vctools

Verification and trust layer for the vibe coding ecosystem. A suite of CLI tools that help you ship AI-generated code with more confidence — production-readiness checks, dependency audits, security scans, error explanations, and project memory extraction.

Install

Pre-publication. 0.1.0 is built and tested locally but not yet on npm. The commands below will start working once it ships. Until then, install from source — see the main README.

npm install -g @vctools/cli
# or run any command without installing
npx @vctools/cli check-readiness .

Commands

vctools init [dir]                Initialize .vctools/ config files
vctools check-readiness [dir]     Twelve rule-based checks (free, no LLM)
vctools audit-deps [dir]          Per-package CVE + deprecation + abandonment audit
vctools scan-security [dir]       Semgrep + OWASP Top 10 ruleset
vctools explain                   Plain-English explanation of an error (Claude)
vctools checkpoint [dir]          Extract memories from latest commit → CONTEXT.md (Claude)
vctools install-hook [dir]        Install a post-commit hook that runs checkpoint silently
vctools uninstall-hook [dir]      Remove the hook

Every command supports --help. Most accept --format terminal|json for CI integration. Exit codes: 0 clean, 1 blockers found, 2 tool error.

What needs what

| Command | Cost | External dep | |---|---|---| | init, check-readiness, audit-deps | Free | — | | scan-security | Free | pip install semgrep | | explain | ~$0.001/call (Haiku 4.5) | ANTHROPIC_API_KEY | | checkpoint, install-hook | ~$0.005/commit (Haiku 4.5) | ANTHROPIC_API_KEY + git repo |

Config

Each tool reads .vctools/<tool>.json from the project root if present. Run vctools init to drop sensible defaults you can edit.

.vctools/
├── readiness.json    Categories to ignore, framework override
├── deps.json         Cache TTL, ignored packages
├── security.json     Semgrep ruleset, blocking thresholds, exclude paths
└── checkpoint.log    (auto-generated) Hook output, when running silent

Examples

# Audit before deploy
vctools check-readiness . && vctools audit-deps . && vctools scan-security .

# Pipe an error through the debugger
node nonexistent.js 2>&1 | vctools explain

# Wire up auto-memory on every commit
export ANTHROPIC_API_KEY=sk-ant-...
vctools install-hook .

Repository and spec

Source: github.com/FaraiMacheka/vctools

The full product spec lives in vibe-coding-tools-spec.md.

License

MIT