apply those rules.
How do you install or deploy this agent?
Use a Node.js environment to run npx and the Skills CLI; the README does not specify a minimum Node.js version. Install for the coding assistants you use:
npx skills add aurite-ai/agent-verifier -a claude-code -a cursorIt can also be installed as a Claude Code plugin:
claude plugin marketplace add aurite-ai/agent-verifier
claude plugin install agent-verifier@aurite-aiThe README does not require a separate API key; the installed coding assistant performs verification.
How do you use this agent?
In a project where the skill is installed, ask your coding assistant:
verify agentFor a focused check, use:
verify agent securityOther focused triggers are verify agent patterns, verify agent quality, and verify agent language. The report groups check results by category and gives finding locations and suggested fixes.
What are this agent's strengths and limitations?
- Offers a full verification suite plus four independently invokable skills, so teams can choose the scope of a review.
- Checks agent-specific patterns including loops, retry limits, hallucinated tool references, and prompt context size.
- Documents checks for Python, TypeScript/JavaScript, and Go, plus framework checks for LangGraph, CrewAI, AutoGen, and LangChain.
- Kahuna can add organization rules in enhanced mode, while standalone mode uses built-in checks.
- The coding assistant performs the checks; the README says heuristic findings can vary by model and run.
- It requires an installed compatible coding assistant and is not a standalone deterministic static analyzer.
- The coding assistant reads project files and handles them under its provider's data policy, so code is not guaranteed to stay on the machine.
- The README does not specify a minimum Node.js version or feature differences for each supported platform.
How does this agent compare with similar options?
The README compares Agent Verifier with ESLint/Biome, Semgrep, and manual review. It focuses on agent patterns, context management, and hallucinated tool references that those approaches may not cover; the README says it complements rather than replaces traditional linters.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Aurite Agent Verifier This agent | 52 · Major gaps | Agent plugin / skillFree | ★ 45 | 11d ago | — | Codex · Claude Code |
| 500+ AI Agent Projects & Use Cases | 21 · Major gaps | CLIFree + model costs | ★ 39k | 2mo ago | Python | — |
| LoopGain Loop Controller | Insufficient evidence | Library / SDKFree | ★ 126 | 24d ago | Python | — |
| Maestro Orchestration Platform | 75 · Some gaps | Agent plugin / skillFree + model costs | ★ 485 | 1d ago | JavaScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The evidence says the skill itself makes no network calls or collects data; the user's existing coding agent reads the code under that agent's data policy. This supports limited inherent permissions and some data flow transparency. The documents do not explain when user confirmation is required, dedicated sensitive-data handling, or how dependency security is checked; they also provide no rollback procedure for installation or updates. The project name and contact channels offer some attribution, but the supplied material does not verify publisher identity, so these areas lose points.
The materials acknowledge that heuristic checks may vary and distinguish pattern-matched from judgment-based findings, but also describe several checks as reliable or automatic without source code here to substantiate runtime behavior. Installation depends on Node.js and an external skills CLI; troubleshooting covers common installation problems but not verification failures, so consistency, dependency availability, and failure messages earn only partial credit.
The documentation covers security, patterns, quality, and language checks, gives full-suite and focused trigger phrases, and lists Python, TypeScript/JavaScript, Go, and several frameworks. It describes standalone mode, optional Kahuna integration, and heuristic limitations. Scores are limited because the claimed support range and automatic detection are documented assertions without implementation details in the supplied evidence.
The README provides a table of contents, architecture, installation and usage instructions, a sample report, and common installation troubleshooting; getting-started and installation tutorials add structure. Naming is generally stable and a license is clearly identified. The materials describe heuristic limitations but include no changelog or named maintenance owner; contribution channels and an email do not establish a maintenance commitment, so maintenance and versioning receive partial credit.
The sample report shows passes, warnings, issues, locations, and suggestions, and focused invocations let users target categories. This makes the expected output and potential value understandable. The evidence does not explain false-positive control, how findings connect to actual fixes, or the cost-benefit tradeoff; utility is primarily supported by documentation examples and claims.
The README lists check categories, specific patterns and thresholds, and separates pattern-matched from heuristic checks; it also states that results may vary by model. These details support some traceability and separation of fact from judgment. The supplied material contains no skill definitions or implementation source with which to verify each rule, and repeated project documentation is not independent corroboration.
- This is a static review of the supplied documentation and fixtures; skill definitions and implementation source were not provided, so actual check behavior cannot be confirmed.
- The documentation says the coding agent reads project code and sends it to its model provider; whether data stays local depends on that agent's policy.
- The documentation acknowledges that heuristic checks may vary by model or run, so users should review findings.