CLI Documentation
Complete reference for the Vibgrate Command Line Interface — commands grouped by what they do, plus configuration, scanners, CI, and reference guides.
Quick Start
npx @vibgrate/cli scanno install·Nothing is installed globally — ideal for CI or a one-off scan.
Overview
Command reference
Complete inventory of every vg subcommand — drift scoring, code graph, AI context, models, IDE, and diagnostics — with links to each full page.
Getting Started
Choose between one-off scans and CI integration. Learn the recommended workflow for adopting Vibgrate.
How It Works
Understand how Vibgrate scans your codebase for upgrade drift across ~19 ecosystems — including Node.js, .NET, Python, Java, Go, Rust, PHP, and Ruby.
Commands
Grouped by what each command set is for — pick a set, then open a command.
Drift scoring & supply chain
Scan, score, baseline, report, vulnerabilities, SBOM, and evidence.
Typical path
All commands (A–Z)
vg baseline
Create drift baseline snapshots for delta comparison and fitness functions.
vg bisect
Pinpoint the commit where a dependency crossed a version line — when a fix was adopted, or never was — and gate CI on it.
vg evidence
Vibgrate Evidence — register products, freeze shipped-release manifests, and answer which shipped products contain a vulnerability as signed, offline-verifiable evidence. Jurisdiction-neutral (EU CRA first).
vg fix
Analyse drift and get ranked, risk-tiered upgrade plans — safe, balanced, and full — scored on real-world exploitability. Read-only until you choose to apply.
vg init
Initialize Vibgrate in your project. Creates the .vibgrate directory and config file.
vg report
Generate human-readable reports from scan artifacts in Markdown, text, or JSON.
vg sbom
Export CycloneDX or SPDX SBOMs, compare dependency deltas, and generate OpenVEX documents.
vg scan
The primary CLI command. Scan for upgrade drift with multiple output formats and quality gates.
vg scan --vulns
Detect known vulnerabilities in installed dependencies against the OSV database — online or air-gapped — with severity, CVSS, the fixing version, and git attribution.
vg update
Check for and install CLI updates.
vg why
Trace a dependency through git history — who added it, every version since, and any open vulnerabilities it carries.
Workspace auth & cloud upload
Sign in to Vibgrate Cloud, manage DSN tokens, and push scan results. Separate from local drift scoring — nothing leaves your machine until you push.
All commands (A–Z)
vg dsn create
Generate HMAC-signed DSN tokens for authenticating dashboard uploads.
vg login
Sign the CLI into your Vibgrate workspace from the browser — no DSN to copy or paste.
vg logout
Sign the CLI out of your Vibgrate workspace by clearing the stored login credential.
vg push
Upload scan results to Vibgrate Cloud for team visibility and trend analysis.
Code graph
Build the map, navigate symbols, impact, tests, and export.
All commands (A–Z)
vg ask
Ask the code map a question using hybrid lexical + structural + semantic search. Returns a budget-bounded context block ready to paste into any AI assistant — fully offline after first use.
vg build
Build or update the code map incrementally. Maps source code into a graph artifact that powers all downstream queries — vg show, vg ask, vg impact, and more.
vg bundle
Build a self-contained, air-gapped bundle — parser grammars, your code map, and the library catalog — so Vibgrate runs with no network at all.
vg drift
What is outdated across your dependencies. Offline by default (inventory plus installed versions); --online queries the registry for the latest, and --fail-on gates CI on version or standards violations.
vg embed
Precompute the semantic index so the next vg ask is instant. Local ONNX model downloaded once into a shared cache — fully offline after first run.
vg export
Export the code map in various formats: JSON, GraphML, Graphviz DOT, Neo4j Cypher, Markdown, HTML, CycloneDX SBOM, or SPDX.
vg facts
Deterministic open facts for a node — contract, invariant, characterization. Epistemic-typed: declared/static through to observed/derived.
vg guide
Cited, relevant standards and practices for a node in your code map — a free pack of guidance attached to the symbol you name.
vg impact
What breaks if you change a node? Deterministic structural blast radius using reverse reachability and decay confidence. With --tests, surfaces exactly the tests to run before shipping.
vg map / vg hubs / vg areas / vg oddities
Map-level insights: overview, most-depended-on hubs, natural code groupings (communities), and surprising cross-area links (architectural smells).
vg path
Show how node A connects to node B — the shortest path in the call graph.
vg savings / vg show savings
A local, privacy-safe report of the tokens and dollars saved — the grep baseline for code-map queries, and context compression by window, model and client. vg show savings opens the same numbers as a live local page; --benchmark measures the compressors offline.
vg share
Make the code map committable and auto-updating for your team. Installs a pre-commit hook, deterministic merge driver, and .gitignore.
vg show / vg show arch
Explain a single code node: what it is, what it calls, what calls it, and its architecture role. vg show arch opens the same graph as a local, interactive architecture map; vg show savings opens the live compression savings page.
vg status
Graph freshness, node/edge counts, staleness, and resolver rungs used. Compares the committed graph against the current working tree.
vg tests
Which tests cover a node via call or coverage linkage. --missing shows untested nodes nearby. --run prints (or --exec runs) the minimal command to exercise exactly those tests.
vg tree
The call tree rooted at a node — callees by default, callers with --callers. Depth-bounded and cycle-safe.
vg unknowns
What the code map cannot resolve, ranked by blast radius — so you can see exactly where the graph is incomplete and how much depends on those gaps.
vg watch
Rebuild the code map when source files change (debounced). Useful for long agent sessions and live map freshness without a full rebuild each time.
AI context & library docs
Local MCP, assistant wiring, and version-correct library docs.
Typical path
All commands (A–Z)
vg install / vg uninstall
Add or remove Vibgrate AI Context on your AI assistant — skill, MCP wiring, advisory nudge, and optionally compression routing (--compress) and learned guardrails (--learn). Idempotent and repo-local. Detects assistants in use, or installs for all 20+ supported tools; vg uninstall is the single revert.
vg lib
Version-correct library docs pinned to your lockfile — from the hosted catalog or local ingestion. The Free Dev Docs Library, served offline to any AI assistant.
vg serve
Start Vibgrate AI Context — the local, offline MCP server that serves your code map, drift, and version-correct library docs to any AI assistant. Add --compress and the same process also shrinks tool output and older turns before they reach the model. No account, nothing uploaded.
Context compression
Shrink tool output and older turns before they reach the model, keep every original retrievable locally, and see what it saved. No new verbs: a mode of serve, a flag on install, a section of savings.
All commands (A–Z)
Code edits & models
Graph-grounded VG Code and Code Modes / local model fleet.
All commands (A–Z)
vg code
VG Code — propose a minimal, graph-grounded code edit for a plain-language instruction, routed to a local or hosted model you choose. Dry-run by default; never writes without your consent.
vg models
Code Modes (Spark / Flow / Forge) plus the local model fleet — Ollama, LM Studio, and gguf files. Fit-aware pack install for VG Code; install and pull run when you invoke them (pass --dry-run to preview).
Diagnostics, IDE & runtime
Doctor, language server, workspace daemon, isolated inference host, and context-policy pins.
All commands (A–Z)
vg daemon
Local workspace daemon for multi-root graph sessions used by IDE extensions and agents: start, ensure, register workspaces, publish the map, and query impact without mutating repos.
vg doctor
One read-only diagnostic pass: config file, credentials (redacted), map freshness, hosted catalog reachability, MCP launch shape, and telemetry opt-outs. Prints state; changes nothing.
vg llm-host
Isolated inference host process for enterprise isolation: load weights and decode over a local socket. Code Modes and install stay on vg models; management never moves into the host.
vg lsp
Start the Vibgrate language server over stdio — the shared engine behind Vibgrate for VS Code and other thin IDE clients. Editors spawn this; humans rarely run it by hand.
vg policy
Show the production context-policy pin used by VG Code ranking, and verify a signed context-policy patch file before any release that would bump it.
Other commands
Additional command pages.
All commands (A–Z)
vg hcs
Holistic Code Specification: extract deterministic code facts from Rust, Ruby, PHP, Dart, Swift, Scala, C++, COBOL, and VB6, then render, map, gate, and validate that fact stream.
vg locale
Vibgrate Localize — manage your application's translations from the command line. Push the locale files in your repo to Vibgrate Cloud, translate, then pull accepted translations back. Formatting and config are free on every plan.
vg module
Manage the optional local modules the CLI can load — relevance, the Architecture module, and the HCS engine. Install fetches an integrity-checked tarball into the Vibgrate cache; nothing in your project is touched.
vg review
Vibgrate Review — architecture and security-control review of the change you just made, run locally from the code map. Produces a signed, versioned receipt, not model prose. Reports change integrity; it does not prove code is secure.
Configuration
Scanners
Architecture Layers Scanner
Classify source files into architectural layers and detect project archetypes.
Breaking Change Exposure Scanner
Flag packages and patterns known to cause upgrade pain.
Build & Deploy Scanner
Detect CI/CD systems, containerization, and infrastructure-as-code.
Code Quality Scanner
Fast AST-based quality checks for cyclomatic complexity and upgrade friction hotspots.
Database Schema Scanner
Table and column structure from Prisma, SQL migrations, Drizzle, and TypeORM — never a query, a row, or a credential.
Dependency Graph Scanner
Lockfile analysis for duplicate packages, phantom dependencies, and workspace graphs.
Dependency Risk Scanner
Risk classification for deprecated packages, native modules, and platform-specific dependencies.
Extended Scanners Overview
Beyond core drift scoring — platform matrix, dependency graph, security posture, and more.
File Hotspots Scanner
Lightweight complexity analysis using filesystem metadata only.
OWASP Category Mapping
Map security findings into OWASP Top 10 categories for triage.
Platform Matrix Scanner
Collect platform and architecture signals that predict where builds will break.
Security Posture Scanner
Structural security hygiene — lockfiles, .gitignore coverage, audit counts.
Security Scanners Scanner
Local security scanner orchestration and readiness analysis.
Service Dependencies Scanner
Map external service and platform dependencies by detecting SDK packages.
Tooling Inventory Scanner
Map your full technology stack by detecting packages across categories.
TypeScript Modernity Scanner
Analyze tsconfig.json for strictness, module system, and ESM readiness.
CI Integration
Azure DevOps
Integrate Vibgrate with Azure Pipelines for .NET and Node.js projects.
CI Integration
Integrate Vibgrate into GitHub Actions, Azure DevOps, GitLab CI, and other pipelines.
GitHub Actions
Integrate Vibgrate with GitHub Actions — SARIF upload, drift gates, and dashboard push.
GitLab CI
Integrate Vibgrate with GitLab CI/CD pipelines and SAST reports.
Reference
Approved-Alternative Library Policies
Steer AI assistants toward your approved packages: set "prefer package B over package A" and have the approved choice lead the library docs your agents read.
Drift Baselines & Fitness Functions
Store scan state for delta comparison and implement drift quality gates in CI.
DriftScore
Understand how the DriftScore is calculated and what the risk levels mean.
Exit Codes
Understand CLI exit codes for scripting and CI integration.
Output Formats
Understand the four output formats: Text, JSON, SARIF, and Markdown.
Privacy & Security
Understand exactly what Vibgrate reads, collects, and never accesses.
Programmatic API
Use Vibgrate types programmatically in your Node.js applications.
Supply Chain Inventory
Use Vibgrate artifacts for SBOM-ready supply chain governance.
Vibgrate Cloud Upload
Push scan results to Vibgrate Cloud for team visibility and trend tracking.
All documentation pages (82)
Alphabetical-by-reading-order list of every page in this guide.