VibeCop Documentation

Your codebase is
accumulating entropy.
We measure it.

Every PR gets reviewed against your codebase's established patterns — not just the diff. VibeCop catches architectural drift before it compounds into technical debt.

What VibeCop catches

AI Slop Detection — 9 static checks

Before any LLM touches your code, nine deterministic checks run across your entire repo. Fast, cheap, no false positives from hallucinated rules.

DEP SCAN

Dependency vulnerabilities — CVEs across your entire package tree, transitive included.

DEP HEALTH

Dependency health — Deprecated or unmaintained packages and weak supply-chain posture.

SECRETS

Exposed credentials — API keys, tokens, hardcoded passwords in source.

SAST

Static code patterns — Injection, XSS, path traversal and more, across 24 CWE- and OWASP-tagged rules.

IAC

Infrastructure misconfigs — Dockerfiles, Compose files, and Kubernetes manifests.

VENDORED

Vendored-code drift — Vendored copies of your own packages that no longer match the original.

MAGIC

Magic numbers — Unexplained numeric literals that should be named constants.

MIGRATIONS

Migration safety — SQL migration steps that are risky on a large table. Warns, never blocks.

ERRORS

Error handling — Empty or log-only catches and throws inside finally. Counts toward Consistency.

$ vibecop scan --quick realworld-app
↳ 62 packages · 1,240 files
 
— dep scan ————————————————
  ✗ P1 lodash@4.17.20 CVE-2021-23337
  ✗ P1 express-jwt@5.3.1 auth bypass
— secrets ——————————————————
  ⚠ P2 JWT_SECRET config.js:4 (hardcoded)
— SAST (semgrep) ———————————
  ⚠ P2 sql-concat db/queries.js:88
— IaC ——————————————————————
  ⚠ P2 root-user Dockerfile:3
 
  3 critical · 7 warnings · done in 28s

Architecture Integrity Index

A score, not a report. 0–100. Updated per PR.

Computed across four structural axes — each worth 25 points. Tracks how coherent your codebase's architecture is over time. Not a linter. A health signal.

Consistency

Similar problems solved the same way

21/25

Reuse

Logic reused, not re-implemented

18/25

Simplicity

Abstractions earning their weight

14/25

Structure

Cycles, fan-out, coupling

19/25

integrity

↑ +3 pts from last scan

Key concepts

Understanding VibeCop

Expand any concept below for a detailed explanation.

Get started

Up and running in 4 steps

1

Connect your repo

Authenticate with GitHub and select the repository you want VibeCop to analyse.

2

Confirm "Run first scan + graph?"

One prompt kicks off the first scan and graph — runnable later from Codebases if you skip it.

3

Full-repo scan

Nine static checks (eight hygiene layers plus error handling) and nine architectural detector agents run over the whole repository tarball; the detected stack card auto-advances.