Intermediate-level help articles for the Vibgrate CLI.
Complete reference for vg locale: configure a locale project, push source keys to Vibgrate Cloud, pull accepted translations back into your repo, and format locale files. Covers the free local-only commands, the Team-plan cloud commands, supported file formats, and every shared flag.
Start the Vibgrate language server over stdio. Editors spawn this; it powers Vibgrate for VS Code and other thin clients from one engine.
Start and manage the local workspace daemon for multi-root graph sessions used by IDE extensions and agents: ensure, register, publish, query, and impact.
Register products with digital elements, freeze shipped-release manifests, and answer which shipped products contain a vulnerability as signed, offline-verifiable evidence. Jurisdiction-neutral: the EU Cyber Resilience Act is the first regime.
Propose a minimal code edit for a plain-language instruction, grounded in Vibgrate's deterministic code map and routed to a local or hosted model you choose. Dry-run by default; never writes without your consent.
Get three ranked upgrade plans — Low-risk, Balanced, and Full — scored on real-world exploitability (CISA KEV and FIRST EPSS), so the dangerous upgrade rises to the top. Read-only until you choose to apply.
Detect known vulnerabilities in your installed dependencies against the OSV database, online or air-gapped, with severity, CVSS, the fixing version, and git attribution.
Trace any dependency through git history: who added it, every version since, and any open vulnerabilities it carries — across npm, Python, Go, Rust, Ruby, PHP, Dart, Elixir, and .NET projects.
Pinpoint the commit where a dependency reached a version or semver range — when a fix was adopted, or never was — and gate CI on it, across npm, Python, Go, Rust, Ruby, PHP, Dart, Elixir, and .NET projects.
Capture a known-good snapshot of your project's drift state with vg baseline so future scans can report change as a delta and power fitness functions.
Use vg impact to see what breaks if you change a node — a deterministic structural blast radius from reverse reachability with decay confidence — so you can plan changes safely.
Use the --tests flag on vg impact to surface exactly the tests to run before shipping a change, turning a structural blast radius into a focused, runnable test list.
Use vg path to show how node A connects to node B — the shortest path through the call graph — so you can trace exactly how two parts of your code relate.
Use vg tree to walk the call tree rooted at a node — callees by default — with depth-bounded, cycle-safe traversal so you can understand how code fans out.
Use vg hubs to surface the most-depended-on nodes in your codebase — the functions, classes, and modules that everything else relies on. Learn why hubs matter for risk, refactoring, and onboarding.
Use vg oddities to surface surprising cross-area links — the connections that violate your intended architecture. Learn how Vibgrate Graph flags these smells and how to triage them.
Use vg areas to reveal the natural groupings in your codebase — clusters of nodes that work closely together. Learn how communities help you understand modularity and plan refactors.
Use vg export with --format and --out to write your code map to JSON, GraphML, Graphviz DOT, Neo4j Cypher, Markdown, HTML, or SBOM. Learn how to move the graph into other tools.
Use vg embed to precompute the semantic index so your next vg ask is instant. Learn how the local ONNX model works, why it is fully offline, and when to run it.
Use vg share to make the code map committable and auto-updating. It installs a pre-commit hook, a deterministic merge driver, and .gitignore entries so the graph stays fresh in version control.
Use vg facts to produce deterministic facts for a node — contract, invariant, and characterization — typed by how they were derived, from declared/static to observed. Learn how facts ground AI assistants.
Use vg tests to see which tests cover a node, --missing to find untested nodes nearby, and --run or --exec to get and run the minimal test command. Learn to target exactly the tests that matter.
Run vg serve to launch Vibgrate AI Context, the local, offline MCP server that feeds your code map, drift, and version-correct library docs to any AI assistant. A practical command guide.
The primary CLI command. Scan your project for upgrade drift, generate reports in multiple formats, enforce quality gates, and optionally push results to the dashboard.
Establish a drift baseline snapshot for delta comparison. Baselines are the foundation of drift fitness functions and CI regression gates.
Export CycloneDX or SPDX SBOMs from scan artifacts, compare dependency deltas between two scans, and generate OpenVEX exploitability statements for supply-chain governance.
Upload scan results to the Vibgrate Cloud API for team visibility, portfolio tracking, and historical trend analysis.
Generate HMAC-signed DSN tokens for authenticating scan uploads to Vibgrate Cloud. Supports US and EU data residency regions.
How Vibgrate measures vulnerability exposure over time — who introduced each issue, how long you have been exposed, and whether remediation keeps pace with per-severity SLAs.
Learn what a drift budget is, how the --drift-budget flag turns DriftScore into a pass/fail gate, and how it complements baselines and worsening checks.
Vibgrate's Dependency Risk scanner classifies risky packages — deprecated, native, or platform-specific. Learn what these findings mean and how they complement your SBOM.
How Vibgrate surfaces vulnerable dependencies through its security scanning and SBOM output, and how to feed CycloneDX SBOMs into vulnerability tooling and OpenVEX exploitability statements.
Your SBOM captures the licenses of every dependency. Learn how license information appears in Vibgrate's CycloneDX and SPDX output and how to use it for license compliance.
Learn how to read vg impact results — the reverse-reachability blast radius and decay confidence — so you can tell a contained change from a risky one and act accordingly.
Understand how incremental vg build keeps the code graph fast, why graph queries are offline and quick after the first build, and how to keep large-repo workflows snappy.
Vibgrate AI Context runs locally, needs no account, and uploads nothing. Learn exactly what stays on your machine and why the local context server is safe for sensitive codebases.
Learn what the Dependency Risk Scanner detects — deprecated packages, native modules, and platform-specific dependencies — why each class raises upgrade risk, and how to act on the findings before they block a release.
Understand how the Dependency Graph Scanner analyzes lockfiles to find duplicate packages, phantom dependencies, and workspace graph problems — and why these hidden issues make upgrades fragile.
Learn how the Build & Deploy Scanner detects your CI/CD systems, containerization, and infrastructure-as-code — and why understanding your delivery pipeline is essential to predicting where upgrades break in production.
Understand how the TypeScript Modernity Scanner reads tsconfig.json to assess strictness, module system, and ESM readiness — and why these settings determine how painful your next TypeScript or framework upgrade will be.
Learn how the Breaking Change Exposure Scanner flags packages and patterns known to cause upgrade pain, why early exposure data lowers migration risk, and how to plan around the findings.
Learn how the Security Posture Scanner checks structural security hygiene — lockfile presence, .gitignore coverage, and audit counts — why these basics predict supply-chain risk, and how to close the gaps.
Understand how the Security Scanners Scanner detects and assesses readiness of local security tools, why orchestration beats ad-hoc scanning, and how to use the findings to harden your pipeline.
Learn how the Service Dependencies Scanner detects SDK packages to map your external service and platform dependencies, why this map matters for resilience and upgrades, and how to act on it.
Understand how the Architecture Layers Scanner classifies source files into layers and detects project archetypes, why an explicit layer map reveals structural drift, and how to use it.
Learn how the Code Quality Scanner runs fast AST-based checks for cyclomatic complexity and upgrade-friction hotspots, why content-aware analysis catches what metadata misses, and how to act on findings.
Understand how Vibgrate maps security findings into OWASP Top 10 categories, why a shared taxonomy speeds triage and reporting, and how to use the mapping to prioritize fixes.
Learn how the Platform Matrix Scanner collects platform and architecture signals that predict build breakage, why cross-platform risk is easy to miss, and how to use the matrix to harden your pipeline.
Learn a practical method for reading scanner findings, prioritizing them by impact, and turning a scan into an action plan — so the DriftScore becomes work that ships rather than a number you ignore.
A practical look at the factors that increase or decrease your DriftScore, so you can prioritize the upgrades that move the number most and keep drift in check.
Understand the difference between a drift baseline and a drift budget, when to use each, and how they work together to stop regressions and cap absolute drift.
Understand how Vibgrate CLI uses exit codes to signal pass, fail, and error so your scripts and CI pipelines can branch reliably on scan results.
Understand how Vibgrate recognizes monorepos and workspaces, reads their package graphs, and scans multiple packages so drift is measured across the whole repository.
Learn the difference between direct and transitive dependencies, why both contribute to drift and risk, and how Vibgrate uses lockfiles to see the full tree.
Understand what an end-of-life runtime is, why it's one of the biggest drivers of drift and risk, and how Vibgrate surfaces unsupported language and platform versions.
Learn how deprecations and breaking changes accumulate as drift, the difference between the two, and how Vibgrate flags exposure before an upgrade bites you.
Understand why upgrade drift is also a security problem, how outdated dependencies and EOL runtimes expand your exposure, and how Vibgrate surfaces structural security signals.
Learn why a single DriftScore is less useful than a trend, and how baselines and Vibgrate Cloud let you track whether drift is improving or quietly creeping up.
Understand the difference between scanning for drift locally and in CI, when to use each, and how to combine them for fast feedback and reliable enforcement.
Learn what a code graph is, how Vibgrate Graph maps your source into nodes and edges, and why a structural model of your code powers offline queries and impact analysis.
Understand what version-correct AI context means, why pinning docs and code structure to your lockfile prevents AI hallucinations, and how Vibgrate AI Context serves it offline.
A deep dive into how the Vibgrate DriftScore is calculated — the four weighted components, risk levels, and how to interpret your score.
Turn drift scoring into a formal quality gate. Learn how baselines, drift budgets, and worsening thresholds create fitness functions that prevent drift regression in CI.
Download an SBOM from Vibgrate Cloud wrapped in a signed attestation, so a consumer can prove it came from Vibgrate and has not been altered — and see its verified status in the dashboard.
Run the Vibgrate CLI inside a container with Docker, mount your project for scanning, and capture machine-readable output for pipelines.
Emit SARIF from a Vibgrate scan so drift findings appear in GitHub code scanning and other SARIF-aware tools. Learn the --format sarif flag and how to save it.
Enforce a maximum acceptable DriftScore with --drift-budget. Learn how to set a budget so scans fail when drift exceeds the threshold you choose.
Speed up pull request checks by scanning just what changed. Learn the --changed-only flag and when a focused scan is the right choice for fast feedback.
Run Vibgrate across a monorepo. Learn how to scan the whole tree, target individual packages with --cwd, and exclude folders to keep results meaningful.
Compare a scan against a saved baseline to see what drift is new. Learn how to capture a baseline and pass it with --baseline for delta-based gates.
Make scans fast and predictable. Learn how caching speeds repeated scans, when to use --no-cache for a clean run, and how --changed-only keeps feedback quick.
Resolve common scan problems. Learn how to rule out stale caches with --no-cache, narrow scope with --cwd and --exclude, and read exit codes when a scan fails CI.
Understand the configuration that vg init writes, how to tune scanner toggles and exclusions, and why committing the config keeps your team and CI consistent.
Keep scans fast and focused by excluding generated, vendored, and irrelevant directories using configuration exclusions and the --exclude flag.
Use vg scan --baseline to compare the current state against a stored snapshot, report drift as a delta, and fail builds only when drift worsens.
Keep baselines meaningful over time: when to refresh after intentional upgrades, how to re-run vg baseline, and how to avoid masking real drift.
Make scans deterministic across machines and CI by pinning a specific Vibgrate CLI version, and learn how this interacts with vg update.
Give each repository its own committed Vibgrate configuration so thresholds, scanner toggles, and exclusions match that project, and stay consistent across the team.
Understand how CLI workspace settings connect local scans to a Vibgrate Cloud workspace via vg login or a DSN, and how that enables team trend analysis.
Diagnose and fix common authentication problems: failed uploads, expired or missing DSNs in CI, stale local credentials, and pushing to the wrong workspace.
Get a repository showing up in Vibgrate Cloud by naming it consistently on upload. Learn how --repository-name groups scans under the right repo so trends stay coherent.
Generate an HMAC-signed DSN token so non-interactive environments can upload to Vibgrate Cloud. Learn how vg dsn create works and how to use --dsn safely in CI.
Roll many repositories up into a single portfolio view so leaders can compare DriftScore across the estate. Learn how consistent naming and pushing build the rollup.
Keep DriftScore data fresh by scanning and pushing on a schedule. Learn how to wire vg scan --push into scheduled CI jobs for continuous reporting.
Feed your own BI and analytics tools with machine-readable drift data. Learn how to export JSON from vg report and where to write it with --out.
Wire Vibgrate uploads into your CI so every build reports its DriftScore to Vibgrate Cloud. Learn the canonical scan-and-push pattern with DSN authentication.
Group related repositories under an application so drift rolls up to something the business recognizes. Learn how consistent repository naming feeds application views.
Read DriftScore as a moving signal rather than a snapshot. Learn what makes the number move, how baselines complement trends, and how to keep history reliable.
Give each team a focused view of the repositories they own. Learn how consistent naming and grouping turn pushed scans into per-team dashboards.
Fix the most common reasons a push to Vibgrate Cloud fails — missing login, stale or wrong DSN, and inconsistent repository names. Step through the checks in order.
Automate SBOM generation on every build by adding vg sbom export to your CI pipeline, so a fresh, reproducible Software Bill of Materials is produced for each commit or release.
Learn how to generate a Software Bill of Materials and attach it to a tagged release so customers, auditors, and downstream tools can retrieve the exact component inventory for each version.
Use Vibgrate SBOMs as durable audit evidence. Learn how to produce, name, and retain Software Bills of Materials so they satisfy compliance reviews and customer security questionnaires.
Run drift scoring and SBOM export together so a single build produces both a DriftScore for upgrade risk and a Software Bill of Materials for supply-chain visibility.
Send your scan results to Vibgrate Cloud for team visibility and trend tracking, and keep SBOM files as release artifacts — learn how the local SBOM and the hosted dashboard work together.
Fix the most common problems with vg sbom export — empty component lists, missing licenses, wrong output location, and format confusion — so you get a complete, correct SBOM.
Make code reviews faster and safer by using vg impact, vg show, and vg tree to understand blast radius, verify dependencies, and surface the tests a change should pass.
Plan and execute refactors with confidence using vg impact to map blast radius, vg tree to understand structure, and vg impact --tests to know what to run before shipping.
Build and query a code graph across a monorepo with vg build, then use vg path and vg impact to understand cross-package dependencies and the reach of shared code.
Fix common Vibgrate Graph issues — stale results, missing nodes, empty paths, and overwhelming trees — by rebuilding correctly and choosing the right query for the question.
A guide to every format vg export supports — JSON, GraphML, Graphviz DOT, Neo4j Cypher, Markdown, HTML, CycloneDX, and SPDX — with guidance on which to pick for visualization, databases, docs, and SBOMs.
A practical guide to making the Vibgrate Graph code map a shared team asset with vg share — committing it to version control, keeping it fresh automatically, and avoiding merge conflicts.
A guide to feeding deterministic, epistemic-typed facts to AI assistants so their suggestions are grounded in your real code — contracts, invariants, and characterizations served via Vibgrate AI Context.
A guide to using vg tests --missing to find untested nodes near your changes, then --run or --exec to run exactly the right tests — closing coverage gaps without running the whole suite.
A troubleshooting guide for common issues with vg export and vg share — stale output, missing code map, format and path mistakes, and committed maps that look out of date after a pull.
Wire Vibgrate AI Context into Claude and Claude Code so the assistant can read your code map, drift, and version-correct library docs over MCP. Step-by-step using vg install and vg serve.
Set up Vibgrate AI Context in Cursor so its AI reads your code map, drift, and version-correct library docs over MCP. A step-by-step guide using vg install and vg serve.
Wire Vibgrate AI Context into VS Code so Copilot and MCP-aware extensions read your code map, drift, and version-correct library docs. Step-by-step using vg install and vg serve.
Set up Vibgrate AI Context as an MCP server in the Continue extension so its AI reads your code map, drift, and version-correct library docs. A step-by-step guide.
Add Vibgrate AI Context as an MCP server in the Zed editor so its assistant reads your code map, drift, and version-correct library docs. A step-by-step guide.
Vibgrate AI Context is a standard MCP server, so any MCP-compatible client can use it. Learn how to connect tools beyond the ones with built-in wiring, using vg serve.
Vibgrate AI Context serves more than docs — it feeds your code map and DriftScore to your AI assistant over MCP. Learn how to expose structural and drift context alongside version-correct docs.
Version-correct docs are only correct if they track your dependencies. Learn how the Free Dev Docs Library stays aligned with your lockfile and how to refresh it as you upgrade.
Bring version-correct docs and code-map context into AI-assisted code review with Vibgrate AI Context. Learn how grounded context catches version-mismatched suggestions before they merge.
Run full drift analysis without any network connectivity using downloaded package manifests. Perfect for secure, restricted, or air-gapped environments.
Complete reference for the Vibgrate configuration file — thresholds, scanner toggles, exclude patterns, and all supported config formats.
Turn a Vibgrate scan into a quality gate with --fail-on. Learn how to fail the build when findings reach a chosen severity so risky drift blocks merges.
Keep CI logs clean with the --quiet flag. Learn how quiet mode suppresses extra console output so pipelines show only what matters and exit codes drive decisions.
Push scan results from automated pipelines without an interactive browser by using a DSN token, so vg push works headlessly in CI.
A guide to running vg status in continuous integration to keep the committed code map fresh — detecting staleness, gating on freshness, and rebuilding when the graph drifts from the working tree.
Add Vibgrate drift scanning to a Jenkins declarative pipeline. Learn how to install the CLI on an agent, run a scan, fail the build on regressions, and archive the report artifact.
Wire the Vibgrate CLI into a CircleCI job. Learn how to run a scan in a Node executor, set a quality gate, and persist the report as a build artifact.
Configure bitbucket-pipelines.yml to run Vibgrate drift scans on every push and pull request. Learn how to set a quality gate and keep the report as an artifact.
Set up .travis.yml to run Vibgrate drift scans in a Node environment. Learn how to fail builds on regressions and produce a report artifact.
Add a Vibgrate drift scan step to a Drone pipeline using a Node container. Learn how to apply a quality gate and surface the DriftScore on every build.
Add a Vibgrate drift scan step to a Buildkite pipeline running on self-hosted agents. Learn how to gate builds and upload the report as a Buildkite artifact.
Add a command-line build step that runs Vibgrate drift scanning in TeamCity. Learn how to fail builds on regressions and keep the report as a build artifact.
Add a Run step to a Harness CI pipeline that executes Vibgrate drift scanning. Learn how to gate the build and push results to Vibgrate Cloud.
Add a Vibgrate drift scan step to a Woodpecker CI pipeline using a Node container. Learn how to gate builds and generate a report.
Use --drift-budget to fail a pull request build when the DriftScore exceeds an allowed ceiling. Learn how to choose a budget and tighten it over time.
Produce a SARIF file with --format sarif and upload it to your platform's code scanning dashboard. Learn the scan command and how findings appear inline.
Turn a Vibgrate drift scan into a required status check so pull requests cannot merge while drift exceeds your gate. Learn the scan setup and the branch-protection side.
Run a full Vibgrate drift scan on a nightly schedule to track trend without slowing pull requests. Learn the scan command and how to push results for trend analysis.
Generate a Markdown drift report in CI and post it as a pull request comment so reviewers see the DriftScore inline. Learn the scan command and the posting pattern.
Use --changed-only to scan just the files touched in a pull request, keeping PR pipelines fast while reserving full scans for scheduled runs.
Persist the Vibgrate cache between CI runs to speed up repeat scans. Learn what to cache, how to key it, and when to bypass the cache.
Use --push to upload CI scan results to Vibgrate Cloud for team visibility and trend analysis. Learn how to configure a DSN secret and run the push safely.
Use --fail-on to fail a build when findings reach a chosen severity. Learn how the flag maps to exit codes and how it complements a drift budget.
Set up Vibgrate in GitHub Actions for continuous drift detection, SARIF integration with Code Scanning, and automated dashboard uploads.
Set up Vibgrate in Azure DevOps Pipelines for continuous drift detection, SARIF artifact publishing, and drift budget enforcement.
Set up Vibgrate in GitLab CI/CD for continuous drift detection, SAST report integration, and drift budget enforcement.
Use Vibgrate in any CI system — Jenkins, CircleCI, Bitbucket Pipelines, or custom build scripts. The CLI requires no login, produces standard outputs, and works entirely offline.
Understand how environment-level configuration interacts with the Vibgrate CLI, including offline mode, proxy settings, and credentials, and how environment context flows into scans and uploads.
Learn where environment variables fit in a Vibgrate workflow, especially for supplying secrets like a DSN to vg push in CI without committing them.
Learn how to choose the two endpoints for vg path using --pick-a and --pick-b so you trace the connection between exactly the nodes you mean.
Flip vg tree to show callers instead of callees with --callers, and control how deep it traverses with --depth, to focus the call tree on exactly what you need.
Common issues when running Vibgrate AI Context (vg serve) and how to fix them — from clients not seeing tools to stale context, slow first runs, and offline library gaps.
Learn how to control which scanners run and narrow a scan to what you care about, why focusing improves signal and speed, and how to keep configuration consistent across your team and CI.
A reference for the flags that apply across Vibgrate CLI commands, including path selection, output control, and quiet mode. Learn what each common flag does and when to reach for it.
A detailed reference for the Vibgrate configuration file created by vg init. Learn where config lives, what it controls, and how scanner toggles, thresholds, and exclusions shape every scan.
Learn how to produce and consume JSON output from the Vibgrate CLI for scripting and dashboards. Understand how JSON relates to the other output formats and how to write it to a file.
Learn how to emit SARIF from Vibgrate scans and feed it into code-scanning surfaces such as GitHub code scanning. Understand when SARIF is the right format and how to write it to a file.
Configure the Vibgrate CLI for proxied networks and air-gapped environments. Learn how offline mode works, how to bypass caches, and how local code-map queries stay fully offline after first use.
Resolve authentication problems with the Vibgrate CLI, from the browser login flow to DSN tokens for CI. Learn how to re-authenticate, clear stale credentials, and authenticate non-interactively.
Speed up slow Vibgrate scans with concurrency tuning, exclusions, scoping, and cache control. Learn which knobs to turn first on large or monorepo codebases.
Understand why a Vibgrate step fails in CI and how to fix it, separating intentional drift-gate failures from real errors. Learn to read exit codes, gates, and authentication problems.
Fix problems building or querying the Vibgrate code map. Learn how to check freshness, rebuild incrementally, precompute the semantic index, and confirm queries work offline.
A guide to the categories of problems the Vibgrate CLI reports and how to act on each, from command not found and detection issues to gate failures and upload errors. Includes how to read exit codes.