Vibe Code Tagger

Transparency is the entry ticket. Evidence earns the score. Honesty protects it.

Vibe-coded apps — apps built largely with AI coding assistants — are real, useful, and here to stay. Hiding that fact is the wrong instinct: it turns transparency into a liability. Vibe Code Tagger flips that. It lets a creator openly declare "this was vibe coded" and earn a confidence rating that tells users how much they can trust the result.

Declaring that your app is vibe coded never lowers your score. The score measures the things users actually care about — is it tested, is it documented, is it secure, was it reviewed, and does the creator's disclosure match reality. A fully vibe-coded app with solid tests, clean security, honest disclosure, and a human review can score higher than a hand-written app with none of those.

The two pieces

1. The Vibe Transparency Standard (VTS) — an open, versioned format for a .vibe.yaml manifest a creator puts in their repo. It captures how the app was built (AI authorship, human oversight, tools) and an honest disclosure (testing, security review, known limitations, intended use).

2. vibecheck (CLI) — reads the manifest, scans the repo for objective evidence (tests, CI, docs, license, lockfile, secrets, dependency health), cross-checks claims against evidence, computes a Confidence Score (0–100) and tier, and emits a badge you embed in your README plus an auditable report.

How the rating works (hybrid)

Confidence = (0.4 · Transparency + 0.6 · Evidence) · ConsistencyMultiplier

• Transparency — how completely and honestly the manifest is filled out.
• Evidence — machine-verified repo health signals.
• Consistency — a multiplier that penalizes over-claiming (saying "security reviewed" with no proof) and rewards corroboration. Honestly disclosing a limitation is never penalized — that is the mechanic that lets creators stay credible while being open.

| Score | Tier | Meaning | |-------|------|---------| | 85–100 | 🟢 Gold | High confidence | | 65–84 | 🔵 Silver | Solid | | 45–64 | 🟠 Bronze | Developing | | 0–44 | ⚪ Unverified | Early / unproven |

Use it in any repo

Once published to npm, run it with no install from inside any project:

npx checkvibe scan      # compute the Confidence Score for the current repo
npx checkvibe init      # interactively scaffold .vibe.yaml
npx checkvibe badge     # write badge.svg + report.md

From this source checkout (before publishing)

npm install
npm run build

# option A — make `checkvibe` available globally, then run it in any repo:
npm link
cd ../some-other-repo && checkvibe scan

# option B — run without installing globally:
npm pack                              # produces checkvibe-0.1.0.tgz
cd ../some-other-repo
npx /path/to/checkvibe-0.1.0.tgz scan

# option C — run straight from the build output:
node /path/to/checkvibe/dist/index.js scan

During development, npm run dev -- <command> runs the TypeScript directly via tsx.

Useful flags: --json (machine-readable output for validate/scan), --offline (skip the network-dependent npm audit check), and --out / --report (badge/report output paths).

This repo tags itself: the badge at the top is generated by running vibecheck badge on this project, and links to its own report.md.

Layout

| Path | What | |------|------| | spec/00-overview.md | The model and principles | | spec/manifest.md | The .vibe.yaml format (VTS v0.1) | | spec/scoring.md | The scoring rubric and formula | | spec/trust-model.md | Anti-gaming and what the score means | | spec/badge.md | The badge spec | | schema/vibe.schema.json | JSON Schema for the manifest | | examples/.vibe.yaml | A worked example | | src/ | The vibecheck CLI (TypeScript/Node) |

Next on the roadmap: a test suite, a hosted badge endpoint, signed attestations, and a GitHub Action.