{"slug": "show-hn-weftgate-a-local-verification-gate-for-coding-agents", "title": "Show HN: Weftgate, a local verification gate for coding agents", "summary": "Developer Avinash Amudala released Weftgate v0.1.1, a local static verification gate that checks environment variables, Python and Node imports, and FastAPI/Starlette route handlers in agent-written code before it ships. The tool runs as a CLI, MCP server, hook, or GitHub Action with no API key, no runtime dependencies, and no network calls on the default verification path, blocking only on a positive, machine-checkable falsehood. Weftgate is an early static analyzer with bounded parsers that does not execute the app or replace tests or a security scanner.", "body_md": "**Catch broken connections in agent-written code before it ships.**\n\nA mistyped environment variable. An import missing from the lockfile. A FastAPI route pointing at a handler that does not exist. Weftgate checks these connections against your repository through one local CLI, MCP server, hook, or GitHub Action.\n\n**No API key. No runtime dependencies. No network calls on the default verification path.**\n\n[Watch the full demo](https://github.com/Avinash-Amudala/weftgate/releases/download/v0.1.1/weftgate-demo-motion.mp4) ·\n[Transcript and reproducible evidence](https://github.com/Avinash-Amudala/weftgate/blob/main/docs/DEMO.md) · [How to write an oracle](https://github.com/Avinash-Amudala/weftgate/blob/main/docs/ORACLES.md)\n\n```\npip install weftgate\ncd /path/to/your/repo\nweftgate doctor                  # see which contracts can be checked\nweftgate audit                   # inspect the current repository\nweftgate check app/main.py        # check a file or directory\n```\n\nFrom source: `pip install git+https://github.com/Avinash-Amudala/weftgate.git`.\nFor development, `bash scripts/bootstrap.sh` installs the extras and runs the offline self-test.\n\nThe demo uses an intentionally broken fixture, not a field benchmark:\n\n```\nREJECT  import 'requestz'       → did you mean requests?\nREJECT  env var 'DATABSE_URL'   → did you mean DATABASE_URL?\nREJECT  handler 'helth'         → did you mean health?\n```\n\nFix the three names and the fixture passes. A computed key such as `os.environ[key]`\nreturns `review`, because static analysis cannot establish its value.\nTo reproduce: `weftgate eval mutate --fixture --seed 13`.\n\n| Result | Meaning | Blocks by default? | \n|---|---|---|\n| `accept` | The extracted reference resolves, or nothing checkable was found. | No | \n| `review` | Evidence is incomplete or the reference is dynamic. | No | \n| `reject` | A hard claim contradicts the indexed contract. | Yes | \n| `unverifiable` | The relevant index or capability is unavailable. | No | \n\nThe rule is **block only on a positive, machine-checkable falsehood**. Suggestions\naccompany findings when a nearby candidate exists. An `accept` verdict is not a test\nsuite result or proof that the application works; inspect coverage with `weftgate doctor`.\n\n| Oracle | Checks | Conservative limits | \n|---|---|---|\n| Environment variables | Reads against dotenv examples, settings schemas, Docker/Compose declarations, code defaults, and configured files. | Dynamic keys and absent declaration sources soften. Declare externally supplied variables in your contract. | \n| Python and Node imports | Imports against dependency metadata, local packages, known package aliases, and supported path aliases. | A manifest alone cannot prove a complete dependency tree. Unknown mappings and optional imports review. | \n| FastAPI / Starlette routes | Handler references, router includes, and route claims using a static AST index. | Computed registration, external modules, and unresolved prefixes cannot be fully verified. | \n\nThis is an early static analyzer with bounded parsers. It does not execute your app,\nreplace tests or a security scanner, or cover every framework. Python, Node, and\nmonorepo import resolution can depend on runtime configuration. Missing or ambiguous\nevidence must soften; please [report a false block](https://github.com/Avinash-Amudala/weftgate/issues/new/choose)\nwith a minimal reproduction. [Historical field runs](https://github.com/Avinash-Amudala/weftgate/blob/main/docs/FIELD-RESULTS.md) document\nmethods and limitations, rather than a claim of zero false positives.\n\n```\nweftgate setup --agents claude,cursor,vscode\nweftgate setup --hooks             # review the generated local configuration\n```\n\nThe standard-library MCP server requires no extra package. Example MCP configuration:\n\n```\n{\"mcpServers\": {\"weftgate\": {\"command\": \"weftgate\", \"args\": [\"mcp\"]}}}\n```\n\nRun the server with the repository as its working directory. `weftgate setup --agents all`\nwrites supported project configs and prints snippets for clients with global settings.\nCLI and MCP use the same gate functions. Tools include `check_change`, `check_claim`,\n`audit`, `suggest`, `index_status`, and `index`.\n\n```\ngit diff | weftgate check -\nweftgate check --staged\nweftgate check --path app/main.py --content proposed.py\nweftgate claim '[{\"kind\":\"route\",\"method\":\"POST\",\"path\":\"/users\"}]'\nweftgate audit --format=json\nweftgate index --show routes\n```\n\nExit codes: **0** allows the change, **1** blocks according to policy, **2** means a\nusage or configuration error. Use `--format=github` for workflow annotations.\n\n```\nname: Verify connections\non: [pull_request]\npermissions:\n  contents: read\njobs:\n  verify:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v5\n        with:\n          fetch-depth: 0\n      - uses: Avinash-Amudala/weftgate@v0.1.0\n        with:\n          mode: check             # or audit to inspect the repository\n```\n\nThe Action supports `base`, `paths` (shell-quoted paths, no shell expansion),\n`block-on`, and `python-version`. Use a full checkout for diff ancestry.\nThe [pre-commit hooks](https://github.com/Avinash-Amudala/weftgate/blob/main/.pre-commit-hooks.yaml) use the same gate; pin `rev: v0.1.0`.\n\n```\n# weftgate.toml\n[weftgate]\noracles = [\"env_vars\", \"imports_lockfile\", \"routes_fastapi\"]\nblock_on = \"reject\"                 # reject | review | never\nenv_declared_in = [\".env.example\"]\n```\n\nPrecedence: `WEFTGATE_*` environment variables, repository configuration, user\nconfiguration, then defaults. The index lives in the user cache, outside the repo.\n`weftgate doctor` explains the selected configuration and missing contracts.\n\nOutcome claims such as “tests passed” need machine-checkable evidence. Re-running a\nnamed test command or probing a URL requires explicit `--run` and the configured\nallowlist. See [security and execution boundaries](https://github.com/Avinash-Amudala/weftgate/blob/main/SECURITY.md).\n\nWeftgate exposes `memory anchor`, `memory check`, and `memory changes` through the CLI\nand MCP. With mnemo installed in the same interpreter, add\n`\"oracles\": [\"weftgate.memory\"]` to `.mnemo.json` to check structured memory claims.\n\nChanged evidence keeps memories **stale**; checking does not silently replace the\noriginal hashes or prove remembered prose. See [the integration contract](https://github.com/Avinash-Amudala/weftgate/blob/main/docs/MEMORY.md).\nMnemo is a separate companion repository and is not required to use Weftgate.\n\n```\nbash scripts/bootstrap.sh\n.venv/bin/ruff check .\n.venv/bin/ruff format --check .\n.venv/bin/mypy weftgate\n.venv/bin/python -m weftgate.selftest\n.venv/bin/python -m pytest -q --cov=weftgate --cov-fail-under=85\n```\n\nStart with [CONTRIBUTING.md](https://github.com/Avinash-Amudala/weftgate/blob/main/CONTRIBUTING.md), the [oracle guide](https://github.com/Avinash-Amudala/weftgate/blob/main/docs/ORACLES.md), and\n[AGENTS.md](https://github.com/Avinash-Amudala/weftgate/blob/main/AGENTS.md). New oracles need a real broken example, a correct example,\nand a dynamic case that reviews. Reproducible false blocks and missing-contract\nreports are especially useful.\n\nApache-2.0 · [Changelog](https://github.com/Avinash-Amudala/weftgate/blob/main/CHANGELOG.md) · [Launch plan](https://github.com/Avinash-Amudala/weftgate/blob/main/docs/LAUNCH.md)", "url": "https://wpnews.pro/news/show-hn-weftgate-a-local-verification-gate-for-coding-agents", "canonical_source": "https://github.com/Avinash-Amudala/weftgate", "published_at": "2026-09-13 05:50:52+00:00", "updated_at": "2026-09-13 06:28:04.691969+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools", "ai-products"], "entities": ["Weftgate", "Avinash Amudala", "GitHub", "FastAPI", "Starlette", "Python", "Node", "Claude"], "alternates": {"html": "https://wpnews.pro/news/show-hn-weftgate-a-local-verification-gate-for-coding-agents", "markdown": "https://wpnews.pro/news/show-hn-weftgate-a-local-verification-gate-for-coding-agents.md", "text": "https://wpnews.pro/news/show-hn-weftgate-a-local-verification-gate-for-coding-agents.txt", "jsonld": "https://wpnews.pro/news/show-hn-weftgate-a-local-verification-gate-for-coding-agents.jsonld"}}