@vibgrate/cli 2026.715.1 → 2026.718.2

package/DOCS.md

@@ -567,7 +567,7 @@ vg ask "<question>"
 
 A local ONNX embedding model is downloaded once on first use, then cached and fully offline. Degrades gracefully to lexical-only under `--local` or `--no-semantic`.
 
-> **Semantic search is opt-in.** The embedding backend (`fastembed`, which pulls a native ONNX runtime) is declared as an **optional dependency**: package managers install it by default, but if it's absent — e.g. you installed with `--omit=optional`, or it failed to build on your platform — `vg ask` and `vg embed` transparently fall back to lexical + structural search. Nothing else in the CLI needs it, so `vg build`, `vg show`, `vg impact`, drift reporting, and MCP serving all run without it. If you never use semantic `ask`, you can install lean: `npm i @vibgrate/cli --omit=optional`.
+> **Semantic search is opt-in.** The embedding backend (`fastembed`, which pulls a native ONNX runtime) is declared as an **optional dependency**: package managers install it by default, but if it's absent — e.g. you installed with `--omit=optional`, or it failed to build on your platform — `vg ask` and `vg embed` transparently fall back to lexical + structural search. Nothing else in the CLI needs it, so `vg build`, `vg show`, `vg impact`, drift reporting, and MCP serving all run without it. If you never use semantic `ask`, you can install lean: `npm i @vibgrate/cli --omit=optional`. A host application that bundles the CLI without optional dependencies (Vibgrate for VS Code does this) can supply the backend from its own directory by setting `VIBGRATE_EMBEDDER_PATH` to a folder whose `node_modules` contains `fastembed`; when set, that copy is used first.
 
 Before answering, `ask` checks whether files changed since the map was last built and, if so, rebuilds it incrementally first (only the changed files re-parse) — so answers always reflect the code as it is now. The check is stat-based and costs almost nothing when nothing changed; `--no-refresh` opts out.
 

package/README.md

@@ -89,6 +89,32 @@ This writes the MCP config for your chosen tool(s) and installs a skill that tea
 
 Browse all 21+ supported assistants and their skill descriptions at **[vibgrate.com/skills](https://vibgrate.com/skills)**.
 
+## Tools
+
+`vg serve` exposes 19 MCP tools:
+
+- **orient** — start here: project overview, entry points, where to look first.
+- **search_symbols** — find a symbol by name or literal string.
+- **query_graph** — find code by meaning: symptoms, relationships, what-breaks-if.
+- **get_node** — inspect one symbol: signature, callers, callees, area.
+- **find_path** — shortest connection between two symbols.
+- **impact_of** — blast radius of a change: dependents, files, covering tests, risk.
+- **tests_for** — which tests cover a symbol.
+- **get_graph_summary** — code map overview: counts, languages, top areas and hubs.
+- **list_areas** — code areas (communities) by size.
+- **list_hubs** — most-depended-on symbols.
+- **get_facts** — deterministic facts for a node (contract/invariant; needs a `--deep` build).
+- **guide_node** — cited standards and practices for a node (OWASP/CWE).
+- **check_drift** — offline dependency inventory with optional git who-added attribution.
+- **vuln_attribution** — who introduced each open vulnerability, exposure windows, CRA remediation metrics.
+- **list_vulnerabilities** — known vulnerabilities from the last `vg scan --vulns`: CVE, severity, CVSS, fixed version.
+- **upgrade_impact** — what breaks if you upgrade a package: major distance, import blast radius, vulns fixed.
+- **list_models** — local models on disk (Ollama / LM Studio / gguf).
+- **resolve_library** — resolve a library to its canonical id and the version your project uses.
+- **library_docs** — version-correct usage docs for a library, sliced to a token budget.
+
+Prefer the hosted server over your team's scan data? **[Vibgrate MCP](https://vibgrate.com/mcp)** connects your assistant to Vibgrate Cloud (OAuth 2.1, 51 tools).
+
 ---
 
 ## Understand any codebase

package/dist/baseline-DKPQWOQ6.js

@@ -0,0 +1,6 @@
+export { baselineCommand, runBaseline } from './chunk-BFXDF6ZE.js';
+import './chunk-RME7BFMU.js';
+import './chunk-RXP66R2E.js';
+import './chunk-GI6W53LM.js';
+//# sourceMappingURL=baseline-DKPQWOQ6.js.map
+//# sourceMappingURL=baseline-DKPQWOQ6.js.map

package/dist/{baseline-BTLZWSNS.js.map → baseline-DKPQWOQ6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-BTLZWSNS.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-DKPQWOQ6.js"}

package/dist/{chunk-6DKWB2OI.js → chunk-BFXDF6ZE.js}

@@ -1,4 +1,4 @@
-import { runCoreScan, writeJsonFile, compactUiPurpose } from './chunk-C5AVF7PT.js';
+import { runCoreScan, writeJsonFile, compactUiPurpose } from './chunk-RME7BFMU.js';
 import { findPackageJsonFiles, readJsonFile, findFiles, readTextFile, pathExists } from './chunk-GI6W53LM.js';
 import * as path3 from 'path';
 import { Command } from 'commander';
@@ -4355,5 +4355,5 @@ var baselineCommand = new Command("baseline").description("Create a drift baseli
 });
 
 export { baselineCommand, loadAdvancedScanHook, runBaseline };
-//# sourceMappingURL=chunk-6DKWB2OI.js.map
-//# sourceMappingURL=chunk-6DKWB2OI.js.map
+//# sourceMappingURL=chunk-BFXDF6ZE.js.map
+//# sourceMappingURL=chunk-BFXDF6ZE.js.map