diff --git a/scripts/verify_debug.sh b/scripts/verify_debug.sh
new file mode 100755
index 0000000..4a4a144
--- /dev/null
+++ b/scripts/verify_debug.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Verify the CM_DEBUG env toggle on the cm-web container.
+# No DB required — web-view has no DB dependency, and we use --no-deps
+# to skip api-server (which needs MySQL).
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Verify the CM_DEBUG env toggle on the cm-web container.
+
+Usage:
+  scripts/verify_debug.sh
+
+What it does:
+  Brings up web-view twice — once with CM_DEBUG=true, once unset (default
+  false) — greps the container logs for the Werkzeug "Debug mode" banner
+  and the "Debugger PIN" line, and reports pass/fail. Tears down on exit.
+
+Requirements:
+  - docker compose (v2 plugin)
+  - sudo (matches scripts/local_build.sh; set NO_SUDO=1 to skip sudo)
+  - .env at the repo root (copy envs/rex/.env or envs/siong/.env first)
+
+Exit code:
+  0 if both modes behave correctly, non-zero otherwise.
+EOF
+}
+
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT_DIR}"
+
+SUDO="sudo"
+[[ "${NO_SUDO:-0}" == "1" ]] && SUDO=""
+# shellcheck disable=SC2206
+COMPOSE=(${SUDO} docker compose -f docker-compose.yml -f docker-compose.override.yml)
+
+SERVICE=web-view
+WAIT_SECS=20
+
+if [[ ! -f .env ]]; then
+  echo "ERROR: .env not found at repo root. Copy envs/rex/.env (or envs/siong/.env) first." >&2
+  exit 2
+fi
+
+cleanup() {
+  echo
+  echo "==> Cleaning up..."
+  "${COMPOSE[@]}" down --remove-orphans >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+wait_for_banner() {
+  local left=$WAIT_SECS
+  while (( left > 0 )); do
+    if "${COMPOSE[@]}" logs --no-color --tail=80 "${SERVICE}" 2>&1 | grep -q "Debug mode:"; then
+      return 0
+    fi
+    sleep 1
+    ((left--))
+  done
+  return 1
+}
+
+check_logs() {
+  local expected_debug="$1" expect_pin="$2"
+  local logs
+  logs="$("${COMPOSE[@]}" logs --no-color --tail=80 "${SERVICE}" 2>&1)"
+
+  if ! echo "${logs}" | grep -q "Debug mode: ${expected_debug}"; then
+    echo "FAIL: expected 'Debug mode: ${expected_debug}' in ${SERVICE} logs"
+    echo "--- captured logs ---"
+    echo "${logs}"
+    return 1
+  fi
+
+  if [[ "${expect_pin}" == "yes" ]]; then
+    if ! echo "${logs}" | grep -q "Debugger PIN:"; then
+      echo "FAIL: expected 'Debugger PIN:' line, none found"
+      echo "--- captured logs ---"
+      echo "${logs}"
+      return 1
+    fi
+  else
+    if echo "${logs}" | grep -q "Debugger PIN:"; then
+      echo "FAIL: 'Debugger PIN:' line present when CM_DEBUG should be off"
+      echo "--- captured logs ---"
+      echo "${logs}"
+      return 1
+    fi
+  fi
+}
+
+run_mode() {
+  local mode="$1" expected_debug="$2" expect_pin="$3"
+  echo "==> CM_DEBUG=${mode} — expecting 'Debug mode: ${expected_debug}', PIN ${expect_pin}"
+
+  CM_DEBUG="${mode}" "${COMPOSE[@]}" up -d --build --no-deps "${SERVICE}" >/dev/null
+
+  if ! wait_for_banner; then
+    echo "FAIL: ${SERVICE} did not print 'Debug mode:' banner within ${WAIT_SECS}s"
+    "${COMPOSE[@]}" logs --no-color --tail=80 "${SERVICE}"
+    return 1
+  fi
+
+  check_logs "${expected_debug}" "${expect_pin}" || return 1
+  echo "PASS"
+  echo
+
+  "${COMPOSE[@]}" stop "${SERVICE}" >/dev/null
+}
+
+run_mode "true"  "on"  "yes" || exit 1
+run_mode "false" "off" "no"  || exit 1
+
+echo "All CM_DEBUG verifications passed."