Concepts articles for the Vibgrate CLI.
What a reporting framework is, how it relates to the CLI “regime” flag, and which frameworks ship today — including the EU Cyber Resilience Act and DORA incident reporting.
How Vibgrate measures vulnerability exposure over time — who introduced each issue, how long you have been exposed, and whether remediation keeps pace with per-severity SLAs.
Understand what a Vibgrate scan tells you. Learn how to read the DriftScore, the findings summary, and the exit code so you can act on results with confidence.
Learn what a drift budget is, how the --drift-budget flag turns DriftScore into a pass/fail gate, and how it complements baselines and worsening checks.
A plain-language introduction to the Software Bill of Materials (SBOM): what it lists, why regulators and customers ask for one, and how Vibgrate CLI produces one from your codebase.
Vibgrate's Dependency Risk scanner classifies risky packages — deprecated, native, or platform-specific. Learn what these findings mean and how they complement your SBOM.
How Vibgrate surfaces vulnerable dependencies through its security scanning and SBOM output, and how to feed CycloneDX SBOMs into vulnerability tooling and OpenVEX exploitability statements.
Your SBOM captures the licenses of every dependency. Learn how license information appears in Vibgrate's CycloneDX and SPDX output and how to use it for license compliance.
Learn what Vibgrate Graph is, what the code graph (code map) represents, and how it powers offline queries like vg show, vg ask, vg impact, vg path, and vg tree.
Learn how to read vg impact results — the reverse-reachability blast radius and decay confidence — so you can tell a contained change from a risky one and act accordingly.
Understand how incremental vg build keeps the code graph fast, why graph queries are offline and quick after the first build, and how to keep large-repo workflows snappy.
Vibgrate AI Context is the local, offline MCP server that serves your code map, drift, and version-correct library docs to any AI assistant. Learn what it does, why it exists, and how it differs from the Vibgrate Cloud MCP.
The Free Dev Docs Library gives your AI assistant version-correct documentation pinned to your lockfile, served offline through Vibgrate AI Context. Learn what it covers and how it keeps AI answers accurate.
AI assistants hallucinate APIs because their training data is frozen and version-blind. Learn why version-correct documentation from the Free Dev Docs Library makes AI-assisted coding dramatically more accurate.
Vibgrate AI Context runs locally, needs no account, and uploads nothing. Learn exactly what stays on your machine and why the local context server is safe for sensitive codebases.
Learn what the Dependency Risk Scanner detects — deprecated packages, native modules, and platform-specific dependencies — why each class raises upgrade risk, and how to act on the findings before they block a release.
Understand how the Dependency Graph Scanner analyzes lockfiles to find duplicate packages, phantom dependencies, and workspace graph problems — and why these hidden issues make upgrades fragile.
See how the Tooling Inventory Scanner detects packages across categories to build a complete map of your stack — frameworks, build tools, test runners, and more — and why an accurate inventory is the foundation of upgrade planning.
Learn how the Build & Deploy Scanner detects your CI/CD systems, containerization, and infrastructure-as-code — and why understanding your delivery pipeline is essential to predicting where upgrades break in production.
Understand how the TypeScript Modernity Scanner reads tsconfig.json to assess strictness, module system, and ESM readiness — and why these settings determine how painful your next TypeScript or framework upgrade will be.
Learn how the Breaking Change Exposure Scanner flags packages and patterns known to cause upgrade pain, why early exposure data lowers migration risk, and how to plan around the findings.
Understand how the File Hotspots Scanner uses filesystem metadata alone to surface likely complexity hotspots, why a zero-parse signal is fast and privacy-friendly, and how to use the findings to focus effort.
Learn how the Security Posture Scanner checks structural security hygiene — lockfile presence, .gitignore coverage, and audit counts — why these basics predict supply-chain risk, and how to close the gaps.
Understand how the Security Scanners Scanner detects and assesses readiness of local security tools, why orchestration beats ad-hoc scanning, and how to use the findings to harden your pipeline.
Learn how the Service Dependencies Scanner detects SDK packages to map your external service and platform dependencies, why this map matters for resilience and upgrades, and how to act on it.
Understand how the Architecture Layers Scanner classifies source files into layers and detects project archetypes, why an explicit layer map reveals structural drift, and how to use it.
Learn how the Code Quality Scanner runs fast AST-based checks for cyclomatic complexity and upgrade-friction hotspots, why content-aware analysis catches what metadata misses, and how to act on findings.
Understand how Vibgrate maps security findings into OWASP Top 10 categories, why a shared taxonomy speeds triage and reporting, and how to use the mapping to prioritize fixes.
Learn how the Platform Matrix Scanner collects platform and architecture signals that predict build breakage, why cross-platform risk is easy to miss, and how to use the matrix to harden your pipeline.
See how Vibgrate's individual scanners contribute to one 0-100 DriftScore, why a single number aids prioritization without hiding detail, and how to drill from the score into the findings behind it.
Learn a practical method for reading scanner findings, prioritizing them by impact, and turning a scan into an action plan — so the DriftScore becomes work that ships rather than a number you ignore.
Learn what upgrade drift is, why it accumulates silently, and how Vibgrate CLI measures it so you can keep dependencies, runtimes, and tooling current without surprises.
Understand what a DriftScore of 0-100 means, how the risk bands map to action, and how to read a score in context rather than chasing a perfect zero.
A practical look at the factors that increase or decrease your DriftScore, so you can prioritize the upgrades that move the number most and keep drift in check.
Understand the difference between a drift baseline and a drift budget, when to use each, and how they work together to stop regressions and cap absolute drift.
Learn how to treat drift as an architectural fitness function — an automated, objective check that your codebase keeps moving in the right direction over time.
Understand Vibgrate CLI's output formats — human-readable text, JSON, SARIF, and Markdown — and when to choose each for terminals, pipelines, code scanning, and reports.
Understand how Vibgrate CLI uses exit codes to signal pass, fail, and error so your scripts and CI pipelines can branch reliably on scan results.
Learn which languages and ecosystems Vibgrate scans and how it reads manifests and lockfiles to detect dependencies, runtimes, and drift across a polyglot codebase.
Understand how Vibgrate recognizes monorepos and workspaces, reads their package graphs, and scans multiple packages so drift is measured across the whole repository.
Learn the difference between direct and transitive dependencies, why both contribute to drift and risk, and how Vibgrate uses lockfiles to see the full tree.
Understand what an end-of-life runtime is, why it's one of the biggest drivers of drift and risk, and how Vibgrate surfaces unsupported language and platform versions.
Learn how deprecations and breaking changes accumulate as drift, the difference between the two, and how Vibgrate flags exposure before an upgrade bites you.
Understand why upgrade drift is also a security problem, how outdated dependencies and EOL runtimes expand your exposure, and how Vibgrate surfaces structural security signals.
Learn why a single DriftScore is less useful than a trend, and how baselines and Vibgrate Cloud let you track whether drift is improving or quietly creeping up.
Understand the difference between scanning for drift locally and in CI, when to use each, and how to combine them for fast feedback and reliable enforcement.
Learn what a code graph is, how Vibgrate Graph maps your source into nodes and edges, and why a structural model of your code powers offline queries and impact analysis.
Understand what version-correct AI context means, why pinning docs and code structure to your lockfile prevents AI hallucinations, and how Vibgrate AI Context serves it offline.
How Vibgrate sizes each scanned project into nano, micro, small or standard tiers, bills it as a fraction of a project, and rounds the total down to your billable projects.
A deep dive into how the Vibgrate DriftScore is calculated — the four weighted components, risk levels, and how to interpret your score.
Turn drift scoring into a formal quality gate. Learn how baselines, drift budgets, and worsening thresholds create fitness functions that prevent drift regression in CI.