Overview
The Vibgrate CLI installs as @vibgrate/cli and exposes the vg command (vibgrate is an alias). scan is the default subcommand — bare vg scans the current directory. Never append a trailing . to path-defaulting commands.
This page is the full inventory. Each link opens the detailed command page. Under each set, Typical path is the order most teams run the important commands; the table below it is the full list A–Z.
Drift scoring & supply chain
Typical path: vg init → vg scan → vg baseline → vg report → vg fix
| Command | Purpose |
|---|---|
vg / vg scan | Scan for upgrade drift (default subcommand) |
vg baseline | Create a drift baseline snapshot |
vg bisect | Commit where a dependency crossed a version line |
vg evidence | Signed regulatory evidence (regime-neutral; CRA first) |
vg fix | Ranked, risk-tiered upgrade plans (hosted planner) |
vg init | Initialize Vibgrate in a project |
vg report | Generate a drift report from a scan artifact |
vg sbom | SBOM export/delta and OpenVEX |
vg scan --vulns | Drift plus known vulnerabilities (OSV) |
vg update | Update the CLI |
vg why | Who introduced a dependency + open vulnerabilities |
Change review
Vibgrate Review — did this change move the system toward its declared architecture, weaken a security control, or create an implication the author did not account for? Answered locally from the code map, as one decision in a signed, versioned receipt.
Typical path: vg review → vg review findings-from-diff → vg review propose <id> --model forge --json → vg review --base origin/main --format json in CI → vg review verify <receipt>
| Command | Purpose |
|---|---|
vg review | Architecture + security-control review of the current change (pass / needs_review / fail / undetermined) |
vg review findings-from-diff | Deterministic vg.review.findings.v1 document for the change (correctness blast-radius and architecture-policy rows plus security scanners; JSON adds publishable; writes .vibgrate/review-propose-handoff.json) |
vg review explain | The evidence behind one finding: graph edges, spans, policy rules |
vg review propose | PatchIR dry-run for one finding (--model relay:<slug> or spark|flow|forge; --findings, same --base / --in-place / --diff as findings-from-diff, or last-run .vibgrate/review-propose-handoff.json; never writes the default branch) |
vg review verify | Check a receipt's digest and Ed25519 signature offline (verified / unverified / failed) |
Workspace auth & cloud upload
Sign in, create a DSN for CI, and push scan results. Local drift scoring does not require this — nothing leaves your machine until you push.
Typical path: vg login → vg dsn → vg push → vg logout
| Command | Purpose |
|---|---|
vg dsn | Manage DSN tokens |
vg login | Browser auth with your Vibgrate workspace |
vg logout | Clear stored login credentials |
vg push | Push scan results to Vibgrate Cloud |
Localization
Vibgrate Localize — your application's translation keys and translations, synced between your repo and Vibgrate Cloud. config and format are local-only and free on every plan; the rest need a Team plan or above.
Typical path: vg locale config → vg locale push → vg locale pull
| Command | Purpose |
|---|---|
vg locale | Manage app translations — config, push, pull, status, format (vg localize is an alias) |
Code graph
Typical path: vg build → vg status → vg ask → vg impact → vg share
| Command | Purpose |
|---|---|
vg ask | Ask the map (budget-bounded context block) |
vg build | Build or update the deterministic code map |
vg bundle | Air-gapped bundle |
vg drift | Outdated dependencies (offline; --online for currency) |
vg embed | Precompute the local semantic index |
vg export | Export the map (JSON, GraphML, SBOM, …) |
vg facts | Deterministic facts for a node |
vg guide | Cited standards/practices for a node |
vg impact | Blast radius of a change |
vg map / hubs / areas / oddities | Overview, hubs, communities, smells |
vg path | Shortest path between two nodes |
vg savings | Tokens/$ saved — grep baseline for map queries, and context compression |
vg share | Commitable map + team hooks |
vg show | Explain a node, with its architecture role |
vg show arch | Local, interactive architecture map of the graph |
vg status | Map freshness, counts, staleness |
vg tests | Tests covering a node |
vg tree | Call tree from a node |
vg unknowns | Unresolved sites by blast radius |
vg watch | Rebuild the map when files change (debounced) |
AI context & library docs
Typical path: vg serve → vg install → vg lib
| Command | Purpose |
|---|---|
vg install / uninstall | Wire AI assistants (or remove wiring) |
vg lib | Version-correct library docs |
vg serve | Vibgrate AI Context (local MCP) |
Context compression
Compression adds no new command. It is a mode of vg serve, a flag on vg install, and a section of vg savings — see the context compression overview.
Typical path: vg install claude --compress → use Claude Code as usual → vg savings
| Command | Purpose |
|---|---|
vg serve --compress | Serve the code map and compress context: an Anthropic- and OpenAI-compatible listener on loopback |
vg serve --compress --background | Start the listener as a background process (or reuse the running one) and return |
vg serve --compress <agent> | Run one agent session through it, environment only — nothing written; everything after the agent name is the agent's |
vg install <agent> --compress | Route an agent through it durably by writing its base-URL config (reversible), and start the listener |
vg install <agent> --learn | Turn past agent sessions into guardrails in its instructions file (--apply writes) |
vg uninstall <agent> | Put that config back byte-for-byte, with everything else vg install wrote |
vg savings | Tokens and dollars saved, today / 7 days / 30 days, by model, client and project |
vg savings --benchmark | Offline compression benchmark on built-in fixtures: latency and ratio per content type |
vg show savings | Open the same numbers as a live local page |
vg serve status / vg serve stop | What is listening and which agents are routed; stop a background listener |
vg serve config | Every VG_* knob and where its value came from; set / unset write settings.json |
vg serve memory | Cross-agent project memory: list, search, add, delete, stats, export, import |
vg serve compress [file] | Run the pipeline over a file by hand — the debug path |
vg serve retrieve <hash> | Expand a compression marker back to the original, or a slice of it |
Code edits & models
Typical path: vg models → vg code
| Command | Purpose |
|---|---|
vg code | Graph-grounded code edit (dry-run by default) |
vg models | Code Modes (Spark/Flow/Forge) + local fleet |
Holistic Code Specification
Deterministic code facts for Rust, Ruby, PHP, Dart, Swift, Scala, C++, COBOL, and VB6 — extract once, then read, map, or gate the stream.
Typical path: vg hcs extract → vg hcs digest / vg hcs map / vg hcs gate
| Command | Purpose |
|---|---|
vg hcs | Extract, digest, map, gate, and validate code-fact streams |
vg module | Manage the optional local modules (relevance, arch, hcs) |
Diagnostics, IDE & runtime
Typical path: vg doctor → vg lsp → vg daemon
| Command | Purpose |
|---|---|
vg daemon | Local workspace daemon for multi-root graph sessions |
vg doctor | Diagnose config, credentials, map, hosted reachability, MCP launch, local inference, compression listener and store |
vg llm-host | Isolated inference host process (enterprise isolation) |
vg lsp | Language server (stdio) for IDE extensions |
vg policy | Context-policy production pin and signed patch verify |
Try without installing
npx @vibgrate/cli scan
After install, prefer vg (not vibgrate) in docs and scripts.