Agent rule

Use this rule with Cursor, Claude Code, Windsurf, or any MCP-connected agent. It is host-agnostic — install it wherever your agent reads project instructions.

Where to install

Agent / IDE	Typical location
Cursor	`.cursor/rules/verdikt.mdc` (create `.cursor/rules/` if needed)
Claude Code	`CLAUDE.md` or project-level instructions
Other agents	`AGENTS.md`, custom system prompt, or team runbook

@useverdikt/mcp already ships server instructions for connected agents. This project rule reinforces reading governance_brief on check_gate when blocked — especially in IDEs that also use .cursor/rules or similar.

Rule (copy below)

For Cursor, save as .cursor/rules/verdikt.mdc. For other agents, copy the body (you may omit the YAML frontmatter between the --- lines).

---
description: Certify GitHub PRs through Verdikt before merge — label trigger, signals, check_gate.action, release_brief, escalate
alwaysApply: false
---

# Verdikt agent playbook

Verdikt is the **trust layer between AI agents and production**. It certifies **signal metrics vs thresholds** for a specific **commit/PR** — it does not review git diffs.

## Production flow (preferred)

1. Open or update a PR on a GitHub repo connected in **Settings → Release Trigger**.
2. Apply label **`verdikt:rc`** (or configured label) → Verdikt opens a cert window for `commit_sha` + `pr_number` and **auto-pulls connected integrations**.
3. Signals arrive from integrations (Braintrust, BrowserStack, Sentry, Datadog) or **`post_signals`** / MCP with real CI output — do **not** invent values. No manual `sources/pull` needed after label.
4. Call **`check_gate(release_id)`** (workspace default mode in Settings → Governance; use `mode: strict` when in doubt).
5. Read **`action`**:
   - **`merge`** — merge/deploy allowed (`gate.exit_code === 0`)
   - **`self_heal`** — fix code, re-run evals/CI, post missing signals, check again
   - **`recover_certification`** — remediation debt blocks non-emergency merge; ship clean CERTIFIED to prod or use corroborated `incident_hotfix`
   - **`escalate`** — call **`escalate`** with reason + `blocking_signals`; human reviews **Escalations** inbox
6. When **`action` is not `merge`**, read **`governance_brief`** on the gate response (`suggested_verb`, `top_blockers`, `regression_story`, `hub_links.release`). Call **`release_brief(release_id)`** only if you need the full remediation payload. Do **not** poll **`check_gate`** alone while debugging a block.

## MCP alternative (when not using label)

Use **`create_release`** with GitHub identity — always include:

- `commit_sha` (PR head SHA)
- `pr_number`
- `github_owner`, `github_repo`, `github_branch`
- `version` (e.g. PR title)

Repeat with same SHA returns `reused: true` — same cert window.

## Do not

- Open releases with bare version strings in production (demo only).
- POST signals from GHA unless you have metrics with no integration source.
- Merge when `action` is not `merge`.
- Poll **`check_gate`** repeatedly when blocked — read **`governance_brief`**, then act or escalate.
- Use API keys for human control-plane actions (thresholds, overrides) — escalate instead.

## MCP tools

`create_release` → `post_signals` → `check_gate` → if not `merge`: read **`governance_brief`** → fix | **`escalate`** | merge

Pass **`session_id`** per agent execution for audit attribution, or use the **`agent_session_id`** returned from **`create_release`**.

Config: [MCP setup](/agent/mcp-setup) and **Settings → Agent access** in the Verdikt app.

See also MCP setup and @useverdikt/mcp on npm.

Getting started

EU AI Act

Connecting signals

GitHub integration

Agent setup

Where to install

Rule (copy below)

​Where to install

​Rule (copy below)

Where to install

Rule (copy below)