@vibgrate/cli 2026.717.1 → 2026.720.1

package/DOCS.md

@@ -874,6 +874,8 @@ vg serve
 
 Via stdio (default), your AI assistant spawns the server. Via `--http`, it runs as a local HTTP endpoint for browser or shared access.
 
+**A live status display shows what the server is doing for you.** While `vg serve` runs in a terminal, a status block on stderr updates in place: uptime, which AI clients are connected (detected from the MCP handshake), calls and average response time per tool, and — for the navigation tools with a grep/read baseline — the context tokens served vs the estimated tokens a grep-and-read agent would have burned instead, with the estimated saving labelled as such. Outside a terminal (when your assistant spawns the server) it degrades to a quiet one-line heartbeat in the server logs every 15 minutes, and only when there has been activity. The display is in-memory only and always on — nothing is written to disk or uploaded (recording and sharing below stay opt-in) — and `--quiet` turns it off.
+
 **Usage stats — local by default, sharing is opt-in.** `--savings` records a *counts-only* ledger under `.vibgrate/` — per navigation call: which tool, how it resolved (complete/partial/miss), the vg-vs-grep token figures, whether it came over the MCP (`mcp`) or the `vg` CLI (`cli`), and a coarse client label (which AI). `vg savings` reports it locally; nothing leaves your machine. `--share-stats` additionally uploads that same counts-only ledger to Vibgrate periodically, so we can see how the local MCP is used and improve it. It **never** sends code, file paths, question text, repo identity, or any credential — only counts, outcomes, token figures, the vg version, your OS/arch, and a random per-install id. It's off unless you pass the flag, is disabled entirely under `--local`, and the endpoint can be overridden with `VIBGRATE_STATS_ENDPOINT`.
 
 **Attributing CLI calls.** The MCP path detects the calling client automatically from the connection handshake. For CLI calls, pass `--client=<ai>` (e.g. `vg "how does auth work" --client=claude`) so the call is attributed in `vg savings` and any shared stats — this is what `vg install` writes into each assistant's skill. Without `--client`, a bare `vg ask` records nothing.

package/README.md

@@ -89,6 +89,32 @@ This writes the MCP config for your chosen tool(s) and installs a skill that tea
 
 Browse all 21+ supported assistants and their skill descriptions at **[vibgrate.com/skills](https://vibgrate.com/skills)**.
 
+## Tools
+
+`vg serve` exposes 19 MCP tools:
+
+- **orient** — start here: project overview, entry points, where to look first.
+- **search_symbols** — find a symbol by name or literal string.
+- **query_graph** — find code by meaning: symptoms, relationships, what-breaks-if.
+- **get_node** — inspect one symbol: signature, callers, callees, area.
+- **find_path** — shortest connection between two symbols.
+- **impact_of** — blast radius of a change: dependents, files, covering tests, risk.
+- **tests_for** — which tests cover a symbol.
+- **get_graph_summary** — code map overview: counts, languages, top areas and hubs.
+- **list_areas** — code areas (communities) by size.
+- **list_hubs** — most-depended-on symbols.
+- **get_facts** — deterministic facts for a node (contract/invariant; needs a `--deep` build).
+- **guide_node** — cited standards and practices for a node (OWASP/CWE).
+- **check_drift** — offline dependency inventory with optional git who-added attribution.
+- **vuln_attribution** — who introduced each open vulnerability, exposure windows, CRA remediation metrics.
+- **list_vulnerabilities** — known vulnerabilities from the last `vg scan --vulns`: CVE, severity, CVSS, fixed version.
+- **upgrade_impact** — what breaks if you upgrade a package: major distance, import blast radius, vulns fixed.
+- **list_models** — local models on disk (Ollama / LM Studio / gguf).
+- **resolve_library** — resolve a library to its canonical id and the version your project uses.
+- **library_docs** — version-correct usage docs for a library, sliced to a token budget.
+
+Prefer the hosted server over your team's scan data? **[Vibgrate MCP](https://vibgrate.com/mcp)** connects your assistant to Vibgrate Cloud (OAuth 2.1, 51 tools).
+
 ---
 
 ## Understand any codebase

package/dist/baseline-5QPV6API.js

@@ -0,0 +1,6 @@
+export { baselineCommand, runBaseline } from './chunk-VYSTOEAK.js';
+import './chunk-AJDUMRVI.js';
+import './chunk-RXP66R2E.js';
+import './chunk-GI6W53LM.js';
+//# sourceMappingURL=baseline-5QPV6API.js.map
+//# sourceMappingURL=baseline-5QPV6API.js.map

package/dist/{baseline-YWGSHCKW.js.map → baseline-5QPV6API.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-YWGSHCKW.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-5QPV6API.js"}

package/dist/{chunk-M62BGJMK.js → chunk-AJDUMRVI.js}

@@ -19,7 +19,7 @@ import * as zlib from 'zlib';
 import { promisify } from 'util';
 
 // src/version.ts
-var VERSION = "2026.717.1";
+var VERSION = "2026.720.1";
 var TOP_LEVEL_NODE_MODULES = /^node_modules\/((?:@[^/]+\/)?[^/]+)$/;
 function parsePackageLock(json) {
   const out = /* @__PURE__ */ new Map();
@@ -11686,5 +11686,5 @@ async function writeTextFile2(filePath, content) {
 }
 
 export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, ensureDir2 as ensureDir, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, pathExists2 as pathExists, prepareCompressedUpload, projectTypeToVulnEcosystem, readJsonFile2 as readJsonFile, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig, writeJsonFile2 as writeJsonFile, writeTextFile2 as writeTextFile };
-//# sourceMappingURL=chunk-M62BGJMK.js.map
-//# sourceMappingURL=chunk-M62BGJMK.js.map
+//# sourceMappingURL=chunk-AJDUMRVI.js.map
+//# sourceMappingURL=chunk-AJDUMRVI.js.map