RELATED 01
LLM Checker
Hardware-aware local model picks plus Ollama model management over MCP
3.1kGitHub stars
1.5k/wknpm downloads
75popularity score
llmverify
Local checks on LLM text for hallucination signals, prompt injection and personal data
By Subodh Kc (individual) TypeScript Local · stdio SecurityAI and ML
41 popularity score ★ 19 ↓ 1.3k/wk
Connect your client
Local (npm)
Add in one click
Opens the app, which asks before it adds the server.
Or add it by command or config
Claude CodeTerminal
claude mcp add llmverify -- npx -y llmverify mcpClaude Desktopclaude_desktop_config.json
{
"mcpServers": {
"llmverify": {
"command": "npx",
"args": [
"-y",
"llmverify",
"mcp"
]
}
}
}Cursor~/.cursor/mcp.json
{
"mcpServers": {
"llmverify": {
"command": "npx",
"args": [
"-y",
"llmverify",
"mcp"
]
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"llmverify": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"llmverify",
"mcp"
]
}
}
}Codex~/.codex/config.toml
[mcp_servers.llmverify]
command = "npx"
args = ["-y", "llmverify", "mcp"]Gemini CLITerminal
gemini mcp add --scope user llmverify npx -- -y llmverify mcpSettings 7
LLMVERIFY_HOME |
Optional: Folder for usage counts, audit logs and baselines; defaults to ~/.llmverify. |
|---|---|
LLMVERIFY_MCP_MAX_INPUT_CHARS |
Optional: Maximum characters per content or input argument; default 1,000,000. |
LLMVERIFY_MCP_TIMEOUT_MS |
Optional: Per-call time limit in milliseconds; default 60000. |
LLMVERIFY_MCP_MAX_OUTPUT_ITEMS |
Optional: Maximum items in any output array; default 50. |
LLMVERIFY_MCP_MAX_TEXT_FIELD_CHARS |
Optional: Maximum characters per output text field; default 2000. |
LLMVERIFY_MCP_MAX_OUTPUT_BYTES |
Optional: Maximum size of a tool result in bytes; default 262144. |
LLMVERIFY_MCP_MAX_QUEUE_DEPTH |
Optional: Maximum queued or running verify calls; default 16. |
What it does
llmverify is an npm toolkit for checking text that a language model produced or is about to receive. Version 1.8.0 includes a stdio MCP server that exposes six of its checks to an assistant or IDE. The server is a thin layer over the package's own functions, not a separate engine.
The tools score text for hallucination risk, scan input for prompt-injection patterns, detect and mask personal data such as emails, US phone numbers, SSNs, card numbers and API keys, and run a combined verification that returns a risk level with the engines it ran and the ones it skipped. Every check is deterministic and pattern-based, runs on your machine and calls no model. Results say what was not checked, and a clean result is a triage signal, not proof.
The MCP doc (docs/MCP.md) lists limits the README leaves out, each with an environment override: inputs are capped at 1,000,000 characters (LLMVERIFY_MCP_MAX_INPUT_CHARS), each tool call times out after 60 seconds (LLMVERIFY_MCP_TIMEOUT_MS), output arrays are cut to 50 items and text fields to 2,000 characters, and at most 16 verify calls may be queued or running at once. Output is passed through PII redaction before it is returned, so raw sensitive values found in the input are not echoed back.
What it needs
| Runtime | Node.js 20+ |
|---|
Node.js 20 or newer for the MCP server (the rest of the package works on Node 18). No account or API key is needed for the free tier. It works on any text passed to it and does not connect to any outside service.
Limits
Detection is pattern-based: it cannot prove a claim false or true, misses obfuscated, encoded or image-embedded personal data, and novel prompt injections can get past it. The free tier allows 500 verification calls a day, counted locally; ML-enhanced checks need a paid tier and an API key. redact_pii returns an error rather than a partial result when the redacted text exceeds the output budget (262,144 bytes by default). A timed-out call is not cancelled and keeps running. Several server processes sharing one LLMVERIFY_HOME can overwrite each other's usage and audit records.
Who it suits
Suits developers who want an assistant to screen model output or user input for personal data and injection attempts without sending text anywhere: it runs locally, needs no key and does not reach the network. It is a first-pass filter, not a fact checker; anyone who needs factual verification against sources, or detection beyond common regex formats, should pair it with human review or a model-based checker. It is a third-party tool from HAIEC, not tied to any one model vendor.
Tools 6
verify_llm_content- Runs the combined hallucination, consistency, JSON and CSM6 checks on text and returns a risk level, with optional profile and JSON schema
assess_hallucination_risk- Scores text for hallucination risk and lists suspicious claims
check_prompt_injection- Scans input for prompt-injection and jailbreak patterns
check_pii- Reports which kinds of personal data appear in text, with values masked
redact_pii- Returns the text with personal data replaced, using an optional replacement string
get_llmverify_capabilities- Describes the engine's checks, limits and local state settings