Let your AI run the check itself

malveon has to be installed first, so the command malveon works in a terminal. Then add it to your AI tool with one of these. Each tool reads its settings when a session starts, so open a new session afterwards.

Claude Code

claude mcp add malveon -- malveon mcp

Cursor, Antigravity and most others

Add this to the tool’s MCP settings file:

{
  "mcpServers": {
    "malveon": { "command": "malveon", "args": ["mcp"] }
  }
}

Codex

Add this to ~/.codex/config.toml:

[mcp_servers.malveon]
command = "malveon"
args = ["mcp"]

VS Code or Cursor with the malveon extension

Nothing to do. The extension connects malveon to your editor’s own AI tool for you.

1. 01You ask your AI to build something.
2. 02The AI finishes and calls malveon_check.
3. 03malveon returns the report. The AI shows you the overview and the GATE line as written.
4. 04If you have set up prompt checking, the report says some of your prompts are waiting. The AI calls malveon_prompt_claims and says, one line each, what you asked for.
5. 05The AI calls malveon_check again, and the answer now includes your prompts.

The server tells the AI to do this by itself. This is what it sends, word for word:

“malveon checks whether the code really does what the user asked, by reading the code, never from an agent’s word. When you finish a task, and before you tell the user it is done, call malveon_check and show them its OVERVIEW and GATE line as written. The user’s own prompts are saved word for word by their editor: when malveon_check says prompts are waiting, call malveon_prompt_claims to list them and say, one line each, what every prompt asked for, each naming a URL, file or code name in backticks. Then call malveon_check again.”

Some tools only act on that when you ask. If yours doesn’t, say “check your work with malveon”.

Most of what you ask an AI never lands in a plan file. After a one-time setup, malveon saves each prompt you type, word for word, to .malveon/prompts.jsonl in your project (ignored by git, never sent anywhere). It comes from your tool’s own hook, a small script the tool runs when you press enter, not from the AI.

The AI then writes what each prompt asked for as lines malveon can check, and malveon checks every line against the code like a plan line. What the AI writes is a list of things to check, never proof.

Set it up when malveon offers (the first check in a project that has an agent folder asks once), or any time:

malveon hooks install

It finds which agents your project uses, shows exactly what it will add, and writes only after you say yes. Codex asks you to approve the new hook once, with /hooks inside Codex.

Some things should never be the AI’s call. When one comes up, malveon asks you, in a dialog in your editor or tool. This is the one for running your project’s own commands:

• Which file is your plan, when more than one could be.
• Whether a project’s own build and test commands may run.
• Whether to add the prompt hooks.
• Whether to stop checking a prompt you cancelled.
• Whether the lines the AI wrote for your prompt are what you meant, when they are about something you didn’t type.

The AI can start these questions. It can’t answer them. If your tool can’t show a dialog, or you dismiss it, nothing changes, and the same decision is available in a terminal: malveon trust, malveon prompt confirm N, malveon prompt drop N.

malveon hooks install --gate shadow

This adds two hooks to Claude Code: one runs before Claude edits a code file, the other when Claude says it’s done. It shows the change and asks first, like every setup step.

• --gate shadow holds nothing. It writes down what malveon would have held, in .malveon/shadow.jsonl, so you can see its behavior before you trust it.
• --gate enforce holds a code edit when your prompt names a file, URL or code name and what the AI says it will check doesn’t match it. It tells Claude what to fix first. A prompt that names nothing (“make the header sticky”) never holds an edit.
• When Claude says it’s done, malveon runs the checks and sends Claude back to fix anything it can prove. It asks twice at most for the same problems, then lets go and tells you.
• It only holds Claude for problems the session could have caused. A problem your project already had still shows up in malveon check, but it doesn’t hold Claude.
• Turn it off any time with MALVEON_GATE=off in the environment.

Limits. It sees Claude’s file-editing tools, not its terminal, so Claude can still change a file through a shell command. This is a speed bump, not a lock. It has been tested on Windows with one version of Claude Code and a scripted stand-in for the AI, which shows how Claude Code reacts to being held, not how a real model behaves. If malveon fails, runs out of time (the “done” check waits at most 20 seconds), or isn’t found, Claude carries on.

• Your AI tool decides whether to call malveon on its own. malveon can ask; it can’t force.
• A tool that can’t show questions to you can’t show the dialogs above. Use the terminal commands instead.
• malveon checks the code. It doesn’t run your app, so “connected” never means “clicked through”.