Live on PyPI

A gate your agent can't talk its way past.

Sure, you could ask the model to check its own work - but that's a model grading a model: it drifts, it can be talked out of it, and it costs tokens. Sembl is a mechanical gate instead. It reads the agent's real git diff against the bounds it was given - which files it could touch, which it couldn't, whether it lied about what it edited or tested - and returns one verdict, the same way every time: PASS, WARN, or BLOCK. No model in the loop, executor-neutral, free in CI.

Star on GitHub

sembl - powershell

            $ pip install sembl
            Successfully installed sembl 0.2.0
             
            $ sembl verify --wo-file bounds.json --report agent.json
              files changed ... 7
              out of scope .... infra/deploy.yaml
              fabricated ...... src/payments/refund.ts
              sembl verify - BLOCK
          

Drops into the stack you already run

Claude Code Cursor Windsurf Aider Codex OpenCode Spec Kit Kiro Tessl GitHub Actions pre-commit MCP

No tokens · free in CI

Same verdict, every run

✓

Any agent · any model

Line to wire into MCP / CI

Plug it into your agent

Your agent calls the gate. One line to wire it up.

Sembl runs as an MCP server, so any agent - and any orchestrator running sub-agents - can ask for a verdict mid-run instead of trusting a self-report. Paste this into your MCP client (Claude Code, Cursor, Windsurf, …). No clone, no build, no API key.

.mcp.json

{ "mcpServers": { "sembl": { "command": "uvx", "args": ["--from", "sembl[mcp]", "sembl-mcp"] } } }

What the agent gets

gate_prone call — picks the base ref, diffs the branch, discovers bounds, returns the verdict
verify_changehand over a diff + what was declared → PASS / WARN / BLOCK
bounds_from_specturn a Spec Kit tasks.md or preset into bounds
doctordeterministic repo readiness, no model

The point: a main agent can verify a sub-agent's work before accepting it - the one thing a model grading itself can't do reliably. Read the recipe →

How it works

Sits after the agent, before you approve.

No new workflow to learn and nothing for Sembl to generate. You declare the bounds of the change, your existing agent does the work, and Sembl gives you a mechanical verdict you can trust and put in CI.

Declare the bounds

Which files the change may touch, which it must not, and an optional size budget. Use GitHub Spec Kit, write it by hand, or let Sembl draft it.

Spec Kitbounds.json

Your agent does the work

Hand the task to whatever you already use. Sembl never sees the agent and never runs a model - it only looks at the result.

Claude CodeCursorAiderCodex

Sembl reads the real diff

It compares what actually changed in git against the bounds, and cross-checks the agent's own report for claims the diff doesn't back up.

You get a verdict

PASS, WARN, or BLOCK, with the exact reasons. Same inputs, same answer, every time - no judgement call, nothing to argue with.

Gate it in CI

Run sembl verify --strict on every agent PR. A forbidden edit or a fabricated claim fails the build before a human ever reads it.

What it checks

Five things a diff can be objectively wrong about.

Every check is deterministic - no maintainability opinions, no model in the loop. Sembl catches what can be proven from the diff and the bounds, and nothing it can't.

sembl verifyBLOCK

Scope

src/auth/redirect.ts
infra/deploy.yaml

Forbidden

No edits landed inside the declared off-limits areas.

Fabricated

src/payments/refund.ts - reported, never changed

Verdict

BLOCK - out-of-scope edit and a fabricated file claim.

Five mechanical checks decide the verdict. Each maps to a real failure mode of an autonomous agent.

Scope

Did a changed file land outside the editable paths?

Forbidden

Did the change touch an area declared off-limits? Blocks.

Fabrication

Did the report claim a file it never actually changed? Blocks.

Evidence

Did it say "tests passed" with nothing to back the claim?

Churn

Did the diff blow past the size budget you set?

Not quality

Sembl does not judge whether the code is good. That's a reviewer's job.

Can't the model just check this?

A model grading a model isn't a gate.

Yes - a capable model can spot most of these too, and Sembl doesn't claim to catch more. The question is what you're trusting. Asking the agent (or another agent) to grade the work is the same kind of system that just made the change: it gives a different answer each run, it can be argued out of its objection, and it bills you per token. You don't let a pull request's author be its own merge gate - you run tests and CI. Sembl is CI for agent accountability.

Same answer, every time

No model runs inside the check, so the verdict is identical on every machine and every rerun. An LLM reviewer drifts; a gate you can put in a policy can't.

Free, and can't be sweet-talked

No tokens, no rate limits, nothing to prompt-inject. The diff either touched a forbidden file or it didn't; it either matches the report or it doesn't. There's no opinion to negotiate with.

✓

A check, not an opinion

One exit code, an auditable record, a hard gate in CI. The kind of thing you can hand a compliance reviewer - not a paragraph of model prose you have to trust.

Where it fits

Downstream of the planner. Independent of the agent.

Spec-driven tools plan what to build. Agents build it. Sembl checks the agent stayed inside the plan - it's the layer none of them own, and the one that matters more as agents get more autonomous and humans review less.

↑

The layer above: whatever plans the change

Spec-driven tools already name the exact files for each task. sembl bounds --from spec-kit|kiro|tessl (or a custom config) turns that into a bounds file in one command - the precise input the gate needs. No planner? Write the four-field JSON by hand.

Spec KitKiroTesslAGENTS.mdby hand

↓

The layer below: gate it where you ship

Drop the verdict into the places a change already passes through. The GitHub Action runs verify on every pull request's diff; the pre-commit hook gates local commits; agent harnesses (Claude Code Stop hook, Aider, OpenCode) run it the moment the agent stops editing.

GitHub Actionpre-commitCIharness hooks

⟳

Inside the loop: agents call it directly

The MCP server (pip install "sembl[mcp]" → sembl-mcp) lets an agent call the gate with no shell - hand over a diff and what was declared, get back PASS/WARN/BLOCK. With the drop-in Agent Skills, a main agent can verify a sub-agent's work before accepting it: the general case for delegating safely.

MCPverify_changeAgent Skillssub-agent gate

Want the whole pipeline, not just the gate?

Sembl is the verdict. sembl-stack is the factory built around it: spec → bounds → executor → this gate → merge → deploy → verify-in-prod, every stage a swappable adapter behind one typed contract, every run recorded. Same team, same honesty, one layer up.

Explore sembl-stack ↗

Install

pip install sembl. That's the latest.

The latest stable release lives on PyPI, so pip install sembl always gives you the newest version. The gate needs no API key and no model - just Python and git.