Local-first MCP server: version-correct library docs, code map, and offline drift for your repo.
com.vibgrate/ai-context (MCP)
Local-first Model Context Protocol (MCP) server that provides version-correct library documentation, a code map, and offline drift information for a repository. It is designed to support working with library docs and code context while remaining local to the project environment.
🛠️ Key Features
Local-first operation
Version-correct library docs
Code map
Offline drift for your repo
🚀 Use Cases
Referencing library documentation aligned to the repo’s versions
Navigating and understanding code structure via a code map
Tracking or assessing changes through offline drift information
⚡ Developer Benefits
Maintains alignment between documentation and library versions in the repository
Improves code context discovery through an explicit code map
Supports offline workflows using locally available drift data
@vibgrate/cli
Local codebase intelligence for AI coding agents — graph, drift, and version-correct docs on your machine
vg answers two questions for any repo:
What is this codebase? — A deterministic code graph: call trees, import paths, impact surfaces, dependency facts.
How far behind is it? — A ranked DriftScore (0–100) with runtime/framework lag, dependency age and EOL proximity, and a prioritised fix list.
Everything runs on your machine. No API key, no network call, no data leaving your repo unless you explicitly push. The vibgrate command is an alias for vg — they are interchangeable.
A real vg scan replay — drift score, breakdown, and ranked priorities in one command. Animation plays right here on GitHub; nothing runs in your browser.
npm install -D @vibgrate/cli
npx vg scan # vg is the primary command; vibgrate is an alias
Local binaries live in node_modules/.bin — use npx vg (or an npm script) unless you install globally.
Use it with your AI assistant
vg serve starts Vibgrate AI Context — a local-first MCP server that
gives any MCP-compatible assistant (Claude, Cursor, Windsurf, Copilot, Gemini
CLI, …) your code map, offline drift, local models, and version-correct
library docs, all from your machine (no account, nothing uploaded; thin
local docs fall through to the hosted catalog unless you pass --local). No
context-window stuffing, no hallucinated APIs. The map keeps itself fresh:
when files change — including edits the assistant itself just made — the next
tool call rebuilds it incrementally before answering, with no watcher or
daemon involved.
Wire it up in one command:
bash
vg install # interactive: pick your assistant(s) and done
vg install --all # install for every detected assistant at once
This writes the MCP config for your chosen tool(s) and installs a skill that teaches the assistant how to query the graph. After reloading your assistant you get graph-aware answers: call trees, impact analysis, drift findings, version-correct library docs — all from local data. The token savings are measured and published, methodology included, at vibgrate.com/cli/benchmarks/token-savings.
Browse all 21+ supported assistants and their skill descriptions at vibgrate.com/skills.
Tools
vg serve exposes 19 MCP tools:
orient — start here: project overview, entry points, where to look first.
search_symbols — find a symbol by name or literal string.
query_graph — find code by meaning: symptoms, relationships, what-breaks-if.
get_node — inspect one symbol: signature, callers, callees, area.
find_path — shortest connection between two symbols.
impact_of — blast radius of a change: dependents, files, covering tests, risk.
tests_for — which tests cover a symbol.
get_graph_summary — code map overview: counts, languages, top areas and hubs.
list_areas — code areas (communities) by size.
list_hubs — most-depended-on symbols.
get_facts — deterministic facts for a node (contract / invariant / characterization).
guide_node — cited standards and practices for a node (OWASP/CWE).
check_drift — offline dependency inventory with optional git who-added attribution.
vuln_attribution — who introduced each open vulnerability, exposure windows, CRA remediation metrics.
list_vulnerabilities — known vulnerabilities from the last vg scan --vulns: CVE, severity, CVSS, fixed version.
upgrade_impact — what breaks if you upgrade a package: major distance, import blast radius, vulns fixed.
list_models — local models on disk (Ollama / LM Studio / gguf).
resolve_library — resolve a library to its canonical id and the version your project uses.
library_docs — version-correct usage docs for a library, sliced to a token budget.
Prefer the hosted server over your team's scan data? Vibgrate MCP connects your assistant to Vibgrate Cloud (OAuth 2.1, 51 tools).
Understand any codebase
Build the graph once, query it continuously:
bash
vg build # index the repo (incremental; re-run after changes)
vg show src/auth/service.ts # what this file does, calls, and is called by
vg ask "where is rate limiting enforced?"
vg impact src/db/connection.ts # what breaks if this changes + tests to run
vg path src/api/handler.ts src/db/query.ts # shortest call path between two files
vg tree src/server.ts # call tree rooted at a node
vg insights # overview: hubs, hotspots, untested paths
The graph is byte-deterministic and reproducible — the same repo always produces the same graph on every machine.
bash
vg share # make the graph committable + auto-updating for the team
vg serve # start Vibgrate AI Context (local-first MCP: code map + drift + version-correct docs)
Measure and manage upgrade drift
bash
vg scan # drift score + risk level + ranked priorities
vg scan --push # same, and upload to Vibgrate Cloud for trend tracking
vg baseline # snapshot current drift for regression gating
vg report # generate a report from a saved scan artifact
Known vulnerabilities (opt in with --vulns) — severity, CVSS, the fixing version, and, in a git repo, who introduced them
Find known vulnerabilities and who introduced them
vg scan --vulns checks your installed dependencies against the public OSV database and reports each known vulnerability with its severity, CVSS score, and the version that fixes it — as text, JSON, or SARIF. Add --package-manifest to run it fully offline from a local advisory bundle.
bash
vg scan --vulns # drift score + known vulnerabilities
vg scan --full # drift + vulnerabilities + a banned-dependency report
In a git repository, every finding is attributed from history: who introduced the vulnerable version, in which commit, and how long you have been exposed. Those exposure windows roll up into remediation metrics framed around the EU Cyber Resilience Act (CRA) — per-severity time-exposed and SLA breaches — so "are we fixing things fast enough?" has a number.
bash
vg why lodash # who added a dependency, every version since, and any open vulnerabilities
vg bisect lodash 4.17.21 # the commit where lodash crossed a version line (e.g. reached the fix)
Detection and attribution span the whole npm ecosystem (npm, pnpm, yarn) plus pip/poetry, cargo, composer, bundler, go, pub, hex, NuGet, and Maven/Gradle — read from each project's lockfile, so it works whatever you build in.
Your AI assistant sees this too: vg serve exposes list_vulnerabilities, vuln_attribution, and an upgrade_impact tool that tells an agent what an upgrade will cost — version distance, how many files import the package, the vulnerabilities it fixes, and (online, opt in) the breaking-change notes between your version and the latest.
Track drift over time → create a free workspace
The CLI is fully useful offline. When you want trends across runs and repos — so drift becomes a metric you manage, not a surprise you discover — push scans to a Vibgrate Cloud workspace:
No data leaves your machine unless you run --push / vg push / vg share.
Drift scoring reads manifests and configs only. The code graph (vg build/vg map) and a few extended scanners (code quality, database schema, UI text) read your source locally to compute structural facts and metrics — never a raw source line, and never uploaded as-is; see DOCS.md for exactly what each one reads.
Works without login and without any SaaS dependency.
--offline disables registry/network lookups; --package-manifest <file> feeds drift scoring a local version bundle.
--max-privacy suppresses local artifact writes and high-context scanners; --no-local-artifacts skips writing .vibgrate/*.json to disk.
Paste this into your AI coding tool (Claude, Cursor, Copilot, Gemini CLI, …):
code
Set up Vibgrate for local codebase intelligence:
1. Install: npm install -g @vibgrate/cli@latest
2. Build the graph: vg build
3. Wire your assistant: vg install
4. Ask: vg ask "what are the main entry points?"
Then explain the architecture and my top 3 upgrade priorities.
Most systems don't fail all at once — they accumulate upgrade debt and architectural drift silently until migrations become expensive. vg makes that debt measurable and repeatable — the practice we call Code Drift Intelligence — and gives AI assistants the local context they need to be useful:
AI assistant with real-time, offline codebase context
Day-to-day development, code review, refactoring
Recommended rollout: vg build + vg install now, add vg scan to CI this week.
Requirements
Node.js 22+
macOS, Linux, Windows
Command name conflicts
vg is short and occasionally conflicts with other tools (virtualgo, vugu, the oh-my-zsh git verify-commit alias, custom shell aliases, etc.).
vibgrate is an identical alias — same binary, same flags, same behaviour. If vg is taken on your system, use vibgrate everywhere instead:
bash
vibgrate scan # same as: vg scan
vibgrate build # same as: vg build
vibgrate serve # same as: vg serve
When @vibgrate/cli is installed, it registers both bin entries unconditionally. If it detects at install time that vg is already claimed by another tool, it prints a one-line notice pointing you to vibgrate.
