MCP Observatory
6m ago Tracked 26,548 Last 6m ago 24h 1,896
github TypeScript analyzed · update queued 24db069

vibgrate/cli

github

The Vibgrate CLI scans your codebase for upgrade drift — the gap between the dependency versions you run and the versions you should run. It produces a deterministic Upgrade Drift Score (0–100), a full context-aware dependency graph, and actionable findings enriched with AI-assisted upgrade guidance to help you maintain a healthy, secure codebase.

maintainer
vibgrate
license
Apache-2.0
first seen
2026-06-26
last seen
2026-08-01
releases · 30d
86
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 24db069 · analyzer v27 · 1w ago

skills & prompt files 3

code evidence vv2026.721.3 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 560

filesystem 70

  • fs vibgrate-cli-24db069/src/cli.ts :2 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/attest-actions.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/benchmark.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/build.ts :2 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/bundle.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/doctor.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/export.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/lib.ts :16 import fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/push.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/serve.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/share.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/commands/status.ts :2 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/core-open/config.ts :5 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/core-open/package-version-manifest.ts :4 import { mkdtemp, readFile, rm } from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/core-open/runtimes/client.ts :6 import { readFile, writeFile, mkdir } from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/core-open/scanners/upgrade-impact.ts :4 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/core-open/ui/scan-history.ts :4 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/core-open/ui/trace.ts :4 import { writeFileSync, mkdirSync } from 'node:fs';
  • fs vibgrate-cli-24db069/src/core-open/utils/fs.ts :5 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/core-open/utils/repo-fingerprint.ts :5 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/core-open/utils/update-check.ts :4 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/core-open/utils/vcs.ts :5 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/core-open/utils/version-timeline.ts :4 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/engine/artifacts.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/build.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/cache.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/coverage.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/discover.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/drift.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/embeddings.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/freshness.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/grammars.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/hosted-cache.ts :12 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/lib.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/literal-scan.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/load.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/lock.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/lockfile.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/models.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/module-resolver.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/parse-worker.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/pool.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/refresh.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/savings.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/search.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/standards.ts :1 import fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/engine/stats-share.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/install/registry.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/lsp/scan-cache.ts :15 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/lsp/server.ts :22 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/mcp/ledger-tail.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/mcp/live-stats.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/mcp/server.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/mcp/vuln-data.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/reporting/commands/update.ts :2 import * as fsSync from 'node:fs';
  • fs vibgrate-cli-24db069/src/reporting/config.ts :2 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/reporting/credentials.ts :23 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/reporting/package-version-manifest.ts :1 import { mkdtemp, readFile, rm } from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/reporting/planning/contracts.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/reporting/planning/usage.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/reporting/reachability.ts :26 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/reporting/scanners/architecture.ts :2 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/reporting/scanners/file-hotspots.ts :1 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/reporting/scanners/platform-matrix.ts :2 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/reporting/ui/scan-history.ts :1 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/reporting/utils/fs.ts :2 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/reporting/utils/gitignore.ts :11 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/reporting/utils/scan-freshness.ts :1 import * as fs from 'node:fs';
  • fs vibgrate-cli-24db069/src/reporting/utils/update-check.ts :1 import * as fs from 'node:fs/promises';
  • fs vibgrate-cli-24db069/src/util/cli-invocation.ts :1 import * as fs from 'node:fs';

shell / exec 18

  • shell vibgrate-cli-24db069/src/commands/attest-actions.ts :4 import { execFile } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/commands/build.ts :3 import { spawn } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/commands/share.ts :3 import { execFileSync } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/core-open/package-version-manifest.ts :7 import { spawn } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/core-open/scanners/npm-cache.ts :4 import { spawn } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/core-open/utils/fs.ts :4 import { execFile } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/core-open/utils/git-history.ts :4 import { execFile } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/engine/lib.ts :4 import { execFileSync } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/engine/lookup.ts :75 return new RegExp(`^${escaped}$`, 'i');
  • shell vibgrate-cli-24db069/src/engine/push.ts :1 import { execFileSync } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/engine/search.ts :3 import { spawnSync } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/reporting/commands/update.ts :1 import { execSync } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/reporting/package-version-manifest.ts :4 import { spawn } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/reporting/planning/apply.ts :1 import { spawnSync } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/reporting/planning/contracts.ts :71 const fromRe = new RegExp(`^\\s*from\\s+${e}(?:\\.[\\w.]+)?\\s+import\\s+(.+)$`, 'gm');
  • shell vibgrate-cli-24db069/src/reporting/utils/fs.ts :1 import { execFile } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/reporting/utils/open-url.ts :1 import { spawn } from 'node:child_process';
  • shell vibgrate-cli-24db069/src/util/cli-invocation.ts :2 import { execFileSync } from 'node:child_process';

network 29

  • net vibgrate-cli-24db069/src/commands/doctor.ts :213 await fetch(base, { method: 'HEAD', signal: controller.signal });
  • net vibgrate-cli-24db069/src/core-open/scanners/cargo-cache.ts :56 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/changelog-signals.ts :187 const res = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/composer-cache.ts :57 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/docker-cache.ts :71 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/go-cache.ts :60 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/helm-cache.ts :40 const response = await fetch(searchUrl, {
  • net vibgrate-cli-24db069/src/core-open/scanners/hex-cache.ts :37 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/maven-cache.ts :85 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/npm-cache.ts :317 const res = await fetch('https://registry.npmjs.org/npm/latest', {
  • net vibgrate-cli-24db069/src/core-open/scanners/nuget-cache.ts :57 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/pub-cache.ts :56 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/pypi-cache.ts :74 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/rubygems-cache.ts :79 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/swift-cache.ts :63 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/terraform-cache.ts :40 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/scanners/vulnerability-scanner.ts :301 const res = await fetch(url, { ...init, signal: controller.signal });
  • net vibgrate-cli-24db069/src/core-open/utils/scan-preflight.ts :79 const response = await fetch(url.toString(), {
  • net vibgrate-cli-24db069/src/core-open/utils/symbols-preflight.ts :97 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/core-open/utils/update-check.ts :50 response = await fetch(REGISTRY_URL, {
  • net vibgrate-cli-24db069/src/engine/hosted.ts :47 /** Injectable for tests; defaults to global fetch (undefined → disabled, returns null). */
  • net vibgrate-cli-24db069/src/engine/parse.ts :82 // (`repo.fetch()` / `repo:method()` carry table:, bare `foo()` has only name:).
  • net vibgrate-cli-24db069/src/engine/stats-share.ts :271 const res = await fetch(statsEndpoint(), {
  • net vibgrate-cli-24db069/src/lsp/enrich.ts :103 const res = await fetch(OSV_QUERY_URL, {
  • net vibgrate-cli-24db069/src/reporting/commands/dsn.ts :51 const response = await fetch(url, {
  • net vibgrate-cli-24db069/src/reporting/commands/login.ts :67 const res = await fetch(`${base}/start`, {
  • net vibgrate-cli-24db069/src/reporting/utils/fix-plan.ts :31 return fetch(`${input.scheme}://${host}/v1/fix/plan`, {
  • net vibgrate-cli-24db069/src/reporting/utils/update-check.ts :47 response = await fetch(REGISTRY_URL, {
  • net vibgrate-cli-24db069/src/reporting/utils/upload.ts :48 return fetch(url, {

secrets 5

  • secrets vibgrate-cli-24db069/src/commands/attest-actions.ts :53 const explicitKey = opts.key ?? process.env.VG_ATTEST_KEY;
  • secrets vibgrate-cli-24db069/src/commands/doctor.ts :187 process.env.VIBGRATE_CREDENTIALS ? 'env' : file === projectCredentialsPath(root) ? 'project' : 'home';
  • secrets vibgrate-cli-24db069/src/reporting/commands/push.ts :117 runToken: process.env.VIBGRATE_SCAN_RUN_TOKEN,
  • secrets vibgrate-cli-24db069/src/reporting/commands/scan.ts :178 runToken: process.env.VIBGRATE_SCAN_RUN_TOKEN,
  • secrets vibgrate-cli-24db069/src/reporting/credentials.ts :69 const override = process.env.VIBGRATE_CREDENTIALS?.trim();

install hooks 1

  • postinstall vibgrate-cli-24db069/package.json :50 node scripts/postinstall.mjs

declared dependencies 45

  • @modelcontextprotocol/sdk@^1.19.0
  • @noble/hashes@^2.2.0
  • chalk@^5.3.0
  • commander@^15.0.0
  • fast-xml-parser@^5.0.0
  • gpt-tokenizer@^3.0.0
  • graphology@^0.26.0
  • graphology-communities-louvain@^2.0.2
  • graphology-metrics@^2.4.0
  • graphology-shortest-path@^2.1.0
  • graphology-traversal@^0.3.1
  • ignore@^7.0.6
  • semver@^7.8.5
  • smol-toml@^1.7.0
  • tinypool@^2.1.0
  • tree-sitter-wasms@^0.1.13
  • typescript@^6.0.0
  • web-tree-sitter@0.25.10
  • yaml@^2.6.1
  • @types/node@^26.1.1
  • @types/semver@^7.5.0
  • @typescript-eslint/eslint-plugin@^8.64.0
  • @typescript-eslint/parser@^8.64.0
  • eslint@^10.7.0
  • graphology-types@^0.24.8
  • tsup@^8.0.0
  • tsx@^4.23.1
  • vitest@^4.1.10
  • fastembed@^2.1.0
  • org.springframework.boot:spring-boot-starter-web@*
  • org.springframework.boot:spring-boot-starter-data-jpa@*
  • org.springframework.boot:spring-boot-starter-validation@*
  • org.springframework.boot:spring-boot-starter-security@*
  • org.springframework.boot:spring-boot-starter-actuator@*
  • org.postgresql:postgresql@*
  • org.projectlombok:lombok@*
  • org.mapstruct:mapstruct@*
  • org.springdoc:springdoc-openapi-starter-webmvc-ui@*
  • org.springframework.boot:spring-boot-starter-test@*
  • org.springframework.security:spring-security-test@*
  • com.h2database:h2@*
  • Microsoft.AspNetCore.OpenApi@8.0.0
  • Swashbuckle.AspNetCore@6.5.0
  • MediatR@12.2.0
  • FluentValidation.AspNetCore@11.3.0