# ai-context **Category:** ๐Ÿ’ป Developer Tools **Repository:** https://github.com/vibgrate/cli **Views:** 0 **Installs:** 0 **Upvotes:** 0 **Directory Page:** https://allmcps.com/mcp/ai-context ## Description Local-first MCP server: version-correct library docs, code map, and offline drift for your repo. ## Claude Desktop Quick Installation Heuristic fallback โ€” verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low): ```json "mcpServers": { "ai-context": { "command": "npx", "args": ["-y","ai-context"] } } ``` ## Documentation & README

Vibgrate

@vibgrate/cli
Local codebase intelligence for AI coding agents โ€” graph, drift, and version-correct docs on your machine

npm version npm downloads Vibgrate DriftScore live demo Vibgrate Cloud MCP Apache 2.0 node 22+

`vg` answers two questions for any repo: 1. **What is this codebase?** โ€” A deterministic [code graph](https://vibgrate.com/graph): call trees, import paths, impact surfaces, dependency facts. 2. **How far behind is it?** โ€” A ranked **[DriftScore](https://vibgrate.com/driftscore)** (0โ€“100) with runtime/framework lag, dependency age and EOL proximity, and a prioritised fix list. Exposure is scored separately as a **[RiskScore](https://vibgrate.com/riskscore)**; the two together are the **[DriftRisk Index](https://vibgrate.com/driftrisk)**. The full methodology โ€” formulas, sources, and limitations โ€” is published as a [whitepaper](https://vibgrate.com/whitepapers/software-risk-and-drift-scoring-methodology) under CC BY 4.0 (DOI [10.5281/zenodo.21336304](https://doi.org/10.5281/zenodo.21336304)). Everything runs **on your machine**. No API key, no network call, no data leaving your repo unless you explicitly push. The `vibgrate` command is an alias for `vg` โ€” they are interchangeable. --- ## See it run

Animated terminal replay: npx @vibgrate/cli scan produces a 74/100 drift score, a score breakdown, and ranked upgrade priorities.

A real vg scan replay โ€” drift score, breakdown, and ranked priorities in one command. Animation plays right here on GitHub; nothing runs in your browser.

โ–ถ Try the live, interactive CLI simulator โ†’
Step through every command (scan, build, ask, why, โ€ฆ) against real sample repos.

--- ## Try it in 10 seconds No install, no signup: ```bash npx @vibgrate/cli scan # drift score + upgrade priorities npx @vibgrate/cli build # build the code graph npx @vibgrate/cli ask "what does AuthService do?" ``` Install for repeat runs: ```bash npm install -D @vibgrate/cli npx vg scan # vg is the primary command; vibgrate is an alias ``` > Local binaries live in `node_modules/.bin` โ€” use `npx vg` (or an npm script) unless you install globally. --- ## Use it with your AI assistant `vg serve` starts **[Vibgrate AI Context](https://vibgrate.com/library)** โ€” a local-first [MCP](https://vibgrate.com/glossary/model-context-protocol) server that gives any MCP-compatible assistant (Claude, Cursor, Windsurf, Copilot, Gemini CLI, โ€ฆ) your code map, **offline drift**, local models, and **version-correct library docs**, all from your machine (no account, nothing uploaded; thin local docs fall through to the hosted catalog unless you pass `--local`). No context-window stuffing, no hallucinated APIs. The map **keeps itself fresh**: when files change โ€” including edits the assistant itself just made โ€” the next tool call rebuilds it incrementally before answering, with no watcher or daemon involved. Wire it up in one command: ```bash vg install # interactive: pick your assistant(s) and done vg install --all # install for every detected assistant at once ``` This writes the MCP config for your chosen tool(s) and installs a skill that teaches the assistant how to query the graph. After reloading your assistant you get graph-aware answers: call trees, impact analysis, drift findings, version-correct library docs โ€” all from local data. The token savings are measured and published, methodology included, at [vibgrate.com/cli/benchmarks/token-savings](https://vibgrate.com/cli/benchmarks/token-savings). Browse all 21+ supported assistants and their skill descriptions at **[vibgrate.com/skills](https://vibgrate.com/skills)**. ## Tools `vg serve` exposes 19 MCP tools: - **orient** โ€” start here: project overview, entry points, where to look first. - **search_symbols** โ€” find a symbol by name or literal string. - **query_graph** โ€” find code by meaning: symptoms, relationships, what-breaks-if. - **get_node** โ€” inspect one symbol: signature, callers, callees, area. - **find_path** โ€” shortest connection between two symbols. - **impact_of** โ€” blast radius of a change: dependents, files, covering tests, risk. - **tests_for** โ€” which tests cover a symbol. - **get_graph_summary** โ€” code map overview: counts, languages, top areas and hubs. - **list_areas** โ€” code areas (communities) by size. - **list_hubs** โ€” most-depended-on symbols. - **get_facts** โ€” deterministic facts for a node (contract / invariant / characterization). - **guide_node** โ€” cited standards and practices for a node (OWASP/CWE). - **check_drift** โ€” offline dependency inventory with optional git who-added attribution. - **vuln_attribution** โ€” who introduced each open vulnerability, exposure windows, CRA remediation metrics. - **list_vulnerabilities** โ€” known vulnerabilities from the last `vg scan --vulns`: CVE, severity, CVSS, fixed version. - **upgrade_impact** โ€” what breaks if you upgrade a package: major distance, import blast radius, vulns fixed. - **list_models** โ€” local models on disk (Ollama / LM Studio / gguf). - **resolve_library** โ€” resolve a library to its canonical id and the version your project uses. - **library_docs** โ€” version-correct usage docs for a library, sliced to a token budget. Prefer the hosted server over your team's scan data? **[Vibgrate Cloud MCP](https://vibgrate.com/mcp)** connects your assistant to Vibgrate Cloud (OAuth 2.1, 51 tools). --- ## Understand any codebase Build the graph once, query it continuously: ```bash vg build # index the repo (incremental; re-run after changes) vg show src/auth/service.ts # what this file does, calls, and is called by vg ask "where is rate limiting enforced?" vg impact src/db/connection.ts # what breaks if this changes + tests to run vg path src/api/handler.ts src/db/query.ts # shortest call path between two files vg tree src/server.ts # call tree rooted at a node vg insights # overview: hubs, hotspots, untested paths ``` The graph is byte-deterministic and reproducible โ€” the same repo always produces the same graph on every machine. ```bash vg share # make the graph committable + auto-updating for the team vg serve # start Vibgrate AI Context (local-first MCP: code map + drift + version-correct docs) ``` --- ## Measure and manage upgrade drift ```bash vg scan # drift score + risk level + ranked priorities vg scan --push # same, and upload to Vibgrate Cloud for trend tracking vg baseline # snapshot current drift for regression gating vg report # generate a report from a saved scan artifact ``` One scan gives you: - **Overall score** (0โ€“100) and risk level (**Low / Moderate / High**) - **Score breakdown** โ€” runtime, frameworks, dependencies, EOL - **Per-project detail** across Node.js/TypeScript, .NET, Python, and Java - **Actionable findings** ranked by likely impact - **[SBOM](https://vibgrate.com/glossary/sbom) export** (CycloneDX / SPDX) - **Known vulnerabilities** (opt in with `--vulns`) โ€” severity, CVSS, the fixing version, and, in a git repo, who introduced them --- ## Find known vulnerabilities and who introduced them `vg scan --vulns` checks your installed dependencies against the public [OSV](https://vibgrate.com/glossary/osv) database and reports each known vulnerability with its severity, CVSS score, and the version that fixes it โ€” as text, JSON, or SARIF. Add `--package-manifest` to run it fully offline from a local advisory bundle. ```bash vg scan --vulns # drift score + known vulnerabilities vg scan --full # drift + vulnerabilities + a banned-dependency report ``` In a git repository, every finding is attributed from history: who introduced the vulnerable version, in which commit, and how long you have been exposed. Those exposure windows roll up into remediation metrics framed around the [EU Cyber Resilience Act (CRA)](https://vibgrate.com/cra) โ€” and feed [Vibgrate Evidence](https://vibgrate.com/evidence), which freezes shipped-release manifests so "which shipped products contain this vulnerability?" has a signed, offline-verifiable answer โ€” per-severity time-exposed and SLA breaches โ€” so "are we fixing things fast enough?" has a number. ```bash vg why lodash # who added a dependency, every version since, and any open vulnerabilities vg bisect lodash 4.17.21 # the commit where lodash crossed a version line (e.g. reached the fix) ``` Detection and attribution span the whole npm ecosystem (npm, pnpm, yarn) plus pip/poetry, cargo, composer, bundler, go, pub, hex, NuGet, and Maven/Gradle โ€” read from each project's lockfile, so it works whatever you build in. Your AI assistant sees this too: `vg serve` exposes `list_vulnerabilities`, `vuln_attribution`, and an `upgrade_impact` tool that tells an agent what an upgrade will cost โ€” version distance, how many files import the package, the vulnerabilities it fixes, and (online, opt in) the breaking-change notes between your version and the latest. --- ## Track drift over time โ†’ create a free workspace The CLI is fully useful offline. When you want **trends across runs and repos** โ€” so drift becomes a metric you manage, not a surprise you discover โ€” push scans to a [Vibgrate Cloud](https://vibgrate.com/cloud) workspace: 1. **Create a workspace** at **[dash.vibgrate.com](https://dash.vibgrate.com)** and copy your DSN. 2. **Connect and push:** ```bash VIBGRATE_DSN="vibgrate+https://:@us.ingest.vibgrate.com/" \ vg scan --push ``` Upload is opt-in โ€” nothing leaves your machine until you run `--push`. Store the DSN as a CI secret, never commit it. **[โ†’ Create your workspace](https://dash.vibgrate.com)** --- ## CI integration Drop `vg` into any pipeline to turn drift scoring into a quality gate: ```yaml # GitHub Actions โ€” drift gate + SARIF upload - name: Vibgrate scan env: VIBGRATE_DSN: ${{ secrets.VIBGRATE_DSN }} run: npx @vibgrate/cli scan --push --format sarif --out vibgrate.sarif --fail-on error - name: Upload SARIF if: always() uses: github/codeql-action/upload-sarif@v3 with: sarif_file: vibgrate.sarif ``` Gate on drift budgets and regression relative to a baseline: ```bash vg baseline vg scan --baseline .vibgrate/baseline.json --drift-budget 40 --drift-worsening 5 ``` - `--drift-budget ` fails the build if drift exceeds your budget. - `--drift-worsening ` fails the build if drift worsens by more than X% vs baseline. Copy-paste CI templates live in `examples/github-actions/`. Azure DevOps and GitLab CI snippets are in [DOCS.md](./DOCS.md#ci-integration). --- ## Version-correct library docs `vg lib` fetches usage docs pinned to the **exact version in your lockfile** โ€” never a newer API your code can't call yet: ```bash vg lib react # React docs at your installed version vg lib express --fn middleware # specific function reference ``` AI assistants connected via MCP use `vg lib` automatically when answering questions about library APIs in your project. --- ## SBOM and OpenVEX ```bash vg sbom export --format cyclonedx --out sbom.cdx.json vg sbom export --format spdx --out sbom.spdx.json vg sbom delta --from .vibgrate/baseline.json --to .vibgrate/scan_result.json --out delta.txt vg vex # generate an OpenVEX document for attestation ``` --- ## Privacy & offline-first - No data leaves your machine unless you run `--push` / `vg push` / `vg share`. - Drift scoring reads manifests and configs only. The code graph (`vg build`/`vg map`) and a few extended scanners (code quality, database schema, UI text) read your source **locally** to compute structural facts and metrics โ€” never a raw source line, and never uploaded as-is; see [DOCS.md](./DOCS.md#extended-scanners) for exactly what each one reads. - Works without login and without any SaaS dependency. - `--offline` disables registry/network lookups; `--package-manifest ` feeds drift scoring a local version bundle. - `--max-privacy` suppresses local artifact writes and high-context scanners; `--no-local-artifacts` skips writing `.vibgrate/*.json` to disk. ```bash vg scan --offline --package-manifest ./package-versions.zip --max-privacy --format json --out scan.json ``` Add `.vibgrate/` to your `.gitignore` โ€” those are regenerated local outputs. More on how Vibgrate handles code and data: [vibgrate.com/security](https://vibgrate.com/security), and the [subprocessor register](https://vibgrate.com/subprocessors). --- ## Quick start with AI assistants Paste this into your AI coding tool (Claude, Cursor, Copilot, Gemini CLI, โ€ฆ): ``` Set up Vibgrate for local codebase intelligence: 1. Install: npm install -g @vibgrate/cli@latest 2. Build the graph: vg build 3. Wire your assistant: vg install 4. Ask: vg ask "what are the main entry points?" Then explain the architecture and my top 3 upgrade priorities. ``` See [docs/QUICKSTART-PROMPT.md](./docs/QUICKSTART-PROMPT.md) for the full prompt. --- ## Command reference Under each set, commands are listed Aโ€“Z. A short **typical path** (usual order) is called out where it helps. ### Code graph **Typical path:** `vg build` โ†’ `vg status` โ†’ `vg ask` โ†’ `vg impact` โ†’ `vg share` | Command | Description | | --- | --- | | `vg ask ""` | Query the map in natural language | | `vg build [path]` | Build / update the code map (incremental, deterministic) | | `vg bundle` | Build an air-gapped bundle (grammars + graph + library catalog) | | `vg code ""` | Propose a graph-grounded code edit (dry-run by default; `--apply --yes` to write) | | `vg embed` | Precompute the semantic index for instant `vg ask` | | `vg export` | Export the map (json / ndjson / graphml / dot / cypher / md / html / SBOM) | | `vg facts ` | Deterministic facts for a node (contracts, invariants) | | `vg guide ` | Cited standards / practices for a node (free pack) | | `vg impact ` | What breaks if you change it โ€” and the tests to run | | `vg install` / `vg uninstall` | Wire (or remove) **Vibgrate AI Context** + skill in your AI assistant (`--detect`, `--all`, `--list`) | | `vg lib ` | Version-correct, drift-annotated library docs | | `vg map` / `vg hubs` / `vg areas` / `vg oddities` | Map insights: overview, most-depended-on code, natural groupings, cross-area smells | | `vg models` | Code Modes (Spark / Flow / Forge) + local fleet (Ollama / LM Studio / gguf); `install` / `pull` by default (`--dry-run` to preview) | | `vg path ` | How A connects to B (shortest path) | | `vg savings` | Local report of tokens/$ saved vs a grep baseline (estimates) | | `vg watch` | Rebuild the map when files change | | `vg serve` | Start **Vibgrate AI Context** (local-first MCP: code map + drift + version-correct docs) | | `vg share` | Make the graph committable + auto-updating for your team | | `vg show ` | Explain a node: what it is, what it calls, what calls it | | `vg status` | Cache/freshness, counts, staleness | | `vg tests ` | Which tests cover a node | | `vg tree ` | Call tree rooted at a node | | `vg unknowns` | What the graph cannot resolve, ranked by blast radius | ### Diagnostics, IDE & runtime **Typical path:** `vg doctor` โ†’ `vg lsp` โ†’ `vg daemon` | Command | Description | | --- | --- | | `vg daemon` | Local workspace daemon for multi-root graph sessions (IDE / agents): `status`, `ensure`, `publish`, `query`, `impact`, โ€ฆ | | `vg doctor` | Read-only diagnosis: config, credentials (redacted), map freshness, hosted reachability, MCP launch | | `vg lsp` | Language server (stdio) โ€” engine behind Vibgrate for VS Code and other thin IDE clients | | `vg policy` | Show production context-policy pin; `vg policy verify ` for signed learning patches | ### Drift scoring & supply chain **Typical path:** `vg init` โ†’ `vg scan` โ†’ `vg baseline` โ†’ `vg report` โ†’ `vg fix` | Command | Description | | --- | --- | | `vg baseline [path]` | Create a drift baseline | | `vg bisect ` | The commit where a dependency crossed a version line (`--assert` to gate CI) | | `vg drift` | What is outdated across dependencies (offline; `--online` for currency) | | `vg evidence` | Signed, reproducible regulatory evidence (regime-neutral; CRA first) | | `vg fix` | Ranked, risk-tiered upgrade plans from the hosted planner โ€” then apply the one you choose | | `vg init [path]` | Initialise config and `.vibgrate/` | | `vg report` | Generate a report from a scan artifact | | `vg sbom export` / `delta` / `vex` | Export CycloneDX/SPDX SBOM, diff two artifacts, or emit an OpenVEX document | | `vg scan [path]` | Scan for upgrade drift | | `vg scan --full` | Comprehensive scan: drift + vulnerabilities + a banned-dependency report | | `vg scan --push` | Scan and push results to Vibgrate Cloud | | `vg scan --vulns` | Also detect known vulnerabilities (OSV; offline via `--package-manifest`) | | `vg update` | Check for and install updates | | `vg why ` | Who introduced a dependency, its version history, and any open vulnerabilities | ### Workspace auth & cloud upload Local scoring does not require this โ€” nothing leaves your machine until you push. **Typical path:** `vg login` โ†’ `vg dsn create` โ†’ `vg push` โ†’ `vg logout` | Command | Description | | --- | --- | | `vg dsn create` | Generate a DSN token | | `vg login` / `vg logout` | Authenticate the CLI with your Vibgrate workspace (or clear stored credentials) | | `vg push` | Upload scan results to Vibgrate Cloud | ```bash vg scan [path] [--vulns] [--full] [--format text|json|sarif|md] [--out ] [--fail-on warn|error] \ [--offline] [--package-manifest ] [--no-local-artifacts] [--max-privacy] \ [--drift-budget ] [--drift-worsening ] [--baseline ] ``` Full flag and configuration reference: **[DOCS.md](./DOCS.md)** ยท **[vibgrate.com/cli](https://vibgrate.com/cli)** ยท [help centre](https://vibgrate.com/help) ยท [glossary](https://vibgrate.com/glossary). --- ## Why teams adopt Vibgrate Most systems don't fail all at once โ€” they accumulate upgrade debt and architectural [drift](https://vibgrate.com/glossary/code-drift) silently until migrations become expensive. `vg` makes that debt measurable and repeatable โ€” the practice we call [Code Drift Intelligence](https://vibgrate.com/code-drift-intelligence) โ€” and gives AI assistants the local context they need to be useful. See how it lands for [teams](https://vibgrate.com/solutions/teams) and [enterprises](https://vibgrate.com/solutions/enterprise), or compare it with what you already run: [vs Renovate](https://vibgrate.com/vs/renovate) ยท [vs Dependabot](https://vibgrate.com/vs/dependabot) ยท [vs Snyk](https://vibgrate.com/vs/snyk). | Mode | What you get | Best for | | --- | --- | --- | | **One-off scan** | Fast snapshot of drift score, lag, and findings | Audits, due diligence, migration planning | | **CI-integrated scan** | Continuous drift signal, SARIF annotations, regression guardrails | Keeping upgrade debt under control long-term | | **MCP + graph** | AI assistant with real-time, offline codebase context | Day-to-day development, code review, refactoring | Recommended rollout: `vg build` + `vg install` now, add `vg scan` to CI this week. --- ## Requirements - Node.js **22+** - macOS, Linux, Windows ## Command name conflicts `vg` is short and occasionally conflicts with other tools (`virtualgo`, `vugu`, the oh-my-zsh `git verify-commit` alias, custom shell aliases, etc.). **`vibgrate` is an identical alias** โ€” same binary, same flags, same behaviour. If `vg` is taken on your system, use `vibgrate` everywhere instead: ```bash vibgrate scan # same as: vg scan vibgrate build # same as: vg build vibgrate serve # same as: vg serve ``` When `@vibgrate/cli` is installed, it registers **both** bin entries unconditionally. If it detects at install time that `vg` is already claimed by another tool, it prints a one-line notice pointing you to `vibgrate`. --- ## Everything else Vibgrate makes | | | |---|---| | [**Vibgrate CLI**](https://vibgrate.com/cli) | This package โ€” scan, score, and map any repository. [Live demo](https://vibgrate.com/cli) ยท [benchmarks](https://vibgrate.com/cli/benchmarks) ยท [token savings](https://vibgrate.com/cli/benchmarks/token-savings) | | [**Vibgrate for VS Code**](https://vibgrate.com/vscode) | The same score in your editor, plus VG Code. [Marketplace](https://marketplace.visualstudio.com/items?itemName=vibgrate.vibgrate-vscode) ยท [Open VSX](https://open-vsx.org/extension/vibgrate/vibgrate-vscode) | | [**Vibgrate Graph**](https://vibgrate.com/graph) | The deterministic local code map behind `vg map`, `vg impact` and `vg show` | | [**Vibgrate AI Context**](https://vibgrate.com/library) | `vg serve` โ€” version-correct library docs, your code map, and offline drift, served to any assistant. [Supported assistants](https://vibgrate.com/skills) ยท [on mcp.so](https://mcp.so/servers/cli-a2b26f) | | [**Vibgrate Cloud MCP**](https://vibgrate.com/mcp) | The hosted MCP server over your workspace data (OAuth 2.1) | | [**Vibgrate Cloud**](https://vibgrate.com/cloud) | History, trends, and team rollups. [Create a workspace](https://dash.vibgrate.com) ยท [pricing](https://vibgrate.com/pricing) | | [**Vibgrate Evidence**](https://vibgrate.com/evidence) | Signed, reproducible release evidence โ€” including for the [EU CRA](https://vibgrate.com/cra) | **How the scores work:** [DriftScore](https://vibgrate.com/driftscore) ยท [RiskScore](https://vibgrate.com/riskscore) ยท [DriftRisk Index](https://vibgrate.com/driftrisk) ยท [published methodology](https://vibgrate.com/whitepapers/software-risk-and-drift-scoring-methodology) ยท [public index of real scans](https://vibgrate.com/driftrisk/index) ยท [README badges](https://vibgrate.com/badges) **Reference:** [package registry](https://vibgrate.com/packages) ยท [integrations marketplace](https://vibgrate.com/marketplace) ยท [glossary](https://vibgrate.com/glossary) ยท [help centre](https://vibgrate.com/help) ยท [security](https://vibgrate.com/security) ยท [mission](https://vibgrate.com/mission)

Create a free workspace โ†’  ยท  Try the live demo  ยท  Full docs

Apache-2.0 licensed ยท Copyright ยฉ 2026 Vibgrate