mcp changelog

https://vibgrate.com/llms.txt

− - [VG Code](https://vibgrate.com/vgcode): The graph-grounded, governance-gated coding agent — a capability of Vibgrate CLI (`vg code`) and Vibgrate for VS Code, not a separate product. Grounded in the deterministic code map (a Task Capsule of the relevant symbols with their exact source ranges, relationships, and a verification plan), including your uncommitted working-tree edits and the agent's own pending edits. That grounding is what the published token-savings benchmark measures — the same t+ - [VG Code](https://vibgrate.com/vgcode): The graph-grounded, governance-gated coding agent — a capability of Vibgrate CLI (`vg code`) and Vibgrate for VS Code, not a separate product. Grounded in the deterministic code map (a Task Capsule of the relevant symbols with their exact source ranges, relationships, and a verification plan), including your uncommitted working-tree edits and the agent's own pending edits. That grounding is what the published token-savings benchmark measures — the same t

https://vibgrate.com/llms.txt

− - **Known-vulnerability detection** is opt-in with `vg scan --vulns`: it matches installed dependencies against the public OSV database (or an offline advisory bundle via `--package-manifest`) and reports advisory id/CVE, severity, CVSS, and the fixing version — also as SARIF. `vg scan --vulns --format sarif` writes one result per package and advisory under rule `vibgrate/vulnerability`. The advisory's own id is `properties.advisoryId`. CVE and other aliases stay in `properties.aliases`, in the − - `vg fix` returns three ranked, risk-tiered upgrade plans. The report labels them Low-risk, Balanced, and Full; `--plan` takes `safe`, `balanced`, and `aggressive` for those same tiers. Plans are scored on real-world exploitability — CISA KEV (known-exploited) and FIRST EPSS (exploit probability) on top of advisory data — so the most dangerous upgrade rises first. `--no-apply` prints the plans and does not touch the project. `--dry-run` previews the plan named by `--plan` and never prompts. Wit+ - **Known-vulnerability detection** is opt-in with `vg scan --vulns`: it matches installed dependencies against the public OSV database (or an offline advisory bundle via `--package-manifest`) and reports advisory id/CVE, severity, CVSS, and the fixing version — also as SARIF. `vg scan --vulns --format sarif` writes one result per package and advisory under rule `vibgrate/vulnerability`. The advisory's own id is `properties.advisoryId`. CVE and other aliases stay in `properties.aliases`, in the + - `vg fix` returns three ranked, risk-tiered upgrade plans. The report labels them Low-risk, Balanced, and Full; `--plan` takes `safe`, `balanced`, and `aggressive` for those same tiers. Plans are scored on real-world exploitability — CISA KEV (known-exploited) and FIRST EPSS (exploit probability) on top of advisory data — so the most dangerous upgrade rises first. `--no-apply` prints the plans and does not touch the project. `--dry-run` previews the plan named by `--plan` and never prompts. Wit

https://vibgrate.com/llms.txt

− - `vg fix` returns three ranked, risk-tiered upgrade plans (Low-risk, Balanced, Full) scored on real-world exploitability — CISA KEV (known-exploited) and FIRST EPSS (exploit probability) on top of advisory data — so the most dangerous upgrade rises first. It is **read-only by default** (`--no-apply`, `--dry-run`); apply a tier with `--plan safe|balanced|aggressive`, and gate CI with `--fail-on-vulns <severity>`. The planner is hosted, so it needs `vg login` or a `VIBGRATE_DSN`; it sends depende− - [Free Dev Docs Library](https://vibgrate.com/library): Version-correct library documentation for the exact packages pinned in your project, served to your AI via local MCP. No wrong-version hallucinations.− - [Vibgrate Evidence](https://vibgrate.com/evidence): The regulatory-evidence product — register products with digital elements, freeze shipped-release component manifests, then answer which shipped products contain a vulnerability (at which versions, in which markets, still in support) as signed, reproducible, offline-verifiable evidence (`vg evidence`, and Vibgrate Cloud → Govern ▸ Evidence). Manifests freeze from a Vibgrate scan artifact or an SBOM (CycloneDX, SPDX, or an in-toto/DSSE SBOM at− - [The Vibgrate DriftRisk™ Index](https://vibgrate.com/driftrisk/index): A public index of repositories that added a Vibgrate badge, each with its DriftScore, RiskScore, and DriftRisk™ from the same real, provenance-stamped scan. Scores come from the Vibgrate CLI itself, so they match a local CLI scan of the same commit; a repository is rescanned when new code lands on its default branch, and at least monthly.− vg fix                                                            # ranked, risk-tiered upgrade plans (needs vg login)− - [Trust Center](https://vibgrate.com/trust): Security posture and data-handling overview.+ - `vg build` and `vg scan` do not follow symlinks. A directory link is not entered, so a link that points at its parent cannot hang the walk, and a file link is not read. When a walk skips any, one stderr notice gives the count and the first few root-relative paths. Nothing is printed when there are none. The map, the scan artifact, and the exit code stay the same, and JSON on stdout stays a JSON document. Point the root at the link target, or pass `--exclude` or a narrower root, to include thos+ - `vg fix` returns three ranked, risk-tiered upgrade plans. The report labels them Low-risk, Balanced, and Full; `--plan` takes `safe`, `balanced`, and `aggressive` for those same tiers. Plans are scored on real-world exploitability — CISA KEV (known-exploited) and FIRST EPSS (exploit probability) on top of advisory data — so the most dangerous upgrade rises first. `--no-apply` prints the plans and does not touch the project. `--dry-run` previews the plan named by `--plan` and never prompts. Wit+ - [Free Dev Docs Library](https://vibgrate.com/library): Version-correct library documentation, served to your AI via local MCP. `vg lib <pkg>` labels the answer with the lockfile pin when that file lists the package. Readers open `package-lock.json`, then `pnpm-lock.yaml`, then `yarn.lock`, plus `poetry.lock`, `uv.lock`, `Pipfile.lock`, `Cargo.lock`, `Gemfile.lock`, `composer.lock`, `packages.lock.json`, `Package.resolved`, `pubspec.lock`, and `gradle.lockfile`, in the directory you run from. A+ - [Vibgrate Evidence](https://vibgrate.com/evidence): The regulatory-evidence product — register products with digital elements, freeze shipped-release component manifests, then answer which shipped products contain a vulnerability (at which versions, in which markets, still in support) as signed, reproducible, offline-verifiable evidence (`vg evidence`, and Vibgrate Cloud → Govern ▸ Evidence). Manifests freeze from a Vibgrate scan artifact or an SBOM (CycloneDX, SPDX, or an in-toto/DSSE SBOM at+ - [The Vibgrate DriftRisk™ Index](https://vibgrate.com/driftrisk/index): A public index of repositories scanned by Vibgrate, each with its DriftScore, RiskScore, and DriftRisk™ from the same real scan. A row is not an endorsement, and it does not mean the maintainer added a badge. A repository is labeled a badge adopter only when that adoption is verified. Scores come from the Vibgrate CLI itself, so they match a local CLI scan of the same commit; a repository is rescanned when new code lands on+ vg fix                                                            # ranked upgrade plans (needs a DSN: vg login, VIBGRATE_DSN, or --dsn)+ vg lib react                                                      # library docs; version label follows the lockfile pin+ - [Trust Center](https://vibgrate.com/trust): Security program. Aligned to ISO/IEC 27001 and SOC 2; independent audit planned. Security overview, data handling, subprocessors (https://vibgrate.com/trust/subprocessors; /subprocessors redirects there), policy summaries, documents on request under NDA, a DPA on request, and vulnerability disclosure. The remediation agent is the path on which a language-model provider can see customer source, and only when you ask. Do not describe Vibgrate as holdin+ - [Signed releases](https://vibgrate.com/trust/provenance): How to verify a signed release, an SBOM, and where a binary came from.

https://vibgrate.com/llms.txt

− - Output is written to `.vibgrate/scan_result.json`, with optional SARIF for CI code-scanning and an optional baseline for drift deltas.− - **Known-vulnerability detection** is opt-in with `vg scan --vulns`: it matches installed dependencies against the public OSV database (or an offline advisory bundle via `--package-manifest`) and reports advisory id/CVE, severity, CVSS, and the fixing version — also as SARIF. `vg scan --full` runs drift, vulnerabilities, infrastructure misconfiguration findings, and a banned-dependency report in one pass.− - In a git repository each vulnerability is **attributed**: the commit, author, and date that introduced the affected version, and how long you have been exposed. Exposure windows roll up into remediation metrics framed around the EU Cyber Resilience Act (CRA) — not a compliance certification. Vibgrate also reconstructs **closed** windows from history (a vulnerable version bumped out of range or removed from the lockfile) to report real remediation time (MTTR) — measured, not estimated; offline − - Vulnerability detection and attribution read each project's lockfile, covering npm/pnpm/yarn, pip/poetry/pipenv, cargo, composer, bundler, go, pub, hex, NuGet, and Maven/Gradle.− - **Vibgrate Cloud** (dash.vibgrate.com) is the team layer: DriftScore trends, dependency/vulnerability/SBOM registers, risk & compliance, policies, drift budgets, approvals with delegations, audit trail, and report building. Its SBOM Hub can export downloadable SBOM reports (CycloneDX 1.5 / SPDX 2.3) and sign them into verifiable attestations (in-toto / DSSE), so a consumer can prove a report came from Vibgrate and was not altered; the dashboard shows a verified/unsigned status. Opening dash.vi− - [Vibgrate Review](https://vibgrate.com/review): Architecture-aware code review that runs locally (`vg review`; the Review panel in Vibgrate for VS Code; a GitHub Actions example; and Vibgrate Cloud's commit-by-commit Review timeline). Command reference: https://vibgrate.com/cli/docs/review-command. Given a change — the working tree, or a branch against its merge-base — it reports whether the change moved the system toward its declared architecture, weakened a security control, or created an im− vg scan --baseline .vibgrate/baseline.json                        # scan with drift deltas+ - `vg build --attest` signs the code map it just wrote. There is no `vg attest-actions` command. `vg attest` and `vg verify` are retired names that tell you to run `vg build --attest` and `vg build --verify`. The signature is a DSSE in-toto statement at `.vibgrate/attestation.intoto.jsonl` (`--attestation <file>` overrides). The Ed25519 key is `--attest-key <path>`, else `VG_ATTEST_KEY`, else `.vibgrate/attest-key.pem`. The first run with no key at that default path mints one (mode `0600`, plus + - Output is written to `.vibgrate/scan_result.json`, with optional SARIF for CI code-scanning and an optional baseline for drift deltas plus an audit of findings already in that snapshot. Every SARIF result includes `partialFingerprints["vg/finding-id/v1"]`. The value is a content id of the finding, not the scan time or the result order, so an unchanged finding keeps the same code-scanning alert. Drift findings use the rule id and location (the same id a baseline suppression records). Vulnerabil+ - **Known-vulnerability detection** is opt-in with `vg scan --vulns`: it matches installed dependencies against the public OSV database (or an offline advisory bundle via `--package-manifest`) and reports advisory id/CVE, severity, CVSS, and the fixing version — also as SARIF. `vg scan --vulns --format sarif` writes one result per package and advisory under rule `vibgrate/vulnerability`. The advisory's own id is `properties.advisoryId`. CVE and other aliases stay in `properties.aliases`, in the + - In a git repository each vulnerability is **attributed**: the commit, author, and date that introduced the affected version, and how long you have been exposed. Exposure windows roll up into remediation metrics framed around the EU Cyber Resilience Act (CRA) — not a compliance certification. Vibgrate also reconstructs **closed** windows from history (a vulnerable version bumped out of range or removed from the lockfile) to report real remediation time (MTTR) — measured, not estimated; offline + - Vulnerability detection and attribution read each project's lockfile, covering npm/pnpm/yarn, pip/poetry/pipenv, cargo, composer, bundler, pub, hex, NuGet, and Maven/Gradle. For npm, pnpm, and yarn, `vg scan --vulns` checks every package the lockfile resolves, including transitive dependencies, and names the shortest path from a declared dependency to each affected package. For Go, `vg scan --vulns` matches direct `require` lines in `go.mod` (`go.sum` is not the version source). A pseudo-versi+ - **Vibgrate Cloud** (dash.vibgrate.com) is the team layer: DriftScore trends, a Findings list of open drift, vulnerability, and end-of-life findings, dependency and SBOM registers, policies with drift budgets, approvals with delegations, evidence with an audit log and reports, and a repository page for each repository. Its SBOM tab (under Dependencies) can export downloadable SBOM reports (CycloneDX 1.5 / SPDX 2.3) and sign them into verifiable attestations (in-toto / DSSE), so a consumer can p+ - [Vibgrate Review](https://vibgrate.com/review): Architecture-aware code review that runs locally (`vg review`; the Review panel in Vibgrate for VS Code; a GitHub Actions example; and Vibgrate Cloud's commit-by-commit Review timeline). Command reference: https://vibgrate.com/cli/docs/review-command. Given a change — the working tree, or a branch against its merge-base — it reports whether the change moved the system toward its declared architecture, weakened a security control, or created an im+ - [Free DriftScore Check](https://vibgrate.com/scan): Paste a public repository URL on github.com, gitlab.com or bitbucket.org and get the DriftScore the Vibgrate CLI computes for its default branch. No sign-up. Owners can ask for removal through the contact page (Privacy & Data).+ vg scan --baseline .vibgrate/baseline.json                        # drift delta plus a record of findings already in the baseline