Skip to main content
AI Agent Skills·Apache-2.0 · open source

Teach your AI assistant to
read the code graph, not the whole repo

Vibgrate Skills are ready-made agent instructions plus local MCP wiring thatvg installwrites into your AI coding assistant. One command teaches the agent to prefer the local code graph — cheaper tokens, more relevant context — over grepping and reading dozens of files.

What is a Vibgrate Skill?

A skill is the combination of two things vg install writes into a coding assistant: a SKILL.md with ready-made agent instructions, and the local MCP wiring that registers Vibgrate's read-only graph server.

Together they teach the agent to ask the local code graph for relevant context first — which is cheaper and more focused than grepping and reading many files to reconstruct the same picture.

What each install writes

  • A SKILL.md with the agent instructions, in the assistant's expected location.
  • Registration of the local MCP server (vg serve) so the agent can query the graph.
  • An advisory, opt-out nudge that points the agent at the graph before it reaches for grep.
  • A clean reverse with vg uninstall.

One command installs everything

Install into a single assistant, or every assistant Vibgrate detects, in one go.

Install everywhere
bash
vg install --all

Writes the skill into every supported assistant detected in your environment.

Install one, or remove
bash
vg install claude

vg uninstall claude

vg is the default command (alias vibgrate).

What the skill instructs the agent to do

The instructions steer the agent toward graph-first reasoning.

Prefer the local code graph

The skill tells the agent to query the local code graph for relevant context first, rather than grepping and reading many files — cheaper tokens, more relevant context.

Reason about impact and structure

It teaches the agent to check impact before editing, trace paths between symbols, and use hubs and areas to orient in an unfamiliar codebase.

Stay version-correct

For library questions, the agent is pointed at version-correct docs for the dependencies the project actually uses, and at drift reports for upgrade context.

CLI commands the skill teaches

  • vg "<question>"Ask a question and get a budget-bounded context block drawn from the code graph — instead of grepping and reading dozens of files.
  • vg show <name>Show a single node — its definition, signature, and immediate neighbours.
  • vg impact <name>List what a change to this symbol could affect, following the dependency edges.
  • vg path <A> <B>Find how two symbols are connected through the graph.
  • vg treePrint the structural tree of the codebase.
  • vg hubsSurface the most-connected symbols — the high-leverage parts of the code.
  • vg areasGroup the codebase into cohesive functional areas.
  • vg driftReport upgrade drift; pair with vg scan and vg report for CI-friendly output.
  • vg lib <name>Pull version-correct documentation for a library the project actually uses.

Read-only MCP tools

Over MCP, the same graph is exposed to the agent as a set of read-only tools served by vg serve.

query_graph

Answer a natural-language question with a bounded context block.

get_node

Fetch a single symbol with its definition and neighbours.

impact_of

Return the blast radius of changing a symbol.

find_path

Trace the connection between two symbols.

list_hubs

List the most-connected, high-leverage symbols.

list_areas

List the cohesive functional areas of the codebase.

get_graph_summary

Return a compact overview of the whole graph.

Looking for the hosted, cloud MCP server with drift and portfolio data? See the Vibgrate MCP Server.

Supported assistants

21 install targets — each one written from the same vg install command.

Claude Codeclaude
Cursorcursor
Windsurfwindsurf
VS Code / Copilot Chatvscode
Codexcodex
Gemini CLIgemini
OpenCodeopencode
Kilo Codekilo
Aideraider
Factory Droidfactory
Traetrae
Kirokiro
Ampamp
Kimi Codekimi
CodeBuddycodebuddy
GitHub Copilot CLIcopilot-cli
Pipi
Devin CLIdevin
Hermeshermes
OpenClawopenclaw
Generic Agent Skillsagents

Per-assistant quickstart

Pass the assistant's id to vg install.

Claude Code
bash
vg install claude
Cursor
bash
vg install cursor
Windsurf
bash
vg install windsurf
VS Code / Copilot Chat
bash
vg install vscode

Ready to wire it up?

Install the CLI, then run vg install --all to give every assistant graph-first context.

# Run without installing anything
npx @vibgrate/cli scan

# Pin a version or see every command
npx @vibgrate/cli@latest --help

no install·Nothing is installed globally — ideal for CI or a one-off scan.

08:53Z[DRIFT]Next.jsNext.js is 2 major versions behind (current: 14.2.35, latest: 16.1.6).
08:54Z[OWASP]A03:2021 – InjectionUnescaped user input rendered into HTML template (src/routes/admin.ts:42)
08:52Z[SCANNER]semgrepscan signature set is up to date
08:48Z[DRIFT]of dependencies are 2+ major versions behind in acme.39% of dependencies are 2+ major versions behind in acme.
08:50Z[OWASP]A02:2021 – Cryptographic FailuresJWT secret is hardcoded — use environment variables (src/auth/jwt.ts:18)
08:45Z[SCANNER]gitleaksscan signature set is up to date
08:43Z[DRIFT]@types/node@types/node is 3 major versions behind (spec: 22.15.29, latest: 25.2.3).
08:46Z[OWASP]A03:2021 – InjectionRegular expression built from user input — potential ReDoS (src/utils/search.ts:67)
08:38Z[SCANNER]trufflehogstatus: unavailable
08:38Z[DRIFT]electronelectron is 3 major versions behind (spec: ^37.6.0, latest: 40.4.1).
08:42Z[OWASP]A03:2021 – InjectiondangerouslySetInnerHTML used with potentially untrusted content (src/components/RichText.tsx:31)
08:33Z[DRIFT]@types/node@types/node is 5 major versions behind (spec: ^20.17.52, latest: 25.2.3).
08:38Z[OWASP]A05:2021 – Security MisconfigurationCookie set without httpOnly or secure flags (src/middleware/session.ts:12)
08:28Z[DRIFT]@types/supertest@types/supertest is 4 major versions behind (spec: ^2.0.16, latest: 6.0.3).
08:34Z[OWASP]A03:2021 – Injectioneval() called with dynamic expression (src/utils/template-engine.ts:88)
08:23Z[DRIFT]VitestVitest is 4 major versions behind (current: 0.34.6, latest: 4.0.18).
08:30Z[OWASP]A01:2021 – Broken Access ControlRedirect URL comes from user-controlled parameter (src/pages/auth/callback.tsx:15)
08:18Z[DRIFT]@types/node@types/node is 5 major versions behind (spec: ^20.8.0, latest: 25.2.3).
08:26Z[OWASP]A03:2021 – InjectionUnsanitised input passed to MongoDB query (src/services/users.ts:34)
08:13Z[DRIFT]vitestvitest is 4 major versions behind (spec: ^0.34.6, latest: 4.0.18).
08:22Z[OWASP]A03:2021 – InjectionChild process spawned with user-controlled arguments (src/utils/pdf-generator.ts:52)
08:08Z[DRIFT]of dependencies are 2+ major versions behind in @acme/api.31% of dependencies are 2+ major versions behind in @acme/api.
08:18Z[OWASP]A05:2021 – Security MisconfigurationExternal link opened without rel="noreferrer" (src/components/ExternalLink.tsx:8)
08:03Z[DRIFT]@types/node@types/node is 5 major versions behind (spec: ^20.11.0, latest: 25.2.3).
08:14Z[OWASP]A02:2021 – Cryptographic FailuresMath.random() used for token generation — use crypto.randomBytes (src/utils/token.ts:6)
07:58Z[DRIFT]of dependencies are 2+ major versions behind in @acme/workflow-engine.52% of dependencies are 2+ major versions behind in @acme/workflow-engine.
08:10Z[OWASP]A05:2021 – Security MisconfigurationExpress app without Helmet security headers middleware (src/server.ts:1)
07:53Z[DRIFT]@types/node@types/node is 5 major versions behind (spec: ^20.19.9, latest: 25.2.3).
07:48Z[DRIFT]@types/node@types/node is 3 major versions behind (spec: ^22.15.29, latest: 25.2.3).
08:53Z[DRIFT]Next.jsNext.js is 2 major versions behind (current: 14.2.35, latest: 16.1.6).
08:54Z[OWASP]A03:2021 – InjectionUnescaped user input rendered into HTML template (src/routes/admin.ts:42)
08:52Z[SCANNER]semgrepscan signature set is up to date
08:48Z[DRIFT]of dependencies are 2+ major versions behind in acme.39% of dependencies are 2+ major versions behind in acme.
08:50Z[OWASP]A02:2021 – Cryptographic FailuresJWT secret is hardcoded — use environment variables (src/auth/jwt.ts:18)
08:45Z[SCANNER]gitleaksscan signature set is up to date
08:43Z[DRIFT]@types/node@types/node is 3 major versions behind (spec: 22.15.29, latest: 25.2.3).
08:46Z[OWASP]A03:2021 – InjectionRegular expression built from user input — potential ReDoS (src/utils/search.ts:67)
08:38Z[SCANNER]trufflehogstatus: unavailable
08:38Z[DRIFT]electronelectron is 3 major versions behind (spec: ^37.6.0, latest: 40.4.1).
08:42Z[OWASP]A03:2021 – InjectiondangerouslySetInnerHTML used with potentially untrusted content (src/components/RichText.tsx:31)
08:33Z[DRIFT]@types/node@types/node is 5 major versions behind (spec: ^20.17.52, latest: 25.2.3).
08:38Z[OWASP]A05:2021 – Security MisconfigurationCookie set without httpOnly or secure flags (src/middleware/session.ts:12)
08:28Z[DRIFT]@types/supertest@types/supertest is 4 major versions behind (spec: ^2.0.16, latest: 6.0.3).
08:34Z[OWASP]A03:2021 – Injectioneval() called with dynamic expression (src/utils/template-engine.ts:88)
08:23Z[DRIFT]VitestVitest is 4 major versions behind (current: 0.34.6, latest: 4.0.18).
08:30Z[OWASP]A01:2021 – Broken Access ControlRedirect URL comes from user-controlled parameter (src/pages/auth/callback.tsx:15)
08:18Z[DRIFT]@types/node@types/node is 5 major versions behind (spec: ^20.8.0, latest: 25.2.3).
08:26Z[OWASP]A03:2021 – InjectionUnsanitised input passed to MongoDB query (src/services/users.ts:34)
08:13Z[DRIFT]vitestvitest is 4 major versions behind (spec: ^0.34.6, latest: 4.0.18).
08:22Z[OWASP]A03:2021 – InjectionChild process spawned with user-controlled arguments (src/utils/pdf-generator.ts:52)
08:08Z[DRIFT]of dependencies are 2+ major versions behind in @acme/api.31% of dependencies are 2+ major versions behind in @acme/api.
08:18Z[OWASP]A05:2021 – Security MisconfigurationExternal link opened without rel="noreferrer" (src/components/ExternalLink.tsx:8)
08:03Z[DRIFT]@types/node@types/node is 5 major versions behind (spec: ^20.11.0, latest: 25.2.3).
08:14Z[OWASP]A02:2021 – Cryptographic FailuresMath.random() used for token generation — use crypto.randomBytes (src/utils/token.ts:6)
07:58Z[DRIFT]of dependencies are 2+ major versions behind in @acme/workflow-engine.52% of dependencies are 2+ major versions behind in @acme/workflow-engine.
08:10Z[OWASP]A05:2021 – Security MisconfigurationExpress app without Helmet security headers middleware (src/server.ts:1)
07:53Z[DRIFT]@types/node@types/node is 5 major versions behind (spec: ^20.19.9, latest: 25.2.3).
07:48Z[DRIFT]@types/node@types/node is 3 major versions behind (spec: ^22.15.29, latest: 25.2.3).