Agent Guard

Your AI says “done.” Faultline checks what it told you.

Agents assert things that aren’t true, confidently, in the exact register that reads as competence. Faultline extracts every factual claim from a block of text, verifies each against live sources, and hands back a verdict per claim. This page covers the three places you can mount it — inside the agent, in the pipe, and in CI.

Three mounts, one engine

@nxtg/faultline-mcpInside the agent.not yet published

The harness — Claude Code, Cursor, Windsurf, any MCP client.

Not published yet — the commands below will not resolve until it is.

claude mcp add faultline -- npx -y @nxtg/faultline-mcp

{
  "mcpServers": {
    "faultline": {
      "command": "npx",
      "args": ["-y", "@nxtg/faultline-mcp"],
      "env": { "FAULTLINE_API_KEY": "your-key" }
    }
  }
}

Exposes one tool: verify_claims. Give it text, get a verdict per claim.
The agent can check its own output before telling you it is done.
verify_url is not implemented — the engine has no URL-ingestion path, and this package wraps the engine rather than extending it.
Until it ships, `faultline guard` below does the same check from a pipe or a Stop hook, and is available now.

faultline guardIn the pipe.

Between an agent and whoever reads it — a shell pipeline, a Stop hook, a CI step.

npm install -g @nxtg/faultline

# advisory — reports, always exits 0
claude -p "summarise the release" | faultline guard

# gate — exits non-zero on a refuted claim
claude -p "summarise the release" | faultline guard --fail-on refuted

# machine-readable
cat report.md | faultline guard --json

Advisory by default. A checker that blocks by default gets uninstalled the first time it is wrong, and then it protects nothing.
--fail-on refuted trips on contradiction. --fail-on unsupported is stricter: it adds UNSUPPORTED and MIXED.
With --fail-on set, the gate also fails when verification was degraded. Claims that were never checked are not claims that passed.

faultline-actionIn CI.

Pull requests — the diff, the PR body, the release notes.

uses: nxtg-ai/faultline-action@v1

- uses: nxtg-ai/faultline-action@v1
  with:
    mode: 'guard'
    text: ${{ github.event.pull_request.body }}
    guard-fail-on: 'refuted'
  env:
    FAULTLINE_API_KEY: ${{ secrets.FAULTLINE_API_KEY }}

scan mode checks a file. guard mode checks a block of text, which is what a PR body is.
Findings upload to GitHub code scanning as SARIF — inline annotations on the PR.
The text is passed as data, never interpolated into a shell command, so a PR body containing $(...) cannot execute.

What the verdicts mean

Verdict	Meaning
`VERIFIED`	Supported by sources.
`REFUTED`	Contradicted by sources.
`UNSUPPORTED`	Checked, and no supporting evidence was found.
`MIXED`	Evidence both supports and contradicts the claim.
`UNCHECKED`	Not a verdict. Verification did not run — the provider errored, or the statement is an opinion rather than a checkable fact.

UNCHECKED is not a verdict

“We never checked” and “we checked and found nothing” are opposite statements. Folding them together would make a rate limit or an expired key look like a caught hallucination — which is the exact failure this tool exists to catch. So they stay separate, and every response carries degraded: when it is true, one or more claims went unchecked and the result is not a clean bill of health. risk_score is null when nothing was checked at all, because a scan that verified nothing has no risk reading to report.

Claude Code Stop hook

Check the agent’s output automatically, every time it finishes a turn.

.claude/settings.json

{
  "hooks": {
    "Stop": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "jq -r '.messages[-1].content // empty' \"$CLAUDE_TRANSCRIPT_PATH\" | npx -y @nxtg/faultline guard --json"
          }
        ]
      }
    ]
  }
}

Drop this in .claude/settings.json. It runs when the agent stops and reports on what it just said.
Add --fail-on refuted to make it a gate rather than a report.
This is claims-with-instruments as a hook: the agent does not get to be the only witness to its own accuracy.

Keys, and which paths carry evidence

Hosted

FAULTLINE_API_KEYretrieves sources

Scans run on our API with server-side provider keys. Verification retrieves live sources, and verdicts come back with evidence URLs attached.

Rides your Faultline plan

Bring your own key

GEMINI_API_KEYretrieves sources

Scans run on your machine against your own Gemini key. Gemini retrieves live sources via its search tool, so verdicts carry evidence.

You pay your provider directly

Other providers

OPENAI_API_KEY · ANTHROPIC_API_KEY · PERPLEXITY_API_KEYno sources

These judge claims from the model’s own knowledge without retrieving anything. Verdicts arrive with no sources behind them. Useful as a signal; not evidence you can show anyone. The tools report grounded: false so you can tell the difference.

You pay your provider directly

What v1 checks

v1 checks informational claims — statements about the world that sources can settle. It does not check operational claims like “the tests pass” or “it’s deployed”. Those need deterministic probes against your own systems; asking a language model whether your tests passed just reproduces the problem.