) Productrefactron / products

Verify any diff.Whoever wrote it.

npm install -g refactron
DocumentationGet early access

Run it yourself.Or let the agent.

The same engine either way. You get a verdict in the terminal; your agent gets the same verdict as JSON, before it lands anything. A Python wrapper is published on PyPI as refactron, but it shells out to this same CLI and still needs Node 18 or newer.

Your terminal
Your agent

Three verdicts,told apart by shape.

The third is the one nobody else gives you. A suite that passes without ever running your change has proven nothing, and saying so is the whole job.

safe

Green. The changed code is covered and your tests pass.

unsafe

Red. A test broke under the change.

unproven

Tests pass, but the changed code isn't exercised.

A verdict you canstake a merge on.

Everything the gate does, it does against the suite you already have.

Isolated shadow tree

The diff is applied to a throwaway copy of your repo. Your working tree is never touched, whatever the verdict.

Changed-line coverage, on Python

Coverage attestation is proved on Python today. A TypeScript diff runs every gate and caps at UNPROVEN rather than claiming a proof it can't make.

Coverage preflight

Checks whether a test actually executes the changed lines. Green without that is UNPROVEN, not SAFE.

Flaky-aware

New failures are computed against a green baseline and rerun once on a fresh tree, so a flake cannot be blamed on your diff.

Reproducible report

Base tree, diff, test set and shadow-tree hash, all recorded, so anyone can rebuild the tree and land on the same verdict.

Runs on your machine

No upload and no account needed to get a verdict. The gate reads your repo and your suite, locally.

One tool,any client.

The gate runs as an MCP server exposing exactly one tool, verify_change. It speaks stdio, runs on your machine, and never writes to your repository: applying the change stays the agent's job, after a verdict it can trust.
Claude CodeCursorVS CodeCodex CLIGemini CLIWindsurf
Designed, not shipped
Next

A gate for CI,once it earns it.

The CI check is designed and is what we build next. The number that made us confident: across six runs against a repo carrying a genuine one-in-three flaky test, zero false UNSAFE verdicts. A gate that blames your diff for a flake gets uninstalled within a week, so we measured that before building it rather than after.

Coverage attestation is Python only today, through coverage.py. A TypeScript or mixed-language diff runs every gate but cannot reach SAFE: it returns UNPROVEN and says why. That is the honest answer rather than a flattering one.

) get early access

Verify your agent's PRs before anyone else.

The MCP server and CI gate are being built in the open. Join as a design partner and shape the trust layer your team will run.

No spam, just the verification layer, early. By joining you agree to our Privacy Policy.