What it does
You run lock once, on files you have approved, and then verify whenever you need to check them, for example in CI. The tool runs offline with only the Python standard library. It never loads a model and never launches a server.
vraelis models records the exact bytes of every file in a model folder. It also checks the structure: truncated weights, bad GGUF headers, shard indexes that name missing shards, Git LFS pointers left in place of weights, and invalid JSON. An optional step checks a publisher's Sigstore signature against a signer you name.
vraelis agents records MCP server launch commands, package pins, and environment-variable and header names (never their values unless you pin them). It also records Claude Code hooks and permissions as separate entries, and the bytes of skills and of the local scripts those configurations launch.
How it relates to Vraelis Contour
Vraelis Contour, our enterprise product, compares an approved release with what a running worker reports. A vraelis lockfile is a small, public form of the approved half: a precise record of what was approved. Vraelis Contour itself is not part of this release.
How it was tested
We ran all of this testing ourselves; none of it is independent. For the model checks, a separate agent collected sets of real broken public releases without seeing the tool, and we committed predictions before each run. On the latest set, the checks found 5 of 22 runnable defects with no false alarms on 15 healthy models. That makes it a narrow structural gate, not a general broken-release detector.
For agent add-ons, four blind sets of real configuration changes came from 61 public repositories. On the latest set, it detected 19 of 22 changes with no false alarms. Adversarial reviews by separate AI agents found defects, and every one was fixed before release. CI runs the suite on Linux, Windows and macOS.
When to use something else
Several good tools overlap with this one. Use OpenSSF model_signing if you want signed releases, and hf cache verify for models straight from the Hugging Face Hub. knowyourai and heldfast cover lockfile pinning, and kova and AgentGate cover agent add-ons. Claude Code's own managed settings and ConfigChange hook can enforce changes rather than just report them. The project README lists when each fits better. We have not yet run a head-to-head comparison.
Update, October 21: version 0.1.1
An independent AI review of 0.1.0 found three issues. No real credential exposure was shown.
In vraelis agents, two cases could record values that should have been structure only. One was a config key that happened to be named like the tool's own fields. The other was a gitignored .mcp.json. In vraelis models, a file checked for presence only was listed only in JSON output.
Version 0.1.1 fixes all three. Each fix has tests that fail on 0.1.0. Visibility now follows the project's own ignore rules, read without running git.
A second review then found that 0.1.1 missed some ignore patterns git honours, such as character classes like [[:punct:]]. Version 0.1.2 follows git's matching rules, including case-insensitive repositories. Every CI run now checks it against git itself on Linux, Windows and macOS.
Update, October 24: now Vraelis Prompto
The tool now has a product name, Vraelis Prompto, and its own page with one-file downloads for Windows, macOS and Linux that need no Python. The command is still vraelis.
