Command Line Interface

Vibgrate CLI

One command scans any repo for upgrade drift — a 0–100 DriftScore, the vulnerabilities hiding in stale dependencies, and the upgrade path to clear them.

Free · results in about 60 seconds · nothing uploads unless you push it

Replay

demo@vibgrate — bash

❯ npx @vibgrate/cli scan

╭──────────────────────────────────────────╮

│ Vibgrate Drift Report │

╰──────────────────────────────────────────╯

── node-turborepo (node) .

Runtime: >=18.0.0 (6 majors behind)

Frameworks:

Turbo: 1.13.4 → 2.10.4 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

1 current 1 1-behind 3 2+ behind 1 unknown

── @repo/admin (node) apps/admin

Frameworks:

TanStack Query: 5.101.2 → 5.101.2 (current)

React: 18.3.1 → 19.2.7 (1 behind)

React DOM: 18.3.1 → 19.2.7 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vite: 5.4.21 → 8.1.4 (3 behind)

Dependencies:

4 current 8 1-behind 3 2+ behind 4 unknown

── @repo/api (node) apps/api

Frameworks:

Express: 4.22.2 → 5.2.1 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vitest: 1.6.1 → 4.1.10 (3 behind)

Dependencies:

7 current 5 1-behind 3 2+ behind 4 unknown

── @repo/web (node) apps/web

Frameworks:

Next.js: 14.2.35 → 16.2.10 (2 behind)

React: 18.3.1 → 19.2.7 (1 behind)

React DOM: 18.3.1 → 19.2.7 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

2 current 6 1-behind 3 2+ behind 5 unknown

── @repo/config (node) packages/config

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

2 current 2 1-behind 5 2+ behind 0 unknown

── @repo/types (node) packages/types

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

0 current 0 1-behind 1 2+ behind 1 unknown

── @repo/database (node) packages/database

Frameworks:

Prisma: 5.22.0 → 7.8.0 (2 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

1 current 0 1-behind 3 2+ behind 1 unknown

── @repo/ui (node) packages/ui

Frameworks:

React: 18.3.1 → 19.2.7 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

React: 18.3.1 → 19.2.7 (1 behind)

Dependencies:

1 current 4 1-behind 1 2+ behind 1 unknown

── @repo/utils (node) packages/utils

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vitest: 1.6.1 → 4.1.10 (3 behind)

Dependencies:

0 current 1 1-behind 2 2+ behind 1 unknown

Tech Stack

Frontend: React, React DOM

Meta-frameworks: Next.js

Bundlers: tsx, Turbo, Vite

CSS / UI: Autoprefixer, PostCSS, Tailwind CSS

Backend: Express

ORM / Database: Prisma, Prisma Client

Testing: Vitest

Lint & Format: ESLint, ESLint Prettier, ESLint React, Prettier, typescript-eslint

Services & Integrations

Auth: JWT 9.0.3

Databases: Prisma 5.22.0

TypeScript

v5.3.3 · strict ✔ · MIXED · target: ES2022

Build & Deploy

Package Managers: pnpm

Monorepo: npm-workspaces, pnpm-workspaces, turbo

Product Purpose Signals

Frameworks: react, nextjs

Evidence: 177

Top Signals:

- [heading] Dashboard (apps/admin/src/pages/Dashboard.tsx)

- [title] Revenue Overview (apps/admin/src/pages/Dashboard.tsx)

- [copy] workspace:* (packages/ui/package.json)

- [copy] ./dist (packages/ui/tsconfig.json)

- [copy] ./src/index.ts (packages/ui/package.json)

- [copy] @repo/config/tsconfig-base.json (packages/ui/tsconfig.json)

- [copy] @repo/ui (packages/ui/package.json)

- [copy] #3b82f6 (apps/admin/src/pages/Dashboard.tsx)

Unknowns:

- No pricing or billing evidence found.

- No integrations/connectors evidence found.

- No route structure evidence found.

Security Posture

Lockfile ✖ · .env ✔ · node_modules ✔

Platform

Native modules: turbo

Code Quality

Files: 36 · Functions: 183 · Avg complexity: 2.62 · Avg length: 21.13 lines

Max nesting: 2 · Circular deps: 0 · Dead code: 0%

God files: apps/admin/src/pages/Products (448 lines)

Findings (16 errors, 11 warnings)

✖ Node.js runtime ">=18.0.0" reached end-of-life on 2025-04-30 (latest: 24.0.0).

vibgrate/runtime-eol in .

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in .

✖ 60% of dependencies are 2+ major versions behind in node-turborepo.

vibgrate/dependency-rot in .

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.1.1).

vibgrate/dependency-major-lag in .

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/admin

✖ Vite is 3 major versions behind (current: 5.4.21, latest: 8.1.4).

vibgrate/framework-major-lag in apps/admin

✖ vite is 3 major versions behind (spec: ^5.0.12, latest: 8.1.4).

vibgrate/dependency-major-lag in apps/admin

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/api

✖ Vitest is 3 major versions behind (current: 1.6.1, latest: 4.1.10).

vibgrate/framework-major-lag in apps/api

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.1.1).

vibgrate/dependency-major-lag in apps/api

✖ vitest is 3 major versions behind (spec: ^1.2.1, latest: 4.1.10).

vibgrate/dependency-major-lag in apps/api

⚠ Next.js is 2 major versions behind (current: 14.2.35, latest: 16.2.10).

vibgrate/framework-major-lag in apps/web

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/web

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.1.1).

vibgrate/dependency-major-lag in apps/web

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/config

✖ 56% of dependencies are 2+ major versions behind in @repo/config.

vibgrate/dependency-rot in packages/config

✖ eslint-plugin-react-hooks is 3 major versions behind (spec: ^4.6.0, latest: 7.1.1).

vibgrate/dependency-major-lag in packages/config

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/types

✖ 100% of dependencies are 2+ major versions behind in @repo/types.

vibgrate/dependency-rot in packages/types

⚠ Prisma is 2 major versions behind (current: 5.22.0, latest: 7.8.0).

vibgrate/framework-major-lag in packages/database

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/database

✖ 75% of dependencies are 2+ major versions behind in @repo/database.

vibgrate/dependency-rot in packages/database

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/ui

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/utils

✖ Vitest is 3 major versions behind (current: 1.6.1, latest: 4.1.10).

vibgrate/framework-major-lag in packages/utils

✖ 67% of dependencies are 2+ major versions behind in @repo/utils.

vibgrate/dependency-rot in packages/utils

✖ vitest is 3 major versions behind (spec: ^1.2.1, latest: 4.1.10).

vibgrate/dependency-major-lag in packages/utils

╭──────────────────────────────────────────╮

│ Top Priority Actions │

╰──────────────────────────────────────────╯

1. Upgrade EOL runtime in node-turborepo

End-of-life runtimes no longer receive security patches and block ecosystem upgrades.

./.

>=18.0.0 → 24.0.0 (6 majors behind)

Impact: −10 drift points (runtime & EOL)

2. Fix security posture: no lockfile found

Without a lockfile, installs are non-deterministic. Run the install command to generate one and commit it.

Missing: package-lock.json, pnpm-lock.yaml, or yarn.lock

3. Upgrade Vite 5.4.21 → 8.1.4 in @repo/admin (+2 more)

3 major versions behind. Major framework drift increases breaking change risk and blocks access to security fixes and performance improvements.

./apps/admin

Vite: 5.4.21 → 8.1.4 (3 majors behind)

./apps/api

Vitest: 1.6.1 → 4.1.10 (3 majors behind)

./packages/utils

Vitest: 1.6.1 → 4.1.10 (3 majors behind)

Impact: −5–15 drift points

4. Reduce dependency rot in @repo/types (100% severely outdated)

1 of 1 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.

./packages/types

typescript: 5.9.3 → 7.0.2 (2 majors behind)

Impact: −5–10 drift points

5. Reduce dependency rot in @repo/database (75% severely outdated)

3 of 4 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.

./packages/database

@prisma/client: 5.22.0 → 7.8.0 (2 majors behind)

prisma: 5.22.0 → 7.8.0 (2 majors behind)

typescript: 5.9.3 → 7.0.2 (2 majors behind)

Impact: −5–10 drift points

╭──────────────────────────────────────────╮

│ Architecture Layers │

╰──────────────────────────────────────────╯

Archetype: monorepo (80% confidence)

Files classified: 29 (6 unclassified)

presentation 9 files drift ████████████████████ 100 risk high

routing 4 files drift ████████████████████ 100 risk high

middleware 2 files drift ███████▍░░░░░░░░░░░░ 37 risk moderate

domain 4 files drift ████████████████████ 100 risk high

data-access 2 files drift ████████████████████ 100 risk high

infrastructure 0 files drift ░░░░░░░░░░░░░░░░░░░░ 0 risk none

config 3 files drift ░░░░░░░░░░░░░░░░░░░░ 0 risk none

shared 5 files drift ████████████████████ 100 risk high

testing 0 files drift ████████████████████ 100 risk high

╭──────────────────────────────────────────╮

│ DriftScore Summary │

╰──────────────────────────────────────────╯

DriftScore: 76/100

Risk Level: HIGH

Projects: 9

Classified: 8 nano · 1 micro · 0 small · 0 standard

Billable: 0.42 · 9 detected → 0.42 billable projects (micro-project pricing)

0.1 micro · 0.32 nano

These fractions add up across repositories, then round down to whole billable projects.

Score Breakdown

Runtime: ████████████████████ 100

Frameworks: █████████▏░░░░░░░░░░ 46

Dependencies: ██████████████████▍░ 92

EOL Risk: ████████████████████ 100

Scanned at 2026-07-11T21:07:49.557Z · 27.1s · 285 files scanned · 56 workspace files · 27 dirs

Press Run to start.

Live replay of real @vibgrate/cli runs against our test repositories — nothing is executed in your browser.

Never reads your source — only manifestsRuns fully offlineNo signup to scanSigned, verifiable releases

The Vibgrate CLI scans your codebase for upgrade drift — the gap between the dependency versions you run and the versions you should run. It produces a deterministic DriftScore (0–100) and prioritized findings, and can check every dependency against known vulnerabilities in the same run.

Multi-Ecosystem

Node.js, .NET, Python, Java, Go, Rust, PHP, Ruby, Docker, Terraform and more — out of the box.

Vulnerabilities Included

Add --vulns to check every dependency against known advisories, with fix versions and exposure metrics.

Private by Default

Everything runs on your machine. Drift scoring reads manifests and lockfiles; nothing uploads unless you push it.

CI Ready

SARIF output, drift baselines, and gates like --fail-on and --drift-budget for pipelines.

Install

Pick your tool — every path lands on the same vg command.

# Run without installing anything
npx @vibgrate/cli scan

# Pin a version or see every command
npx @vibgrate/cli@latest --help

no install·Nothing is installed globally — ideal for CI or a one-off scan.

Every image, chart, and release is signed — verify the provenance

Score the drift

One scan measures the gap between the dependency versions you run and the versions you should run — across Node.js, .NET, Python, Java, Go, Rust, PHP, Ruby, Docker, Terraform and more.

You get a deterministic DriftScore (0–100) and findings ranked by severity, in about 60 seconds. Everything runs on your machine; nothing uploads unless you push it.

Vibgrate CLI terminal output — a drift scan producing a DriftScore and prioritized findings — Real terminal capture of a `vg` scan.

Catch the vulnerabilities drift creates

Add --vulns to check every dependency against known advisories in the same run — severity, CVSS, and the fixed version to upgrade to.

With git history, Vibgrate also computes CRA remediation metrics — exposure windows, time to remediate, and per-severity SLA breaches — framed around the EU Cyber Resilience Act (CRA).

Real Vibgrate Cloud widgets — how findings look once you push a scan.

Gate it in CI

Fail builds with --fail-on, cap drift with --drift-budget, and use vg baseline so gates catch regressions, not history.

SARIF output feeds code scanning, so findings land where your team already reviews them.

Replay

demo@vibgrate — bash

Press Run to start.

Real recorded run — the non-zero exit stops the pipeline, the same gate in every repo.

What's free, what's paid

The Vibgrate CLI is free and open source (Apache-2.0). Scanning, the DriftScore, vulnerability checks, SARIF output, and CI gates all run locally at no cost — no account required.

Pushing results to Vibgrate Cloud is optional. Vibgrate Free covers 1 repository and 5 scans a month; paid plans are priced per project under governance, with unlimited seats. See pricing.

Getting Started

Install the CLI, run your first scan, and understand your DriftScore in under 5 minutes.

Documentation

Complete CLI reference — commands, scanners, configuration, and CI integration.

AI Agent Skills

One command — vg install --all — wires the local code graph into Claude Code, Cursor, Copilot, and 18 more assistants.

Supported Languages

19 languages get a full code graph — definitions, call edges, and locate accuracy, measured every release.

Latest v2026.711.2

TypeScript
JavaScript
Python
Java
Go
Rust
C#
C
C++
Ruby
PHP
Kotlin
Swift
Scala
Dart
Lua
Elixir
Shell
Zig

See the benchmarks

More Getting Started Guides

Install the Vibgrate CLI on macOS and Linux

1 min read

Install the Vibgrate CLI on Windows

1 min read

Install the Vibgrate CLI with npm

1 min read

Install the Vibgrate CLI with pnpm, yarn, or bun

1 min read

Run Vibgrate with npx (no install)

1 min read

Install the Vibgrate CLI with the curl installer

1 min read

View all help articles