Skip to content
IR Labs
Try for free

Verify locally with the uok CLI

uok is the Agentic SQA command-line tool. It checks concrete review claims against the exact code revision in your own environment and returns a verdict with supporting evidence. It is part of Agentic SQA, not a separate product: Foundry Verify reviews pull requests in GitHub, and uok is how you verify eligible claims from those findings yourself, from a developer checkout, a CI job or a coding-agent workflow.

Install

curl -LsSf https://get.irlabs.ai/uok/install.sh | sh

The CLI authenticates to your IR Labs workspace so runs, quotas and support attribute correctly. Release artifacts include signed checksums and provenance documents.

Platform support

Native binaries exist for Linux x86-64 and Linux arm64. There is no native macOS or Windows binary. A multi-architecture Docker image is available, and it is the path for Linux containers and for Apple Silicon via Docker.

Commands

The CLI has three commands.

  • uok status reports the state of your installation, authentication and workspace.
  • uok findings lists the findings available to verify.
  • uok verify runs verification and returns verdicts.

Verdicts

For each eligible claim, uok verify returns one of three verdicts: PROVEN, REFUTED or NOT PROVABLE. Not every claim can be mechanically decided. When one can, uok returns PROVEN or REFUTED with supporting evidence; when it cannot, it says NOT PROVABLE rather than guessing.

Verification executes locally against your own checkout and available build context. It can use compilation context when available, or run flagless without it.

Online and saved-report modes

Online use against a pull request requires git and gh, reusing your existing GitHub CLI authentication. A saved-report workflow verifies claims from a saved report instead and can operate without GitHub access.

Data handling

Verification executes locally, and the CLI authenticates to your workspace and transmits results and related metadata to IR Labs. What is transmitted and how it is handled is covered on the security page and governed by the Privacy Policy; those are the authoritative descriptions, so we keep the details there rather than restating them here.