Does it work with my AI coding agent?

That's the point. Refactron verifies a diff whoever authored it: Cursor, Claude Code, Copilot, Codex, a codemod, or you. The MCP server ships today, so your agent can call verify_change on its own work before it lands.

What does UNPROVEN mean?

Your tests pass, but the changed lines aren't actually exercised by any test, so “green” proves nothing. We say so explicitly and list the tests to add, instead of hand-waving.

Does my code leave my machine?

No. Refactron runs locally against your real test suite in an isolated shadow tree. Nothing is sent to an external service to make the verdict.

How is this different from just running my tests in CI?

CI tells you the suite went green. It does not tell you whether a single test executed the lines you changed. Refactron checks that after the suite runs, and returns UNPROVEN when the answer is no, so a green run on untested code stops reading as proof.

What ships today vs. what's coming?

Shipping today: the CLI (npm install -g refactron) and the MCP server, which exposes one tool, verify_change. Changed-line coverage is proved on Python today; a TypeScript diff runs every gate and caps at UNPROVEN. In early access: the hosted CI gate. Verification needs a token, so join early access to get one.

All releases

Oct 11, 2026 · v0.4.7

A Diff That Weakens Its Own Tests

A change that also relaxed the tests that would catch it made the weakened suite pass, and on the trusted path that read SAFE. Deleting an assertion, removing a test, adding a skip: the gate measured the suite the diff had just rewritten. A would-be SAFE is now UNPROVEN, naming the file.

Om Sherikar

verify-diff and the MCP verify_change tool run the post-diff suite. That is the right suite to run, because it is the one the change ships. It is also a suite the change is free to rewrite.

A diff that relaxed the tests which would have caught it made the weakened suite pass, and on the trusted path (--trusted) that read SAFE. Remove an assertion, delete or rename a test, add a skip: the gate measured exactly what the diff told it to measure. When a diff weakens a test file, a would-be SAFE is now reported UNPROVEN with a reason naming the file.

What counts as weakening

A net drop in assertions. pytest assert, including a compound foo(); assert x, and unittest self.assertX / self.fail.
A test function whose name disappears, by def or async def.
Added skip or xfail markers. @pytest.mark.skip, skipif, xfail, pytest.skip(), unittest.skip, self.skipTest.
Assertion text inside strings and docstrings does not count, so a docstring mentioning assert cannot manufacture a result either way.

The report gains testWeakening ([{ file, reasons }]), present only when weakening was found. reportVersion stays 1 and engineVersion marks the change. Untrusted diffs are unaffected, because their SAFE was already withheld in 0.4.6.

What this does not catch

Weakening that keeps the assertion count the same is not detected: a loosened comparison, compensating assertions, an early return. And any weakened test file counts, not only the one covering the change. Both limits can only leave a previous verdict standing; neither can produce a SAFE.

Dependencies

Transitive production dependencies are updated to clear new advisories: proxy-addr (critical), hono (high and moderate) and ip-address (moderate), all reached through @modelcontextprotocol/sdk, which moves from 1.30.0 to 1.32.1. No declared dependency ranges changed.