Everything Vibgrate can do

Understand how Vibgrate scans your codebase for upgrade drift across ~19 ecosystems — including Node.js, .NET, Python, Java, Go, Rust, PHP, and Ruby.

Choose between one-off scans and CI integration. Learn the recommended workflow for adopting Vibgrate.

Complete inventory of every vg subcommand — drift scoring, code graph, AI context, models, IDE, and diagnostics — with links to each full page.

Sign the CLI into your Vibgrate workspace from the browser — no DSN to copy or paste.

Sign the CLI out of your Vibgrate workspace by clearing the stored login credential.

Initialize Vibgrate in your project. Creates the .vibgrate directory and config file.

The primary CLI command. Scan for upgrade drift with multiple output formats and quality gates.

Detect known vulnerabilities in installed dependencies against the OSV database — online or air-gapped — with severity, CVSS, the fixing version, and git attribution.

Analyze drift and get ranked, risk-tiered upgrade plans. The report labels them Low-risk, Balanced, and Full; --plan takes safe, balanced, and aggressive. Scored on real-world exploitability. Preview with --no-apply or --dry-run; apply with --yes or --plan.

VG Code — propose a minimal, graph-grounded code edit for a plain-language instruction, routed to a local or hosted model you choose. Dry-run by default; never writes without your consent.

Trace a dependency through git history — who added it, every version since, and any open vulnerabilities it carries.

Pinpoint the commit where a dependency crossed a version line — when a fix was adopted, or never was — and gate CI on it.

Create drift baseline snapshots for delta comparison and fitness functions.

Generate reports from scan artifacts in Markdown, text, JSON, or HTML.

Vibgrate Review — architecture and security-control review of the change you just made, run locally from the code map. Produces a signed, versioned receipt, not model prose. Reports change integrity; it does not prove code is secure.

Export CycloneDX or SPDX SBOMs, compare dependency deltas, and generate OpenVEX documents.

Vibgrate Evidence — register products, freeze shipped-release manifests, and answer which shipped products contain a vulnerability as signed, offline-verifiable evidence. Jurisdiction-neutral (EU CRA first).

Vibgrate Localize — manage your application's translations from the command line. Push the locale files in your repo to Vibgrate Cloud, translate, then pull accepted translations back. Formatting and config are free on every plan.

Upload scan results to Vibgrate Cloud for team visibility and trend analysis.

Generate HMAC-signed DSN tokens for authenticating dashboard uploads.

Check for and install CLI updates.

Build or update the code map incrementally. Maps source code into a graph artifact that powers all downstream queries — vg show, vg ask, vg impact, and more.

Explain a single code node: what it is, what it calls, what calls it, and its architecture role. vg show arch opens the same graph as a local, interactive architecture map; vg show savings opens the live compression savings page.

Ask the code map a question using hybrid lexical + structural + semantic search. Returns a budget-bounded context block ready to paste into any AI assistant — fully offline after first use.

What breaks if you change a node? Deterministic structural blast radius using reverse reachability and decay confidence. With --tests, surfaces exactly the tests to run before shipping.

Show how node A connects to node B — the shortest path in the call graph.

The call tree rooted at a node — callees by default, callers with --callers. Depth-bounded and cycle-safe.

What is outdated across your dependencies. Offline by default (inventory plus installed versions); --online queries the registry for the latest, and --fail-on gates CI on version or standards violations.

Cited, relevant standards and practices for a node in your code map — a free pack of guidance attached to the symbol you name.

What the code map cannot resolve, ranked by blast radius — so you can see exactly where the graph is incomplete and how much depends on those gaps.

Code Modes (Spark / Flow / Forge) plus the local model fleet — Ollama, LM Studio, and gguf files. Fit-aware pack install for VG Code; install and pull run when you invoke them (pass --dry-run to preview).

A local, privacy-safe report of the tokens and dollars saved — the grep baseline for code-map queries, and context compression by window, model and client. vg show savings opens the same numbers as a live local page; --benchmark measures the compressors offline.

Shrink tool output and older turns before they reach the model, keep every original retrievable on your machine, and see what it saved. No new verbs: vg serve --compress, vg install <agent> --compress, and vg savings. Works with Claude Code, Codex, Cursor, Copilot, Aider, and more.

Build a self-contained, air-gapped bundle — parser grammars, your code map, and the library catalog — so Vibgrate runs with no network at all.

Map-level insights: overview, most-depended-on hubs, natural code groupings (communities), and surprising cross-area links (architectural smells).

Usage docs for one library. The version label follows the lockfile pin when that file lists the package.

Start Vibgrate AI Context — the local, offline MCP server that serves your code map, drift, and version-correct library docs to any AI assistant. Add --compress and the same process also shrinks tool output and older turns before they reach the model. No account, nothing uploaded.

Add or remove Vibgrate AI Context on your AI assistant — skill, MCP wiring, advisory nudge, and optionally compression routing (--compress) and learned guardrails (--learn). Idempotent and repo-local. Detects assistants in use, or installs for all 20+ supported tools; vg uninstall is the single revert.

Make the code map committable and auto-updating for your team. Installs a pre-commit hook, deterministic merge driver, and .gitignore.

Graph freshness, node/edge counts, staleness, and resolver rungs used. Compares the committed graph against the current working tree.

Rebuild the code map when source files change (debounced). Useful for long agent sessions and live map freshness without a full rebuild each time.

Deterministic open facts for a node — contract, invariant, characterization. Epistemic-typed: declared/static through to observed/derived.

Which tests cover a node via call or coverage linkage. --missing shows untested nodes nearby. --run prints (or --exec runs) the minimal command to exercise exactly those tests.

Precompute the semantic index so the next vg ask is instant. Local ONNX model downloaded once into a shared cache — fully offline after first run.

Export the code map in various formats: JSON, GraphML, Graphviz DOT, Neo4j Cypher, Markdown, HTML, CycloneDX SBOM, or SPDX.

One read-only diagnostic pass: config file, credentials (redacted), map freshness, hosted catalog reachability, MCP launch shape, and telemetry opt-outs. Prints state; changes nothing.

Start the Vibgrate language server over stdio — the shared engine behind Vibgrate for VS Code and other thin IDE clients. Editors spawn this; humans rarely run it by hand.

Local workspace daemon for multi-root graph sessions used by IDE extensions and agents: start, ensure, register workspaces, publish the map, and query impact without mutating repos.

Show the production context-policy pin used by VG Code ranking, and verify a signed context-policy patch file before any release that would bump it.

Isolated inference host process for enterprise isolation: load weights and decode over a local socket. Code Modes and install stay on vg models; management never moves into the host.

Holistic Code Specification: extract deterministic code facts from Rust, Ruby, PHP, Dart, Swift, Scala, C++, COBOL, and VB6, then render, map, gate, and validate that fact stream.

Manage the optional local modules the CLI can load — relevance, the Architecture module, and the HCS engine. Install fetches an integrity-checked tarball into the Vibgrate cache; nothing in your project is touched.

Configure Vibgrate with vibgrate.config.ts — thresholds, scanner toggles, and exclusions.

Beyond core drift scoring — platform matrix, dependency graph, security posture, and more.

Collect platform and architecture signals that predict where builds will break.

Risk classification for deprecated packages, native modules, and platform-specific dependencies.

Lockfile analysis for duplicate packages, phantom dependencies, and workspace graphs.

Map your full technology stack by detecting packages across categories.

Detect CI/CD systems, containerization, and infrastructure-as-code.

Analyze tsconfig.json for strictness, module system, and ESM readiness.

Flag packages and patterns known to cause upgrade pain.

Lightweight complexity analysis using filesystem metadata only.

Structural security hygiene — lockfiles, .gitignore coverage, audit counts.

Local security scanner orchestration and readiness analysis.

Map external service and platform dependencies by detecting SDK packages.

Classify source files into architectural layers and detect project archetypes.

Fast AST-based quality checks for cyclomatic complexity and upgrade friction hotspots.

Map security findings into OWASP Top 10 categories for triage.

Table and column structure from Prisma, SQL migrations, Drizzle, and TypeORM — never a query, a row, or a credential.