Beginner-level help articles for the Vibgrate CLI.
Configure your organization, register a product with digital elements, freeze a shipped release, and run your first exposure check from the Evidence panel — no prior regulatory tooling required.
Step-by-step instructions for installing the Vibgrate CLI on macOS and Linux, including Node-based and curl installer options, plus how to confirm the install works.
How to install the Vibgrate CLI on Windows using npm or the PowerShell installer, then verify that the vg command works in PowerShell and Windows Terminal.
Install the Vibgrate CLI globally or per-project with npm, understand the difference, and confirm the vg command runs your first scan.
Install the Vibgrate CLI using pnpm, yarn, or bun, both globally and as a project dev dependency, then run your first drift scan.
Try the Vibgrate CLI without installing anything by running it through npx. Learn the exact command, when to use it, and its tradeoffs versus a global install.
Install the Vibgrate CLI without a Node package manager using the curl shell installer, then verify the vg command and run your first scan.
Scan a Go module for upgrade drift with the Vibgrate CLI, understand the DriftScore it reports, and set up a baseline so you can track drift over time.
Scan a Rust crate or workspace for upgrade drift with the Vibgrate CLI, read the DriftScore, and capture a baseline for tracking drift over time.
Scan a Composer-based PHP project for upgrade drift with the Vibgrate CLI, understand the DriftScore, and create a baseline to track drift over time.
Scan a Bundler-based Ruby project for upgrade drift with the Vibgrate CLI, read the DriftScore, and capture a baseline to track drift over time.
A guided first scan with the Vibgrate CLI: run the bare command, read the findings and DriftScore, then try structured output and a quality gate.
After your first scan, learn what the DriftScore means, how to read its 0-100 range, and what actions to take based on the result.
Sign the Vibgrate CLI into your workspace from the browser with vg login, confirm you are authenticated, and sign out with vg logout when needed.
Keep the Vibgrate CLI current using the built-in updater or your package manager, then confirm the new version is active.
Cleanly remove the Vibgrate CLI: sign out, uninstall the binary with your package manager, and remove project artifacts you no longer need.
Confirm the Vibgrate CLI is correctly installed: check the version, run a quick scan, and resolve common command-not-found issues.
Set up continuous drift detection in under 10 minutes. Quick-start templates for GitHub Actions, Azure DevOps, GitLab CI, and generic pipelines.
Install the Vibgrate CLI, run your first scan, and understand your DriftScore in under five minutes. This guide covers installation on every major platform and walks through the essential first-scan workflow.
A step-by-step guide to scanning Node.js and TypeScript projects with the Vibgrate CLI — from a single package.json to complex monorepos with multiple workspaces.
Scan .NET solutions and projects for upgrade drift — runtime version lag, NuGet package drift, target framework analysis, and more.
Scan Python projects for dependency drift using requirements.txt, pyproject.toml, and other Python manifests with the Vibgrate CLI.
Scan Java and JVM projects for dependency drift — Maven, Gradle, and Spring Boot projects are all supported by the Vibgrate CLI.
Use vg install to add Vibgrate AI Context to your AI assistant — skill, MCP wiring, and an advisory nudge. Detect assistants in use, install for all 20+ supported tools, or remove with vg uninstall.
Run a read-only diagnostic pass: config, credentials (redacted), map freshness, hosted reachability, and MCP launch shape. Prints state; changes nothing.
Manage Code Modes (Spark / Flow / Forge) for VG Code and discover local Ollama, LM Studio, and gguf models. install and pull run when you invoke them; pass --dry-run to preview.
Remove Vibgrate AI Context wiring from named AI assistants. Distinct from uninstalling the CLI package itself.
A step-by-step walkthrough of running vg init to set up Vibgrate in a repository, what the .vibgrate directory contains, and how to verify the setup with a first scan.
Learn how vg init --baseline both sets up Vibgrate and captures a starting drift snapshot in a single command, and when this is the right way to onboard a repository.
Walk through vg login to connect the CLI to your Vibgrate workspace from the browser, with no DSN to copy or paste, then verify and push results.
Use vg logout to clear the stored login credential and disconnect the CLI from your Vibgrate workspace, and learn when signing out is the right move.
Keep the CLI current with vg update to check for and install the latest version, why staying updated matters, and how to confirm your installed version.
A step-by-step guide to exporting a CycloneDX Software Bill of Materials from your project using vg sbom export, including the output file and what to do with it.
A step-by-step guide to building a code graph with vg build, including incremental updates, what the build produces, and how to confirm it worked before running queries.
Use vg show to explain any code node — what it is, what it calls, and what calls it. Learn how to read its callers, callees, and structural metadata.
Use vg ask to query the code graph in natural language and get a budget-bounded context block ready to paste into any AI assistant — fully offline after the first use.
Use vg map to get a structural overview of your repository — the high-level shape of your code map in one command. Learn what the overview shows and how to drill in from there.
Use vg lib to access version-correct library docs pinned to your lockfile — the Free Dev Docs Library, served offline to any AI assistant. Learn how it keeps docs aligned with the versions you actually run.
Use vg status to see graph freshness, node and edge counts, staleness, and the resolver rungs used. Learn how it compares the committed graph against your working tree.
Use vg lib to see which libraries Vibgrate can serve version-correct documentation for, resolved against your project's lockfile. A quick reference for the command and what it shows.
Everything you need to know about the vg init command: creating the .vibgrate directory, generating a default config file, and optionally establishing your first baseline.
Generate Markdown, text, or JSON reports from existing scan artifacts. Perfect for sharing drift status with stakeholders who do not use the CLI.
Check for and install Vibgrate CLI updates. Supports npm, pnpm, yarn, and bun package managers.
What a reporting framework is, how it relates to the CLI “regime” flag, and which frameworks ship today — including the EU Cyber Resilience Act and DORA incident reporting.
Understand what a Vibgrate scan tells you. Learn how to read the DriftScore, the findings summary, and the exit code so you can act on results with confidence.
A plain-language introduction to the Software Bill of Materials (SBOM): what it lists, why regulators and customers ask for one, and how Vibgrate CLI produces one from your codebase.
Learn what Vibgrate Graph is, what the code graph (code map) represents, and how it powers offline queries like vg show, vg ask, vg impact, vg path, and vg tree.
Vibgrate AI Context is the local, offline MCP server that serves your code map, drift, and version-correct library docs to any AI assistant. Learn what it does, why it exists, and how it differs from the Vibgrate Cloud MCP.
The Free Dev Docs Library gives your AI assistant version-correct documentation pinned to your lockfile, served offline through Vibgrate AI Context. Learn what it covers and how it keeps AI answers accurate.
AI assistants hallucinate APIs because their training data is frozen and version-blind. Learn why version-correct documentation from the Free Dev Docs Library makes AI-assisted coding dramatically more accurate.
See how the Tooling Inventory Scanner detects packages across categories to build a complete map of your stack — frameworks, build tools, test runners, and more — and why an accurate inventory is the foundation of upgrade planning.
Understand how the File Hotspots Scanner uses filesystem metadata alone to surface likely complexity hotspots, why a zero-parse signal is fast and privacy-friendly, and how to use the findings to focus effort.
See how Vibgrate's individual scanners contribute to one 0-100 DriftScore, why a single number aids prioritization without hiding detail, and how to drill from the score into the findings behind it.
Learn what upgrade drift is, why it accumulates silently, and how Vibgrate CLI measures it so you can keep dependencies, runtimes, and tooling current without surprises.
Understand what a DriftScore of 0-100 means, how the risk bands map to action, and how to read a score in context rather than chasing a perfect zero.
Understand Vibgrate CLI's output formats — human-readable text, JSON, SARIF, and Markdown — and when to choose each for terminals, pipelines, code scanning, and reports.
Learn which languages and ecosystems Vibgrate scans and how it reads manifests and lockfiles to detect dependencies, runtimes, and drift across a polyglot codebase.
How Vibgrate sizes each scanned project into nano, micro, small or standard tiers, bills it as a fraction of a project, and rounds the total down to your billable projects.
An end-to-end walkthrough: connect a repository to a locale project, push your source keys, translate in Vibgrate Cloud, and pull accepted translations back into your codebase — then wire the safe verb into CI so new keys reach translators automatically.
What legal entity, main establishment, EU authorised representative, coordinator CSIRT, responsible person, filing authority, and out-of-hours contact mean — written for first-time users.
How to register a product with digital elements: markets as country codes, CRA classification options, and recording an in-scope or out-of-scope determination with a rationale.
Why frozen release manifests matter, how to freeze from a scan or SBOM, what ship date and artefact digest mean, and how support periods affect end-of-life handling.
How exposure matching works, what CVE means, offline advisory files, product filters, end-of-life inclusion, and how to build a submission pack or signed bundle.
What the CISA Known Exploited Vulnerabilities catalog is, how Vibgrate Evidence watch uses it against frozen components, and what the results do and do not mean for filings.
Practice the exposure determination against a simulated advisory built from a component you already ship, and optionally record how long your team took.
How offline verification works, what verified / unverified / failed mean, and when to supply a PEM public key as a trust root.
Connect the CLI to Vibgrate Cloud: log in, run a scan, and push results so your team can see DriftScore trends over time in one workspace.
Learn the fastest way to scan a project for upgrade drift. Running bare vg scans the current directory and prints a DriftScore with no configuration required.
Point a Vibgrate scan at a specific folder without changing shells. Use the --cwd flag to scan a subdirectory or sibling project from anywhere.
Generate machine-readable JSON from a Vibgrate scan for scripting, dashboards, and custom tooling. Learn the --format json flag and how to combine it with --out.
Choose human-readable scan output: the default table for terminals and Markdown for pull request comments and docs. Learn the --format options for readable reports.
Keep generated code, vendored folders, and fixtures out of your drift results with the --exclude flag. Learn how to focus a Vibgrate scan on the code that matters.
Save scan output as a build artifact with the --out flag. Learn how to write JSON, SARIF, or Markdown results to a named file for archiving and CI uploads.
Focus a Vibgrate scan on one package or service. Learn how to use --cwd to target a package directory and get a DriftScore scoped to the code one team owns.
Turn a Vibgrate CLI scan into a human-readable report you can read, review, or attach to a pull request. Learn how to produce Markdown, text, or JSON reports with vg report.
Produce a report that teammates, reviewers, and stakeholders can actually open. Learn which format to pick for each audience and how to attach reports to pull requests and chat.
Send your scan results to Vibgrate Cloud so your whole team sees DriftScore, findings, and trends on one dashboard. Learn the two ways to upload and how authentication works.
See how your DriftScore moves over time once you push scans to Vibgrate Cloud. Learn what builds a trend line and how to keep history continuous.
Turn drift data into a one-glance summary leaders can act on. Learn how to combine vg report output with the Vibgrate Cloud dashboard for executive reporting.
Understand how access to Vibgrate Cloud works and how the CLI authenticates against your workspace. Learn the difference between interactive login and DSN-based uploads.
Learn how to keep the Vibgrate code graph fresh as your code changes using incremental vg build runs, so vg show, vg ask, and vg impact always reflect current code.
Help new team members learn a codebase quickly using vg ask, vg show, and vg tree to explore structure, follow entry points, and ask natural-language questions offline.
Resolve documentation for the exact version of a library your project depends on, using vg lib and the Free Dev Docs Library served through Vibgrate AI Context. A practical walkthrough.
A transparent guide to Vibgrate's privacy-first architecture — what data is collected, what is never collected, and how to use privacy modes.
A guide to all four output formats supported by the Vibgrate CLI — when to use each, what they contain, and how to integrate them into your workflows.
Complete inventory of every vg subcommand — drift, code graph, AI context, models, IDE, and diagnostics — with links to detailed help and docs.
Open a Vibgrate-generated CycloneDX or SPDX file and understand its structure — components, versions, licenses, and identifiers — so you can review and use it with confidence.
Vibgrate CLI exports CycloneDX and SPDX SBOMs and can generate OpenVEX documents. Learn what each format is for and how to choose the right one for your use case.
Understand how scanner results are presented — text, JSON, SARIF, and Markdown — why each format suits a different audience, and how to choose the right one for humans, machines, and CI.
A reference for the language ecosystems Vibgrate scans for upgrade drift, including Node.js, .NET, Python, Java, Go, Rust, PHP, and Ruby. Learn how manifests and lockfiles drive results.
Plain-language definitions for the terms you will meet using the Vibgrate CLI, including DriftScore, baseline, code map, Vibgrate AI Context, and SBOM. A quick reference for new and returning users.
A compact, copy-friendly list of every Vibgrate CLI command grouped by purpose: scanning, baselines and reports, uploads, and the Vibgrate Graph code-map commands. Real commands only.
Fix common problems installing or running the Vibgrate CLI, including the vg binary not being found, version mismatches, and trying the CLI without installing. Practical, command-first guidance.
Fix the case where a Vibgrate scan finds no projects. Learn how detection works, how exclusions and working directory affect it, and how to confirm the CLI is scanning the right tree.
Quick answers to the most common questions about the Vibgrate CLI: how to scan, whether you need an account, how to try it without installing, what DriftScore means, and how to work offline.
A quick reference for all CLI exit codes — use these to control pipeline flow and interpret scan results programmatically.
See what hosted AI models cost, which ones this workspace can call, and what caps the bill.
Manage your plan, see scan and usage credits, and handle your subscription.
Software supply-chain intelligence — SBOM coverage, components, provenance, and attestations.
Connect GitHub, GitLab, Bitbucket, or Azure DevOps, bind repositories, and manage drift badges.
Create and manage MCP and CLI access tokens, scoped per workspace with read or write grants.
Your application inventory — ownership, environments, drift, and how each app was discovered.
Your governance inbox — review what needs sign-off, see the impact, and approve or reject.
A living map of services, components, dependencies, and architectural health across your estate.
An immutable log of who changed what, when, and why — with retention and export controls.
Package health, vulnerabilities, licenses, and upgrade opportunities across your estate.
Set how much drift each part of the estate may carry, and track consumption and breaches over time.
The headline view of modernization across your whole estate — drift, risk, and open vulnerabilities at a glance.
Connect a repository, run your first scan, and learn how to read the results.
Send Vibgrate events to your own tools with webhooks, and monitor delivery health.
Plan and track upgrades across your portfolio — prioritize, run migrations, and forecast outcomes.
Define rules, enforce standards, track violations and exceptions, and produce audit-ready evidence.
Turn findings into completed fixes — convert risk into projects and tasks with measurable outcomes.
Source-code inventory with drift scores, scan coverage, and which repositories map to which applications.
The single source of truth for risk posture, vulnerabilities, controls, and compliance evidence.
The operational heartbeat — scan runs, outcomes, and drift trends in near real-time.
Manage who has access to your workspace, and what they can do.
Automate repeatable governance and remediation work with templates, pipelines, and execution tracking.