Commands articles for the Vibgrate CLI.
Complete reference for vg locale: configure a locale project, push source keys to Vibgrate Cloud, pull accepted translations back into your repo, and format locale files. Covers the free local-only commands, the Team-plan cloud commands, supported file formats, and every shared flag.
Use vg install to add Vibgrate AI Context to your AI assistant — skill, MCP wiring, and an advisory nudge. Detect assistants in use, install for all 20+ supported tools, or remove with vg uninstall.
Run a read-only diagnostic pass: config, credentials (redacted), map freshness, hosted reachability, and MCP launch shape. Prints state; changes nothing.
Start the Vibgrate language server over stdio. Editors spawn this; it powers Vibgrate for VS Code and other thin clients from one engine.
Start and manage the local workspace daemon for multi-root graph sessions used by IDE extensions and agents: ensure, register, publish, query, and impact.
Show the production context-policy pin used by VG Code, and verify a signed context-policy patch file before any release that would bump it.
Manage Code Modes (Spark / Flow / Forge) for VG Code and discover local Ollama, LM Studio, and gguf models. install and pull run when you invoke them; pass --dry-run to preview.
Remove Vibgrate AI Context wiring from named AI assistants. Distinct from uninstalling the CLI package itself.
Register products with digital elements, freeze shipped-release manifests, and answer which shipped products contain a vulnerability as signed, offline-verifiable evidence. Jurisdiction-neutral: the EU Cyber Resilience Act is the first regime.
Propose a minimal code edit for a plain-language instruction, grounded in Vibgrate's deterministic code map and routed to a local or hosted model you choose. Dry-run by default; never writes without your consent.
Get three ranked upgrade plans — Low-risk, Balanced, and Full — scored on real-world exploitability (CISA KEV and FIRST EPSS), so the dangerous upgrade rises to the top. Read-only until you choose to apply.
Detect known vulnerabilities in your installed dependencies against the OSV database, online or air-gapped, with severity, CVSS, the fixing version, and git attribution.
Trace any dependency through git history: who added it, every version since, and any open vulnerabilities it carries — across npm, Python, Go, Rust, Ruby, PHP, Dart, Elixir, and .NET projects.
Pinpoint the commit where a dependency reached a version or semver range — when a fix was adopted, or never was — and gate CI on it, across npm, Python, Go, Rust, Ruby, PHP, Dart, Elixir, and .NET projects.
A step-by-step walkthrough of running vg init to set up Vibgrate in a repository, what the .vibgrate directory contains, and how to verify the setup with a first scan.
Learn how vg init --baseline both sets up Vibgrate and captures a starting drift snapshot in a single command, and when this is the right way to onboard a repository.
Capture a known-good snapshot of your project's drift state with vg baseline so future scans can report change as a delta and power fitness functions.
Walk through vg login to connect the CLI to your Vibgrate workspace from the browser, with no DSN to copy or paste, then verify and push results.
Use vg logout to clear the stored login credential and disconnect the CLI from your Vibgrate workspace, and learn when signing out is the right move.
Keep the CLI current with vg update to check for and install the latest version, why staying updated matters, and how to confirm your installed version.
A step-by-step guide to exporting a CycloneDX Software Bill of Materials from your project using vg sbom export, including the output file and what to do with it.
A step-by-step guide to building a code graph with vg build, including incremental updates, what the build produces, and how to confirm it worked before running queries.
Use vg show to explain any code node — what it is, what it calls, and what calls it. Learn how to read its callers, callees, and structural metadata.
Use vg ask to query the code graph in natural language and get a budget-bounded context block ready to paste into any AI assistant — fully offline after the first use.
Use vg impact to see what breaks if you change a node — a deterministic structural blast radius from reverse reachability with decay confidence — so you can plan changes safely.
Use the --tests flag on vg impact to surface exactly the tests to run before shipping a change, turning a structural blast radius into a focused, runnable test list.
Use vg path to show how node A connects to node B — the shortest path through the call graph — so you can trace exactly how two parts of your code relate.
Use vg tree to walk the call tree rooted at a node — callees by default — with depth-bounded, cycle-safe traversal so you can understand how code fans out.
Use vg hubs to surface the most-depended-on nodes in your codebase — the functions, classes, and modules that everything else relies on. Learn why hubs matter for risk, refactoring, and onboarding.
Use vg oddities to surface surprising cross-area links — the connections that violate your intended architecture. Learn how Vibgrate Graph flags these smells and how to triage them.
Use vg areas to reveal the natural groupings in your codebase — clusters of nodes that work closely together. Learn how communities help you understand modularity and plan refactors.
Use vg map to get a structural overview of your repository — the high-level shape of your code map in one command. Learn what the overview shows and how to drill in from there.
Use vg lib to access version-correct library docs pinned to your lockfile — the Free Dev Docs Library, served offline to any AI assistant. Learn how it keeps docs aligned with the versions you actually run.
Use vg export with --format and --out to write your code map to JSON, GraphML, Graphviz DOT, Neo4j Cypher, Markdown, HTML, or SBOM. Learn how to move the graph into other tools.
Use vg embed to precompute the semantic index so your next vg ask is instant. Learn how the local ONNX model works, why it is fully offline, and when to run it.
Use vg share to make the code map committable and auto-updating. It installs a pre-commit hook, a deterministic merge driver, and .gitignore entries so the graph stays fresh in version control.
Use vg status to see graph freshness, node and edge counts, staleness, and the resolver rungs used. Learn how it compares the committed graph against your working tree.
Use vg facts to produce deterministic facts for a node — contract, invariant, and characterization — typed by how they were derived, from declared/static to observed. Learn how facts ground AI assistants.
Use vg tests to see which tests cover a node, --missing to find untested nodes nearby, and --run or --exec to get and run the minimal test command. Learn to target exactly the tests that matter.
Use vg lib to see which libraries Vibgrate can serve version-correct documentation for, resolved against your project's lockfile. A quick reference for the command and what it shows.
Run vg serve to launch Vibgrate AI Context, the local, offline MCP server that feeds your code map, drift, and version-correct library docs to any AI assistant. A practical command guide.
Everything you need to know about the vg init command: creating the .vibgrate directory, generating a default config file, and optionally establishing your first baseline.
The primary CLI command. Scan your project for upgrade drift, generate reports in multiple formats, enforce quality gates, and optionally push results to the dashboard.
Establish a drift baseline snapshot for delta comparison. Baselines are the foundation of drift fitness functions and CI regression gates.
Generate Markdown, text, or JSON reports from existing scan artifacts. Perfect for sharing drift status with stakeholders who do not use the CLI.
Export CycloneDX or SPDX SBOMs from scan artifacts, compare dependency deltas between two scans, and generate OpenVEX exploitability statements for supply-chain governance.
Upload scan results to the Vibgrate Cloud API for team visibility, portfolio tracking, and historical trend analysis.
Generate HMAC-signed DSN tokens for authenticating scan uploads to Vibgrate Cloud. Supports US and EU data residency regions.
Check for and install Vibgrate CLI updates. Supports npm, pnpm, yarn, and bun package managers.