The verifier is a Model Context Protocol server as well as a CLI, so an agent inside Claude, Cursor or any MCP-aware framework calls it directly and reads structured findings instead of shelling out. Every tool result carries the findings JSON contract — the same object bolvrk check --json prints — and a short text summary for the model. Two servers, one contract.
Self-hosted — every plan
npx bolvrk mcp serves over stdio on the machine the agent runs on, with the rules the public CLI bundles. Tools: check (Postgres, SQLite in alpha, and an optional database_url for live-schema context from a read-only replica), secrets (text or file paths, always local, values masked) and explain. Nothing leaves the machine unless a tool is given a database to read.
# Claude Code
claude mcp add bolvrk -- npx -y bolvrk mcp
# Cursor, Claude Desktop and others: mcpServers in their config
{ "mcpServers": { "bolvrk": { "command": "npx", "args": ["-y", "bolvrk", "mcp"] } } }Hosted — Team and above
https://bolvrk.com/api/mcp speaks Streamable HTTP and authenticates with a team token in the Authorization header. It adds what the hosted service has: the full corpus, live schema through a stored connection (connection_id), the team policy, and the run log — every check an agent makes lands there with source mcp. Tools: check, policy, rules and rule. There is no hosted secrets tool: a credential scan never leaves the machine. On Free and Startup the endpoint answers 402 and points at the self-hosted server.
# Claude Code
claude mcp add --transport http bolvrk https://bolvrk.com/api/mcp --header "Authorization: Bearer blv_..."
# Cursor, Claude Desktop and others
{ "mcpServers": { "bolvrk": { "url": "https://bolvrk.com/api/mcp", "headers": { "Authorization": "Bearer blv_..." } } } }The skills library
A server gives an agent the tools; a skill tells it when to use them. The public repository's skills/ folder holds short SKILL.md files — check a migration before committing it and fix findings rather than silencing them, scan a diff or a log for secrets before pasting it anywhere, explain a backfill against a shadow database. Copy one into your agent's skills folder (for Claude Code, .claude/skills/ in the repository or ~/.claude/skills/) and the workflow comes with it.
# into this repository, for everyone who works in it
git clone --depth 1 https://github.com/bolvrk/bolvrk /tmp/bolvrk && cp -r /tmp/bolvrk/skills/* .claude/skills/
# or for yourself, everywhere
cp -r /tmp/bolvrk/skills/* ~/.claude/skills/