Vericore exposes two local integration surfaces:
The REST API is intended for trusted local/internal use. The application does not provide deployment-grade authentication, authorization, tenant isolation, or TLS.
vericore server --host 127.0.0.1 --port 8080
Keep the bind address on loopback for local development.
For exact CLI syntax, options, defaults, artifacts, and command workflows, use CLI Reference rather than duplicating command details here.
GET /Returns the service banner.
GET /healthReturns service health and the current application version.
GET /health/liveReturns the liveness state.
GET /health/readyReturns the readiness state.
GET /reports/{id}.htmlServes a generated report from the local output/ directory. Treat generated reports as potentially sensitive because they can contain repository-derived information.
POST /analyzeAnalyze an existing local repository and generate an HTML report.
Request:
{
"repoPath": "/workspace/example"
}
The endpoint rejects remote repository URLs. The path must resolve to a readable directory within a configured allowed root. Keep VERICORE_ALLOWED_PATHS narrow; the default allowed roots are the server working directory and the JVM temporary directory when the variable is not configured.
Response shape:
{
"fileCount": 42,
"hotspots": [
{"file": "PaymentService.kt", "score": 0.42}
],
"reportUrl": "/reports/<id>.html"
}
POST /impactAnalyze dependency impact for changed repository-relative paths.
Request:
{
"repoPath": "/workspace/example",
"changedPaths": [
"src/main/kotlin/com/example/PaymentService.kt"
]
}
At most 100 changed paths are accepted per request.
POST /architectureRun deterministic Architecture Intelligence.
Request:
{
"repoPath": "/workspace/example"
}
POST /pr-intelligenceAnalyze the working tree or an explicit Git revision pair.
Working tree:
{
"repoPath": "/workspace/example"
}
Revision pair:
{
"repoPath": "/workspace/example",
"baseRevision": "main",
"headRevision": "feature/payment-retry"
}
baseRevision and headRevision must either both be present or both be omitted. Each revision is limited to 256 characters.
POST /askAsk the configured AI provider a repository question.
Request:
{
"repoPath": "/workspace/example",
"question": "Where is authentication configured?"
}
AI must be enabled in the effective Vericore configuration. Questions are limited to 16,000 characters. Provider failures are sanitized before they reach the client.
POST /analyze-orgAnalyze multiple local repositories with bounded concurrency.
Request:
[
"/workspace/service-a",
"/workspace/service-b"
]
At most 20 repository paths are accepted per request. Each path is subject to the same repository path-safety boundary.
Repository paths are resolved with toRealPath() and must be readable directories under one of the configured allowed roots.
Configure allowed roots with:
VERICORE_ALLOWED_PATHS
The legacy CODECONTEXT_ALLOWED_PATHS variable remains supported only as a migration path. Use the canonical VERICORE_ALLOWED_PATHS name for new deployments.
Keep the allowed-root set as narrow as practical.
Rate limiting is enabled by default and is applied at the HTTP application boundary. The response includes Retry-After, X-RateLimit-Limit, and X-RateLimit-Remaining headers when the limiter is active.
Example configuration:
{
"rateLimit": {
"enabled": true,
"requestsPerMinute": 60,
"requestsPerHour": 1000
}
}
Public API errors use a stable shape:
{
"error": "Invalid or unsafe repository path"
}
Internal exception details, provider response bodies, stack traces, credentials, and unnecessary absolute paths are not returned as public API errors.
AI is optional. Deterministic analysis does not require an external provider. When /ask is invoked with AI enabled, bounded repository-derived context is sent to the configured provider.
See Data & Privacy for the application-level data boundary.
The REST server is a local/internal integration surface. It does not currently provide:
For a shared deployment, place an appropriate authenticated service boundary in front of Vericore.