Guides articles for the Vibgrate CLI.
An end-to-end walkthrough: connect a repository to a locale project, push your source keys, translate in Vibgrate Cloud, and pull accepted translations back into your codebase — then wire the safe verb into CI so new keys reach translators automatically.
What legal entity, main establishment, EU authorised representative, coordinator CSIRT, responsible person, filing authority, and out-of-hours contact mean — written for first-time users.
How to register a product with digital elements: markets as country codes, CRA classification options, and recording an in-scope or out-of-scope determination with a rationale.
Why frozen release manifests matter, how to freeze from a scan or SBOM, what ship date and artefact digest mean, and how support periods affect end-of-life handling.
How exposure matching works, what CVE means, offline advisory files, product filters, end-of-life inclusion, and how to build a submission pack or signed bundle.
What the CISA Known Exploited Vulnerabilities catalog is, how Vibgrate Evidence watch uses it against frozen components, and what the results do and do not mean for filings.
Practice the exposure determination against a simulated advisory built from a component you already ship, and optionally record how long your team took.
How offline verification works, what verified / unverified / failed mean, and when to supply a PEM public key as a trust root.
Download an SBOM from Vibgrate Cloud wrapped in a signed attestation, so a consumer can prove it came from Vibgrate and has not been altered — and see its verified status in the dashboard.
Run the Vibgrate CLI inside a container with Docker, mount your project for scanning, and capture machine-readable output for pipelines.
Connect the CLI to Vibgrate Cloud: log in, run a scan, and push results so your team can see DriftScore trends over time in one workspace.
Learn the fastest way to scan a project for upgrade drift. Running bare vg scans the current directory and prints a DriftScore with no configuration required.
Point a Vibgrate scan at a specific folder without changing shells. Use the --cwd flag to scan a subdirectory or sibling project from anywhere.
Generate machine-readable JSON from a Vibgrate scan for scripting, dashboards, and custom tooling. Learn the --format json flag and how to combine it with --out.
Emit SARIF from a Vibgrate scan so drift findings appear in GitHub code scanning and other SARIF-aware tools. Learn the --format sarif flag and how to save it.
Choose human-readable scan output: the default table for terminals and Markdown for pull request comments and docs. Learn the --format options for readable reports.
Enforce a maximum acceptable DriftScore with --drift-budget. Learn how to set a budget so scans fail when drift exceeds the threshold you choose.
Keep generated code, vendored folders, and fixtures out of your drift results with the --exclude flag. Learn how to focus a Vibgrate scan on the code that matters.
Speed up pull request checks by scanning just what changed. Learn the --changed-only flag and when a focused scan is the right choice for fast feedback.
Save scan output as a build artifact with the --out flag. Learn how to write JSON, SARIF, or Markdown results to a named file for archiving and CI uploads.
Run Vibgrate across a monorepo. Learn how to scan the whole tree, target individual packages with --cwd, and exclude folders to keep results meaningful.
Focus a Vibgrate scan on one package or service. Learn how to use --cwd to target a package directory and get a DriftScore scoped to the code one team owns.
Compare a scan against a saved baseline to see what drift is new. Learn how to capture a baseline and pass it with --baseline for delta-based gates.
Make scans fast and predictable. Learn how caching speeds repeated scans, when to use --no-cache for a clean run, and how --changed-only keeps feedback quick.
Get reliable scans on big codebases. Learn how to exclude heavy directories, scope to changed files, and control caching so large-repo scans stay fast and accurate.
Resolve common scan problems. Learn how to rule out stale caches with --no-cache, narrow scope with --cwd and --exclude, and read exit codes when a scan fails CI.
Understand the configuration that vg init writes, how to tune scanner toggles and exclusions, and why committing the config keeps your team and CI consistent.
Keep scans fast and focused by excluding generated, vendored, and irrelevant directories using configuration exclusions and the --exclude flag.
Use vg scan --baseline to compare the current state against a stored snapshot, report drift as a delta, and fail builds only when drift worsens.
Keep baselines meaningful over time: when to refresh after intentional upgrades, how to re-run vg baseline, and how to avoid masking real drift.
Make scans deterministic across machines and CI by pinning a specific Vibgrate CLI version, and learn how this interacts with vg update.
Give each repository its own committed Vibgrate configuration so thresholds, scanner toggles, and exclusions match that project, and stay consistent across the team.
Understand how CLI workspace settings connect local scans to a Vibgrate Cloud workspace via vg login or a DSN, and how that enables team trend analysis.
Diagnose and fix common authentication problems: failed uploads, expired or missing DSNs in CI, stale local credentials, and pushing to the wrong workspace.
Turn a Vibgrate CLI scan into a human-readable report you can read, review, or attach to a pull request. Learn how to produce Markdown, text, or JSON reports with vg report.
Produce a report that teammates, reviewers, and stakeholders can actually open. Learn which format to pick for each audience and how to attach reports to pull requests and chat.
Send your scan results to Vibgrate Cloud so your whole team sees DriftScore, findings, and trends on one dashboard. Learn the two ways to upload and how authentication works.
Get a repository showing up in Vibgrate Cloud by naming it consistently on upload. Learn how --repository-name groups scans under the right repo so trends stay coherent.
Generate an HMAC-signed DSN token so non-interactive environments can upload to Vibgrate Cloud. Learn how vg dsn create works and how to use --dsn safely in CI.
See how your DriftScore moves over time once you push scans to Vibgrate Cloud. Learn what builds a trend line and how to keep history continuous.
Roll many repositories up into a single portfolio view so leaders can compare DriftScore across the estate. Learn how consistent naming and pushing build the rollup.
Keep DriftScore data fresh by scanning and pushing on a schedule. Learn how to wire vg scan --push into scheduled CI jobs for continuous reporting.
Turn drift data into a one-glance summary leaders can act on. Learn how to combine vg report output with the Vibgrate Cloud dashboard for executive reporting.
Feed your own BI and analytics tools with machine-readable drift data. Learn how to export JSON from vg report and where to write it with --out.
Wire Vibgrate uploads into your CI so every build reports its DriftScore to Vibgrate Cloud. Learn the canonical scan-and-push pattern with DSN authentication.
Group related repositories under an application so drift rolls up to something the business recognizes. Learn how consistent repository naming feeds application views.
Read DriftScore as a moving signal rather than a snapshot. Learn what makes the number move, how baselines complement trends, and how to keep history reliable.
Give each team a focused view of the repositories they own. Learn how consistent naming and grouping turn pushed scans into per-team dashboards.
Understand how access to Vibgrate Cloud works and how the CLI authenticates against your workspace. Learn the difference between interactive login and DSN-based uploads.
Fix the most common reasons a push to Vibgrate Cloud fails — missing login, stale or wrong DSN, and inconsistent repository names. Step through the checks in order.
Automate SBOM generation on every build by adding vg sbom export to your CI pipeline, so a fresh, reproducible Software Bill of Materials is produced for each commit or release.
Learn how to generate a Software Bill of Materials and attach it to a tagged release so customers, auditors, and downstream tools can retrieve the exact component inventory for each version.
Use Vibgrate SBOMs as durable audit evidence. Learn how to produce, name, and retain Software Bills of Materials so they satisfy compliance reviews and customer security questionnaires.
Working in a monorepo? Learn strategies for producing Software Bills of Materials at the right granularity — per package or for the whole workspace — using Vibgrate CLI.
Understand how Vibgrate's source-level SBOM fits projects that ship as container images, what it covers, and how to combine it with image-layer SBOM tooling for full coverage.
Run drift scoring and SBOM export together so a single build produces both a DriftScore for upgrade risk and a Software Bill of Materials for supply-chain visibility.
Bring SBOMs, dependency-risk findings, security posture, and drift scoring together into a repeatable check that tells you whether your software supply chain is in good shape.
Send your scan results to Vibgrate Cloud for team visibility and trend tracking, and keep SBOM files as release artifacts — learn how the local SBOM and the hosted dashboard work together.
Fix the most common problems with vg sbom export — empty component lists, missing licenses, wrong output location, and format confusion — so you get a complete, correct SBOM.
Learn how to keep the Vibgrate code graph fresh as your code changes using incremental vg build runs, so vg show, vg ask, and vg impact always reflect current code.
Make code reviews faster and safer by using vg impact, vg show, and vg tree to understand blast radius, verify dependencies, and surface the tests a change should pass.
Help new team members learn a codebase quickly using vg ask, vg show, and vg tree to explore structure, follow entry points, and ask natural-language questions offline.
Plan and execute refactors with confidence using vg impact to map blast radius, vg tree to understand structure, and vg impact --tests to know what to run before shipping.
Build and query a code graph across a monorepo with vg build, then use vg path and vg impact to understand cross-package dependencies and the reach of shared code.
Fix common Vibgrate Graph issues — stale results, missing nodes, empty paths, and overwhelming trees — by rebuilding correctly and choosing the right query for the question.
A guide to every format vg export supports — JSON, GraphML, Graphviz DOT, Neo4j Cypher, Markdown, HTML, CycloneDX, and SPDX — with guidance on which to pick for visualization, databases, docs, and SBOMs.
A practical guide to making the Vibgrate Graph code map a shared team asset with vg share — committing it to version control, keeping it fresh automatically, and avoiding merge conflicts.
A guide to feeding deterministic, epistemic-typed facts to AI assistants so their suggestions are grounded in your real code — contracts, invariants, and characterizations served via Vibgrate AI Context.
A guide to using vg tests --missing to find untested nodes near your changes, then --run or --exec to run exactly the right tests — closing coverage gaps without running the whole suite.
A troubleshooting guide for common issues with vg export and vg share — stale output, missing code map, format and path mistakes, and committed maps that look out of date after a pull.
Resolve documentation for the exact version of a library your project depends on, using vg lib and the Free Dev Docs Library served through Vibgrate AI Context. A practical walkthrough.
Wire Vibgrate AI Context into Claude and Claude Code so the assistant can read your code map, drift, and version-correct library docs over MCP. Step-by-step using vg install and vg serve.
Set up Vibgrate AI Context in Cursor so its AI reads your code map, drift, and version-correct library docs over MCP. A step-by-step guide using vg install and vg serve.
Wire Vibgrate AI Context into VS Code so Copilot and MCP-aware extensions read your code map, drift, and version-correct library docs. Step-by-step using vg install and vg serve.
Set up Vibgrate AI Context as an MCP server in the Continue extension so its AI reads your code map, drift, and version-correct library docs. A step-by-step guide.
Add Vibgrate AI Context as an MCP server in the Zed editor so its assistant reads your code map, drift, and version-correct library docs. A step-by-step guide.
Vibgrate AI Context is a standard MCP server, so any MCP-compatible client can use it. Learn how to connect tools beyond the ones with built-in wiring, using vg serve.
Vibgrate AI Context serves more than docs — it feeds your code map and DriftScore to your AI assistant over MCP. Learn how to expose structural and drift context alongside version-correct docs.
Vibgrate AI Context runs fully offline after a one-time model download, making it suitable for air-gapped and disconnected environments. Learn how to prepare and run it without network access.
Version-correct docs are only correct if they track your dependencies. Learn how the Free Dev Docs Library stays aligned with your lockfile and how to refresh it as you upgrade.
Bring version-correct docs and code-map context into AI-assisted code review with Vibgrate AI Context. Learn how grounded context catches version-mismatched suggestions before they merge.
A transparent guide to Vibgrate's privacy-first architecture — what data is collected, what is never collected, and how to use privacy modes.
Import Vibgrate's core TypeScript types for programmatic use — build custom tools, dashboards, and integrations on top of the scan artifact schema.
Run full drift analysis without any network connectivity using downloaded package manifests. Perfect for secure, restricted, or air-gapped environments.
A comprehensive guide to all extended scanners in the Vibgrate CLI — platform matrix, dependency risk, security posture, architecture layers, code quality, and more.
A guide to all four output formats supported by the Vibgrate CLI — when to use each, what they contain, and how to integrate them into your workflows.
Complete reference for the Vibgrate configuration file — thresholds, scanner toggles, exclude patterns, and all supported config formats.