lv24-vigil 0.4.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +126 -36
- package/package.json +11 -12
package/README.md
CHANGED
|
@@ -1,14 +1,24 @@
|
|
|
1
|
+
|
|
2
|
+
|
|
1
3
|
# lv24-vigil
|
|
2
4
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
5
|
+
[](https://www.npmjs.com/package/lv24-vigil)
|
|
6
|
+
[](https://www.npmjs.com/package/lv24-vigil)
|
|
7
|
+
[](https://github.com/LevapVeeskela/lv24-vigil/blob/main/LICENSE)
|
|
8
|
+
[](https://github.com/LevapVeeskela/lv24-vigil/blob/main/go.mod)
|
|
9
|
+
[](https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/mcp.md)
|
|
10
|
+
|
|
11
|
+
**Vigil is a security auditor for your code that runs on your own model.** It
|
|
12
|
+
runs 163 deterministic rules over a repository, then optionally sends the minimum
|
|
13
|
+
context to the model you already pay for to triage findings, review risky code,
|
|
14
|
+
propose fixes and write a threat model. OpenAI, Anthropic, Gemini, OpenRouter,
|
|
15
|
+
Groq, DeepSeek, Mistral, xAI, OpenCode Go, Ollama, LM Studio, a local CLI or any
|
|
16
|
+
OpenAI-compatible endpoint.
|
|
7
17
|
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
18
|
+
The same binary is a CLI and a stdio MCP server for OpenCode, Claude Code, Codex
|
|
19
|
+
and Cursor. There is no Vigil account, no telemetry, no Docker for a normal scan
|
|
20
|
+
and no source file written by default. Deterministic findings never depend on an
|
|
21
|
+
LLM: a provider outage is a warning, not a failed scan.
|
|
12
22
|
|
|
13
23
|
## Install
|
|
14
24
|
|
|
@@ -17,52 +27,132 @@ npm i -g lv24-vigil
|
|
|
17
27
|
vigil version
|
|
18
28
|
```
|
|
19
29
|
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
30
|
+
Or run it without a global install:
|
|
31
|
+
|
|
32
|
+
```bash
|
|
33
|
+
npx -y lv24-vigil scan --no-llm
|
|
34
|
+
npx -y lv24-vigil mcp
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
**Package choice.** Install only `lv24-vigil`. The six platform packages
|
|
38
|
+
(`@lv24/vigil-win32-x64`, `@lv24/vigil-darwin-arm64`, `@lv24/vigil-linux-x64`,
|
|
39
|
+
…) are `optionalDependencies` selected by the launcher — never install them
|
|
40
|
+
directly. Keep optional dependencies enabled: `--no-optional` and
|
|
41
|
+
`--omit=optional` leave `vigil` without a binary. Nothing is downloaded at
|
|
42
|
+
install time and no install scripts run. Update with
|
|
43
|
+
`npm i -g lv24-vigil@latest`.
|
|
44
|
+
|
|
45
|
+
The npm package requires Node.js 18+. Without Node.js, use the Go install or a
|
|
46
|
+
standalone installer:
|
|
47
|
+
<https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/install.md>.
|
|
48
|
+
|
|
49
|
+
## 60-second quickstart
|
|
50
|
+
|
|
51
|
+
```bash
|
|
52
|
+
cd your-repo
|
|
53
|
+
|
|
54
|
+
vigil scan --no-llm # deterministic rules only: no key, no network
|
|
55
|
+
vigil scan # add LLM triage (needs a provider key)
|
|
56
|
+
vigil status # resolved provider, model, rules and last scan
|
|
57
|
+
vigil rules # the authoritative rule catalog
|
|
58
|
+
|
|
59
|
+
vigil scan --format sarif --fail-on high > vigil.sarif
|
|
60
|
+
vigil review --base origin/main --format sarif --fail-on high
|
|
61
|
+
vigil fix VGL-XXXXXXXXXX --apply # validated diff, never commits
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
Exit codes: `0` clean, `1` error, `2` findings at or above `--fail-on`.
|
|
23
65
|
|
|
24
|
-
##
|
|
66
|
+
## Before commit / before deploy
|
|
25
67
|
|
|
26
68
|
```bash
|
|
27
|
-
|
|
28
|
-
vigil
|
|
29
|
-
vigil scan . --no-llm
|
|
30
|
-
vigil scan . --format sarif --output vigil.sarif
|
|
31
|
-
vigil review --base HEAD~1 # review only changed lines
|
|
32
|
-
vigil review --diff changes.patch # review a patch file
|
|
33
|
-
vigil rules # list detection rules
|
|
34
|
-
vigil init # write a starter .vigil.yaml
|
|
69
|
+
vigil hook install # local pre-commit gate
|
|
70
|
+
vigil hook install --mode pre-push # or before push
|
|
71
|
+
vigil scan . --no-llm --fail-on high # manual gate, no key, no network
|
|
35
72
|
```
|
|
36
73
|
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
74
|
+
The hook runs a deterministic changed-files scan and is marked
|
|
75
|
+
`# managed by lv24-vigil`; `--force` backs up a foreign hook instead of
|
|
76
|
+
clobbering it. GitHub Actions, GitLab CI, SARIF and the optional pre-check are
|
|
77
|
+
documented in
|
|
78
|
+
[Before commit / before deploy](https://github.com/LevapVeeskela/lv24-vigil#before-commit--before-deploy)
|
|
79
|
+
and [docs/ci.md](https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/ci.md).
|
|
42
80
|
|
|
43
81
|
## MCP server
|
|
44
82
|
|
|
45
|
-
|
|
83
|
+
Claude Code, Claude Desktop and Cursor (`mcpServers` shape):
|
|
46
84
|
|
|
47
85
|
```json
|
|
48
86
|
{
|
|
49
87
|
"mcpServers": {
|
|
50
88
|
"vigil": {
|
|
51
|
-
"command": "
|
|
52
|
-
"args": ["mcp"]
|
|
89
|
+
"command": "npx",
|
|
90
|
+
"args": ["-y", "lv24-vigil", "mcp"]
|
|
53
91
|
}
|
|
54
92
|
}
|
|
55
93
|
}
|
|
56
94
|
```
|
|
57
95
|
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
96
|
+
OpenCode (`opencode.json`):
|
|
97
|
+
|
|
98
|
+
```json
|
|
99
|
+
{
|
|
100
|
+
"mcp": {
|
|
101
|
+
"vigil": {
|
|
102
|
+
"type": "local",
|
|
103
|
+
"command": ["npx", "-y", "lv24-vigil", "mcp"],
|
|
104
|
+
"enabled": true
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
}
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
Codex (`~/.codex/config.toml`):
|
|
111
|
+
|
|
112
|
+
```toml
|
|
113
|
+
[mcp_servers.vigil]
|
|
114
|
+
command = "npx"
|
|
115
|
+
args = ["-y", "lv24-vigil", "mcp"]
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
Claude Code one-liner: `claude mcp add vigil -- npx -y lv24-vigil mcp`.
|
|
119
|
+
|
|
120
|
+
The server exposes 11 tools (`vigil_scan`, `vigil_review`, `vigil_explain`,
|
|
121
|
+
`vigil_fix`, `vigil_threat_model`, `vigil_status`, `vigil_rules`,
|
|
122
|
+
`vigil_baseline`, `vigil_report`, `vigil_verify`, `vigil_history`), four
|
|
123
|
+
resources and three prompts. Only `vigil_fix` with `apply=true` changes source
|
|
124
|
+
files. Then ask the agent: *"Scan this repository with Vigil and explain the top
|
|
125
|
+
three findings."*
|
|
126
|
+
|
|
127
|
+
## For AI agents
|
|
128
|
+
|
|
129
|
+
```json
|
|
130
|
+
{
|
|
131
|
+
"package": "lv24-vigil",
|
|
132
|
+
"install": "npm i -g lv24-vigil",
|
|
133
|
+
"binary": "vigil",
|
|
134
|
+
"mcp": { "command": "npx", "args": ["-y", "lv24-vigil", "mcp"] },
|
|
135
|
+
"deterministic_only": "vigil scan --no-llm",
|
|
136
|
+
"json_report": "vigil scan --format json",
|
|
137
|
+
"status_json": "vigil status --json",
|
|
138
|
+
"exit_codes": { "0": "clean", "1": "error", "2": "findings at or above --fail-on" },
|
|
139
|
+
"docs_index": "https://github.com/LevapVeeskela/lv24-vigil/blob/main/llms.txt"
|
|
140
|
+
}
|
|
141
|
+
```
|
|
142
|
+
|
|
143
|
+
Use `lv24-vigil`, not the platform packages. If no model is configured,
|
|
144
|
+
`--no-llm` still runs all 163 rules. Prefer `--format json` or MCP over parsing
|
|
145
|
+
the human summary. Show a fix diff before applying it.
|
|
62
146
|
|
|
63
147
|
## Links
|
|
64
148
|
|
|
65
|
-
-
|
|
66
|
-
-
|
|
67
|
-
-
|
|
68
|
-
|
|
149
|
+
- **Source and full README:** <https://github.com/LevapVeeskela/lv24-vigil>
|
|
150
|
+
- **Docs:** <https://github.com/LevapVeeskela/lv24-vigil/tree/main/docs>
|
|
151
|
+
- **Agent index:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/llms.txt>
|
|
152
|
+
- **Install options:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/install.md>
|
|
153
|
+
- **MCP recipes:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/mcp.md>
|
|
154
|
+
- **Providers:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/docs/providers.md>
|
|
155
|
+
- **Issues:** <https://github.com/LevapVeeskela/lv24-vigil/issues>
|
|
156
|
+
- **Changelog:** <https://github.com/LevapVeeskela/lv24-vigil/blob/main/CHANGELOG.md>
|
|
157
|
+
|
|
158
|
+
Apache-2.0. No telemetry: only the model endpoint you configure is contacted.
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lv24-vigil",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"description": "Vigil
|
|
3
|
+
"version": "0.5.0",
|
|
4
|
+
"description": "Vigil — security audit for your code on your own model: 163 deterministic rules, LLM triage, fixes and an MCP server",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
@@ -13,14 +13,13 @@
|
|
|
13
13
|
},
|
|
14
14
|
"keywords": [
|
|
15
15
|
"security",
|
|
16
|
-
"audit",
|
|
17
16
|
"sast",
|
|
18
|
-
"vulnerability",
|
|
19
17
|
"mcp",
|
|
20
|
-
"model-context-protocol",
|
|
21
18
|
"ai",
|
|
19
|
+
"vulnerability-scanner",
|
|
20
|
+
"code-review",
|
|
22
21
|
"llm",
|
|
23
|
-
"
|
|
22
|
+
"go"
|
|
24
23
|
],
|
|
25
24
|
"bin": {
|
|
26
25
|
"vigil": "bin/vigil.js"
|
|
@@ -32,12 +31,12 @@
|
|
|
32
31
|
"bin"
|
|
33
32
|
],
|
|
34
33
|
"optionalDependencies": {
|
|
35
|
-
"@lv24/vigil-win32-x64": "0.
|
|
36
|
-
"@lv24/vigil-win32-arm64": "0.
|
|
37
|
-
"@lv24/vigil-darwin-x64": "0.
|
|
38
|
-
"@lv24/vigil-darwin-arm64": "0.
|
|
39
|
-
"@lv24/vigil-linux-x64": "0.
|
|
40
|
-
"@lv24/vigil-linux-arm64": "0.
|
|
34
|
+
"@lv24/vigil-win32-x64": "0.5.0",
|
|
35
|
+
"@lv24/vigil-win32-arm64": "0.5.0",
|
|
36
|
+
"@lv24/vigil-darwin-x64": "0.5.0",
|
|
37
|
+
"@lv24/vigil-darwin-arm64": "0.5.0",
|
|
38
|
+
"@lv24/vigil-linux-x64": "0.5.0",
|
|
39
|
+
"@lv24/vigil-linux-arm64": "0.5.0"
|
|
41
40
|
},
|
|
42
41
|
"publishConfig": {
|
|
43
42
|
"access": "public"
|