lv24-vigil 0.3.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +111 -36
  2. package/package.json +11 -12
package/README.md CHANGED
@@ -1,14 +1,24 @@
1
+ ![Vigil — security audit on your own model](https://raw.githubusercontent.com/LevapVeeskela/lv24-vigil/main/.github/assets/banner.svg)
2
+
1
3
  # lv24-vigil
2
4
 
3
- **Vigil** is a security auditor for your code that runs on your own model.
4
- Deterministic rules catch known patterns, an LLM you choose triages the results,
5
- and the same binary works as a CLI or as an MCP server for Claude Code, Codex
6
- and OpenCode.
5
+ [![npm](https://img.shields.io/npm/v/lv24-vigil?label=npm&color=cb3837&logo=npm)](https://www.npmjs.com/package/lv24-vigil)
6
+ [![downloads](https://img.shields.io/npm/dm/lv24-vigil?color=cb3837)](https://www.npmjs.com/package/lv24-vigil)
7
+ [![license](https://img.shields.io/badge/license-Apache--2.0-2ea44f)](https://github.com/LevapVeeskela/lv24-vigil/blob/main/LICENSE)
8
+ [![Go](https://img.shields.io/badge/Go-1.27-00ADD8?logo=go&logoColor=white)](https://github.com/LevapVeeskela/lv24-vigil/blob/main/go.mod)
9
+ [![MCP](https://img.shields.io/badge/MCP-stdio-6C5CE7)](https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/mcp.md)
10
+
11
+ **Vigil is a security auditor for your code that runs on your own model.** It
12
+ runs 163 deterministic rules over a repository, then optionally sends the minimum
13
+ context to the model you already pay for to triage findings, review risky code,
14
+ propose fixes and write a threat model. OpenAI, Anthropic, Gemini, OpenRouter,
15
+ Groq, DeepSeek, Mistral, xAI, OpenCode Go, Ollama, LM Studio, a local CLI or any
16
+ OpenAI-compatible endpoint.
7
17
 
8
- - **Source and docs:** <https://github.com/LevapVeeskela/lv24-vigil>
9
- - **License:** Apache-2.0
10
- - **No telemetry.** Only the configured LLM endpoint is contacted. There is no
11
- cloud account and no call home.
18
+ The same binary is a CLI and a stdio MCP server for OpenCode, Claude Code, Codex
19
+ and Cursor. There is no Vigil account, no telemetry, no Docker for a normal scan
20
+ and no source file written by default. Deterministic findings never depend on an
21
+ LLM: a provider outage is a warning, not a failed scan.
12
22
 
13
23
  ## Install
14
24
 
@@ -17,52 +27,117 @@ npm i -g lv24-vigil
17
27
  vigil version
18
28
  ```
19
29
 
20
- npm installs only the binary for your platform (`@lv24/vigil-<os>-<cpu>`:
21
- Windows, macOS and Linux on x64 and arm64). Nothing is downloaded at install
22
- time and no install scripts run. Update with `npm i -g lv24-vigil@latest`.
30
+ Or run it without a global install:
31
+
32
+ ```bash
33
+ npx -y lv24-vigil scan --no-llm
34
+ npx -y lv24-vigil mcp
35
+ ```
36
+
37
+ **Package choice.** Install only `lv24-vigil`. The six platform packages
38
+ (`@lv24/vigil-win32-x64`, `@lv24/vigil-darwin-arm64`, `@lv24/vigil-linux-x64`,
39
+ …) are `optionalDependencies` selected by the launcher — never install them
40
+ directly. Keep optional dependencies enabled: `--no-optional` and
41
+ `--omit=optional` leave `vigil` without a binary. Nothing is downloaded at
42
+ install time and no install scripts run. Update with
43
+ `npm i -g lv24-vigil@latest`.
23
44
 
24
- ## Quick start
45
+ The npm package requires Node.js 18+. Without Node.js, use the Go install or a
46
+ standalone installer:
47
+ <https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/install.md>.
48
+
49
+ ## 60-second quickstart
25
50
 
26
51
  ```bash
27
- cd ~/src/my-app
28
- vigil scan . # deterministic rules + LLM triage
29
- vigil scan . --no-llm # rules only, no model needed
30
- vigil scan . --format sarif --output vigil.sarif
31
- vigil review --base HEAD~1 # review only changed lines
32
- vigil review --diff changes.patch # review a patch file
33
- vigil rules # list detection rules
34
- vigil init # write a starter .vigil.yaml
52
+ cd your-repo
53
+
54
+ vigil scan --no-llm # deterministic rules only: no key, no network
55
+ vigil scan # add LLM triage (needs a provider key)
56
+ vigil status # resolved provider, model, rules and last scan
57
+ vigil rules # the authoritative rule catalog
58
+
59
+ vigil scan --format sarif --fail-on high > vigil.sarif
60
+ vigil review --base origin/main --format sarif --fail-on high
61
+ vigil fix VGL-XXXXXXXXXX --apply # validated diff, never commits
35
62
  ```
36
63
 
37
- Configure the model with environment variables (for example
38
- `VIGIL_PROVIDER`, `VIGIL_MODEL`, `VIGIL_API_KEY`, `VIGIL_BASE_URL`) or with
39
- provider/model in `.vigil.yaml`. Keys and `base_url` stay in the environment or
40
- the user config; a project file may not contain them. `OLLAMA_HOST` points Vigil
41
- at a local model. Secrets are masked in every output.
64
+ Exit codes: `0` clean, `1` error, `2` findings at or above `--fail-on`.
42
65
 
43
66
  ## MCP server
44
67
 
45
- Vigil speaks MCP over stdio:
68
+ Claude Code, Claude Desktop and Cursor (`mcpServers` shape):
46
69
 
47
70
  ```json
48
71
  {
49
72
  "mcpServers": {
50
73
  "vigil": {
51
- "command": "vigil",
52
- "args": ["mcp"]
74
+ "command": "npx",
75
+ "args": ["-y", "lv24-vigil", "mcp"]
76
+ }
77
+ }
78
+ }
79
+ ```
80
+
81
+ OpenCode (`opencode.json`):
82
+
83
+ ```json
84
+ {
85
+ "mcp": {
86
+ "vigil": {
87
+ "type": "local",
88
+ "command": ["npx", "-y", "lv24-vigil", "mcp"],
89
+ "enabled": true
53
90
  }
54
91
  }
55
92
  }
56
93
  ```
57
94
 
58
- That `mcpServers` shape fits Claude Code/Desktop and Cursor. Codex uses
59
- `~/.codex/config.toml` and OpenCode uses an `mcp` block; see the main README for
60
- both. Then ask the agent to scan a repository, explain a finding or propose a
61
- fix. Deterministic findings are never blocked by an LLM outage.
95
+ Codex (`~/.codex/config.toml`):
96
+
97
+ ```toml
98
+ [mcp_servers.vigil]
99
+ command = "npx"
100
+ args = ["-y", "lv24-vigil", "mcp"]
101
+ ```
102
+
103
+ Claude Code one-liner: `claude mcp add vigil -- npx -y lv24-vigil mcp`.
104
+
105
+ The server exposes 11 tools (`vigil_scan`, `vigil_review`, `vigil_explain`,
106
+ `vigil_fix`, `vigil_threat_model`, `vigil_status`, `vigil_rules`,
107
+ `vigil_baseline`, `vigil_report`, `vigil_verify`, `vigil_history`), four
108
+ resources and three prompts. Only `vigil_fix` with `apply=true` changes source
109
+ files. Then ask the agent: *"Scan this repository with Vigil and explain the top
110
+ three findings."*
111
+
112
+ ## For AI agents
113
+
114
+ ```json
115
+ {
116
+ "package": "lv24-vigil",
117
+ "install": "npm i -g lv24-vigil",
118
+ "binary": "vigil",
119
+ "mcp": { "command": "npx", "args": ["-y", "lv24-vigil", "mcp"] },
120
+ "deterministic_only": "vigil scan --no-llm",
121
+ "json_report": "vigil scan --format json",
122
+ "status_json": "vigil status --json",
123
+ "exit_codes": { "0": "clean", "1": "error", "2": "findings at or above --fail-on" },
124
+ "docs_index": "https://github.com/LevapVeeskela/lv24-vigil/blob/main/llms.txt"
125
+ }
126
+ ```
127
+
128
+ Use `lv24-vigil`, not the platform packages. If no model is configured,
129
+ `--no-llm` still runs all 163 rules. Prefer `--format json` or MCP over parsing
130
+ the human summary. Show a fix diff before applying it.
62
131
 
63
132
  ## Links
64
133
 
65
- - Repository: <https://github.com/LevapVeeskela/lv24-vigil>
66
- - Issues: <https://github.com/LevapVeeskela/lv24-vigil/issues>
67
- - Standalone installers (no Node.js required) live in
68
- [`installers/`](https://github.com/LevapVeeskela/lv24-vigil/tree/main/installers).
134
+ - **Source and full README:** <https://github.com/LevapVeeskela/lv24-vigil>
135
+ - **Docs:** <https://github.com/LevapVeeskela/lv24-vigil/tree/main/docs>
136
+ - **Agent index:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/llms.txt>
137
+ - **Install options:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/install.md>
138
+ - **MCP recipes:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/mcp.md>
139
+ - **Providers:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/providers.md>
140
+ - **Issues:** <https://github.com/LevapVeeskela/lv24-vigil/issues>
141
+ - **Changelog:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/CHANGELOG.md>
142
+
143
+ Apache-2.0. No telemetry: only the model endpoint you configure is contacted.
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "lv24-vigil",
3
- "version": "0.3.0",
4
- "description": "Vigil: security audit for your code, on your own model — deterministic rules plus LLM triage, CLI and MCP server",
3
+ "version": "0.4.1",
4
+ "description": "Vigil — security audit for your code on your own model: 163 deterministic rules, LLM triage, fixes and an MCP server",
5
5
  "license": "Apache-2.0",
6
6
  "repository": {
7
7
  "type": "git",
@@ -13,14 +13,13 @@
13
13
  },
14
14
  "keywords": [
15
15
  "security",
16
- "audit",
17
16
  "sast",
18
- "vulnerability",
19
17
  "mcp",
20
- "model-context-protocol",
21
18
  "ai",
19
+ "vulnerability-scanner",
20
+ "code-review",
22
21
  "llm",
23
- "cli"
22
+ "go"
24
23
  ],
25
24
  "bin": {
26
25
  "vigil": "bin/vigil.js"
@@ -32,12 +31,12 @@
32
31
  "bin"
33
32
  ],
34
33
  "optionalDependencies": {
35
- "@lv24/vigil-win32-x64": "0.3.0",
36
- "@lv24/vigil-win32-arm64": "0.3.0",
37
- "@lv24/vigil-darwin-x64": "0.3.0",
38
- "@lv24/vigil-darwin-arm64": "0.3.0",
39
- "@lv24/vigil-linux-x64": "0.3.0",
40
- "@lv24/vigil-linux-arm64": "0.3.0"
34
+ "@lv24/vigil-win32-x64": "0.4.1",
35
+ "@lv24/vigil-win32-arm64": "0.4.1",
36
+ "@lv24/vigil-darwin-x64": "0.4.1",
37
+ "@lv24/vigil-darwin-arm64": "0.4.1",
38
+ "@lv24/vigil-linux-x64": "0.4.1",
39
+ "@lv24/vigil-linux-arm64": "0.4.1"
41
40
  },
42
41
  "publishConfig": {
43
42
  "access": "public"