Soma

io.github.medianemi-beepPublished by GitHub account medianemi-beepv0.1.0Updated Nov 3, 2026

Execution-verified code generation and verification with signed, offline-checkable certificates.

VerifiedSTDIODesktop onlyDeveloper ToolsAI & ML

Overview

AI-generated overview

Soma runs candidate code against tests in a sandbox and returns a PASS/FAIL verdict with a signed, offline-checkable certificate, plus generates verified code.

What you can do
  • Run code against tests in an isolated sandbox and get a verdict with pass counts
  • Receive a signed certificate (Ed25519) with public key and algorithm for offline checking
  • Generate code for a task, executed against derived tests before it is returned
  • Work across 15+ languages including Python, JavaScript/TypeScript, Go, C/C++, Java, Rust, Ruby, PHP and Bash
  • Choose function mode with input/expected pairs and an entrypoint, or stdio mode with stdin and expected stdout
When to use it
Useful when an assistant writes code and you want independent evidence that it actually passes tests before trusting it, or when you want generated code that has already been executed against derived tests. Best for tasks with concrete input/output examples that can be verified automatically.
Requirements
Runs locally over stdio via the npm package soma-verify-mcp, requiring Node.js 18+. Needs a Soma API key in SOMA_API_KEY (a throttled public demo key is built in, and free preview keys are available by contacting the provider). Optional SOMA_BASE_URL and SOMA_TIMEOUT_MS settings; network access to the hosted Soma endpoint.
Before you install
Your code, tests and prompts are sent to a remote Soma service at the configured base URL, so avoid submitting proprietary or sensitive source. The README lists SOMA_API_KEY as required while the manifest calls it optional with a built-in demo key; a certificate only attests that the listed tests passed in a sandbox at generation time and is not a warranty of fitness, so review output before production use.

Installation

In SourceWeft

  1. Open Soma in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Soma MCP Server

Give your AI agent the one thing it can't do for itself: actually run code against tests and prove it passed.

Soma is an execution-verified code service. This MCP server exposes two tools:

  • soma_verify_code — run candidate code against tests inside an isolated sandbox; get a PASS/FAIL verdict plus a signed, offline-checkable certificate (Ed25519). Use it to independently confirm code works before trusting it.
  • soma_generate_verified_code — ask Soma to write code for a task; when the task is verifiable, the returned code has already been executed against derived tests, with a certificate attached.

15+ languages are supported for verification (Python, JavaScript/TypeScript, Go, C/C++, Java, Rust, Ruby, PHP, Bash, and more).

Install

Requires Node.js 18+. Runs over stdio.

Add to your MCP client config (Claude Desktop, Cursor, etc.):

json
{  "mcpServers": {    "soma": {      "command": "npx",      "args": ["-y", "soma-verify-mcp"],      "env": {        "SOMA_API_KEY": "YOUR_SOMA_KEY"      }    }  }}
  • Claude Desktop: Settings → Developer → Edit Config, add the block above, restart.
  • Cursor: Settings → MCP → Add, or drop the same block in ~/.cursor/mcp.json.

Configuration

Env varRequiredDefaultPurpose
SOMA_API_KEYyes—Your Soma API key.
SOMA_BASE_URLnohttps://170-9-236-56.sslip.ioSoma API base URL.
SOMA_TIMEOUT_MSno300000Per-request timeout.

Get a free preview key: contact [email protected] (free tier during the preview).

Tools

soma_verify_code

Run code against tests and return a signed verdict.

  • language (string) — e.g. python, javascript, go, rust.
  • code (string) — the complete source to verify.
  • tests (array) — one of:
    • function mode (default): [{ "input": [arg1, arg2], "expected": value }] plus entrypoint (the function name).
    • stdio mode: set mode: "stdio" and [{ "stdin": "...", "expected_stdout": "..." }]; no entrypoint.
  • entrypoint (string, optional) — function name for function mode.
  • mode ("function" | "stdio", optional).

Returns: verdict, tests_passed, tests_total, and a signature / public_key / sig_alg you can check offline.

soma_generate_verified_code

Get code for a task, executed against derived tests before it's returned.

  • prompt (string) — the coding task. Include concrete input/output examples (e.g. >>> f(2) == 4) so the result is verifiable rather than best-effort.
  • max_tokens (int, optional, default 1500).

Returns: the code, certified (bool), and a certificate (verdict, tests_passed, tests_total) when verification passed. If a task isn't verifiable, output is returned uncertified and clearly labeled — never a false "verified".

What the certificate means

A certificate attests that the listed tests passed inside an isolated sandbox at generation time. It is signed (Ed25519) and checkable offline against the returned public key. It is not a warranty of fitness for any purpose — review output before production use.

Privacy

No training on your prompts. See the Soma Privacy & Data Policy at ${SOMA_BASE_URL}/privacy.

License

MIT.

Source: README.md at commit bc14927

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.