Your first Vibgrate scan: a step-by-step walkthrough

This walkthrough takes you through your very first scan with the Vibgrate CLI, what the output means, and where to go next. It is written for developers who have just installed vg.

Prerequisites

• The Vibgrate CLI installed, or run the no-install form npx @vibgrate/cli scan
• A project directory to scan (any supported ecosystem)

Step 1 — Run a scan

From the root of your project, run the bare command. scan is the default subcommand, so a bare vg scans the current directory:

vg

Vibgrate detects your ecosystem, reads the relevant manifests and lockfiles, and prints findings followed by a DriftScore from 0 to 100.

Step 2 — Read the results

The DriftScore summarizes how far your dependencies have drifted from current, healthy versions. The findings list explains what contributed to the score. A higher score means more upgrade work ahead. For the full breakdown, see understanding your first DriftScore.

Step 3 — Try a structured format

When you want output you can store or feed into tools, choose a format:

vg scan --format sarif

SARIF, JSON, and Markdown are all available; see the output formats guide for details.

Step 4 — Add a quality gate

To make the command fail when serious issues appear, use a gate:

vg scan --fail-on error

The command exits non-zero when errors are found, which is exactly what CI needs.

Step 5 — Capture a baseline

To track drift over time, snapshot the current state:

vg baseline

Future scans can compare against it with vg scan --baseline .vibgrate/baseline.json.

Troubleshooting

• Nothing detected — run from the directory that holds your manifest and lockfile.
• Want to commit settings — run vg init to create the .vibgrate directory and config file.

Related

Next: understanding your first DriftScore, drift baselines, and setting up a Vibgrate workspace to share results with your team.