Vibgrate for VS Code

Your codebase has a number. Now it's in your editor.

Every stack drifts: runtimes reach end of life, frameworks fall majors behind, dependencies go quiet. Most teams find out during the upgrade that hurts. Vibgrate for VS Code shows you the drift as you work — a DriftScore in the status bar, computed on your machine, with per-dependency detail in your manifests. (Full feature tour.)

Install the extension, open a workspace, and the score appears. No account. No token. Nothing to configure.

One build works in VS Code, Cursor, Windsurf, and Eclipse Theia — published to both the VS Code Marketplace and Open VSX.

What is a DriftScore?

The DriftScore is a 0–100 measure of how far your stack has drifted from current, supported versions — runtimes, frameworks, and dependencies. 0 means no drift; 100 means maximum drift. Scores fall into three bands: low (0–30), moderate (31–60), and high (61–100). The methodology is published and versioned, alongside the separate RiskScore for exposure and the DriftRisk Index that combines them. The full derivation, with formulas and references, is in the risk-scoring whitepaper (DOI 10.5281/zenodo.21336304). Unfamiliar terms are defined in the glossary.

What you see

• Status bar — your workspace DriftScore, colored by band, always current.
• Inline detail — each dependency line in package.json shows how far behind it is, the latest version, and how stale it has gone. Configurable: full, compact, or off.
• Overview ruler — colored marks in the scrollbar show the whole file's drift at a glance.
• Explorer badges — each package.json / lockfile shows that package’s DriftScore (not the whole-workspace rollup), so monorepos stay readable.
• DriftScore panel — the workspace score, counts, EOL horizon, and trend.
• Dependencies panel — full per-package inventory with search, filters, version journey, lazy vulnerability checks, and Fix.
• Vulnerabilities panel — known advisories for your dependencies, ordered by severity with actively-exploited (CISA KEV) entries first, showing fixed versions and where each package is used. Reachability is reported honestly as reached, potentially reached, not observed, or unknown — and lines of your own code that reach a vulnerable package get an end-of-line marker (vibgrate.vulnInline).
• Docs panel — every markdown file in the workspace, most recently updated first, so you can see what documentation moved and what has gone stale. Sort by date or name, filter by path, click to open.
• Hovers — version currency, majors behind, package age, and license for any dependency.
• Fix… — when you decide to act, a ranked list of remediation routes (Renovate, Dependabot, OpenRewrite, and others) ordered by technical fit for your case.

All colors adapt to your theme, including light and high-contrast themes.

Local by design

• Your code stays on your machine. Drift scanning reads manifests and lockfiles only — it does not read or upload your source code. (How we handle data.)
• No account, no token. The full local DriftScore works without signing in to anything.
• The engine is bundled. The first scan works offline, with nothing to download — including on Remote-SSH, in devcontainers, and behind a corporate proxy.
• VG Code is the one part that can reach out, and only if you choose a hosted model. A local model keeps the turn on your machine; Vibgrate Relay, OpenRouter, or another hosted provider you select receives that turn's context. Drift scanning is unaffected either way. (Where your code goes.)

Quiet by design

Drift is not urgent the way a security alert is, and a tool that nags gets uninstalled. So this extension shows no toasts, no modals, and no notifications. Problems-panel diagnostics are off by default; when you turn them on, they report three hard facts only — end-of-life runtimes, unmaintained packages, and license changes — and never at Error severity. Vibgrate measures; it does not gate your work.

Works with your AI assistant

If you use an AI coding assistant — Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Copilot, Aider, Grok CLI, and others — the extension notices and wires Vibgrate AI Context into it in the background (the same setup as running vg install --all yourself): a skill, an MCP registration where the assistant supports one, and a short advisory note, so your assistant answers from your code map and real dependency versions instead of guessing. It runs once per workspace, silently, and only when an assistant is actually in use. Two settings control it: turn off vibgrate.aiContext.autoInstall to stop the automatic setup, or turn off vibgrate.aiContext.enabled to remove the wiring again (the same as running vg uninstall).

The extension also builds the local Vibgrate Graph — the code map behind the panel's Graph section — in the background. Turn it off with vibgrate.graph.enabled. Semantic search over the graph uses a small local search backend and embedding model, downloaded automatically when the extension loads (so Ask just works); turning off vibgrate.graph.semanticSearch keeps queries lexical and removes both downloads.

VG Code — a coding agent, in chat or the sidebar

Describe a change in plain language and VG Code works on it, grounded in your code map — it starts from the symbols and the source that matter for your task instead of searching the repository blind. It streams its work live, and in the default Agent mode every edit and every command waits for your approval — nothing touches your files until you say so. Switching to Auto accept is the one way past that gate, and it is your decision, not the agent's: it then approves its own edits and commands under a command denylist, default-deny outbound network, and shell isolation. It is the same agent and the same permission modes as vg code in the Vibgrate CLI.

Two places to use it

• In its own panel — VG Code installs itself into the Secondary Side Bar, docked as a tab alongside your other agent panels, with the full chat UI, a model bar, inline Approve / Reject cards, and chat history. Nothing to drag or configure. On editors without a Secondary Side Bar it falls back to a VG Code entry in the activity bar instead. This is the full experience.
• In the Chat view — type @vgcode in VS Code's Chat (the same panel as your other chat participants). A chat participant isn't its own tab — you invoke it by @-mentioning it in the chat box. Responses stream as markdown, file references are clickable, and each edit or command asks for approval before it applies. Each message is handled on its own; conversation, history, and undo live in the panel.

File and symbol references in the graph results and in VG Code's output are clickable — one click opens the file at the right line in your editor.

You decide how much it can do

A selector next to Send sets the permission mode for the next turn:

Switching modes keeps the conversation — you don't lose your session.

Undo an approved change

VG Code takes a snapshot the moment you approve a change, before it is written. Each applied change carries a Restore control that puts back only the files that change touched, for as long as that chat is open. Your branch, your staged changes, and your history are never touched, and nothing appears in git log.

Review before you approve

Approval cards show the diff inline. Review in editor opens the change in VS Code's own diff editor — syntax highlighting, folding, your keybindings — showing exactly the content that will be written. A change across several files is one decision, not a run of prompts.

Point it at the right thing

Type @ in the composer to attach context: a symbol resolved through your code map (so it knows which send you meant), a file, your current selection, the problems in your workspace, @codebase to pull matching code for the request, or @docs:<package> for version-correct documentation of a dependency you actually have installed. The file you have open shows as a chip you can toggle on, and you can attach files and images, including a pasted screenshot.

It checks its own work

When VG Code has changed files, it checks them before it finishes — including running your project's test command where one is configured. If a check fails it works from that failure to repair the change, rather than handing you a broken tree. Edits that reference symbols your codebase doesn't have are blocked before they are applied.

Continue where you left off

The panel keeps the conversation across turns, so a follow-up doesn't re-explain the task. History lists prior chats in this workspace and reopens one where it ended; New starts clean. Stop ends the current turn, not the conversation.

Answers you can read, and a cost you can see

Code in an answer is syntax-highlighted in your editor's own colours, and every block has its own Copy. Diffs carry a line-number gutter. Mermaid diagrams and TeX math render as figures — entirely offline, from renderers inside the extension; nothing is fetched, and one click shows the source behind any figure.

The context meter at the bottom of the panel opens a breakdown: tokens per turn and for the whole chat, split into input, cached input and output, with a dollar estimate whenever the model publishes a price. A model with no published price shows tokens and says so, rather than a misleading $0.00. Compact context is a button there.

Reasoning models show their thinking as a collapsed trace, kept separate from the answer, with a reasoning-effort picker where the model supports one.

Choose where the model runs

The bar at the bottom of the panel shows the current model. Click it to change how VG Code runs:

• Vibgrate Relay — hosted models on Vibgrate credit. Sign in once with your workspace DSN; there are no API keys to manage. The panel shows the catalogue with per-token prices and your credit balance.
• Code Modes — Spark, Flow, Forge — first-party model packs that run on your machine. Before anything downloads, the panel tells you whether a pack fits your RAM, VRAM, and free disk, and what it needs.
• Custom Local — models you already have in Ollama or LM Studio, with install (live progress, cancellable) and uninstall.
• OpenRouter — the live catalogue with search. Your API key is kept in VS Code's secret storage, never in settings or your project.

Local models keep inference on your machine. A hosted model — Vibgrate Relay, OpenRouter, or another provider you configure — receives the context for that request, under that provider's terms. Drift scanning is unaffected either way: it reads manifests and lockfiles locally and uploads nothing.

Guardrails, on by default

• No writes without consent in Agent and Plan mode, on either surface.
• Secret-bearing files are refused. .env files, key material, and credential stores are not read, and credential-shaped strings are masked out of any file it does read.
• Shell commands can run under isolation. Set vibgrate.code.securityTier to run them inside an OS sandbox — Seatbelt on macOS, bubblewrap on Linux, where available. Autonomous runs use it by default.
• Every run is recorded, secret-free: the task, the model, the files touched, and how it ended.

It uses the tools you already wired

VG Code reads your existing MCP server configuration — .mcp.json, .cursor/mcp.json, .vscode/mcp.json — so tools you set up for another assistant work here too. Read-only tools run freely; anything that can change something goes through the same approval gate. Your code map and library documentation are available to it as tools with no setup at all.

The same number everywhere

The extension renders scores computed by the Vibgrate CLI — the same engine that powers vg in your terminal, in CI, and in Vibgrate Cloud. The score in your editor matches the score in your CI output and on your dashboard, because it comes from the same place. To try the engine directly, run npx @vibgrate/cli scan in any repository, or point the vibgrate.cliPath setting at your own vg install. Every release ships measured benchmarks, including the token savings from giving an assistant the code map.

Settings

VG Code

Commands

• Vibgrate: Rescan Workspace
• Vibgrate: Open DriftScore Panel
• Vibgrate: Open Dependencies Panel
• Vibgrate: Open Vulnerabilities Panel
• Vibgrate: Open Code Graph Panel
• Vibgrate: Open Docs Panel
• Vibgrate: Open Evidence Panel
• Vibgrate: Open Cloud Panel
• VG Code: Open Agent Panel
• VG Code: Expand All Tool Details · VG Code: Collapse All Tool Details
• Vibgrate: Find in Code Graph
• Vibgrate: Graph Impact of Symbol
• Vibgrate: Publish Code Map to Runtime
• Vibgrate: Fix…
• Vibgrate: Show Language Server Log
• Vibgrate: Fusion Runtime (vgd) Status

Free and paid, plainly

Everything this extension shows — the DriftScore, inline detail, the panel, hovers — is free, with no account. A Vibgrate Cloud account adds score history, trends, and team rollups — see pricing, or what it looks like for teams and enterprises. Automated remediation (vg fix) is a separate paid capability; it appears in Fix… ranked on technical fit like every other route, labeled as paid, with no special placement. The score never advertises the fix.

Learn more

This extension

• Vibgrate for VS Code — the full feature tour
• Help centre · Glossary

The rest of the platform

• Vibgrate CLI — the same engine in your terminal and CI
• Vibgrate Graph — the local code map, free
• Vibgrate AI Context — version-correct library docs and your code map, served to your AI assistant (MCP directory listing)
• Vibgrate Relay — hosted models for VG Code on Vibgrate credit, with no API keys to manage
• Vibgrate Cloud — score history, trends, and team rollups (dashboard)
• Vibgrate Evidence — signed, reproducible release evidence, including for the EU CRA

How the numbers work

• DriftScore · RiskScore · DriftRisk Index
• Risk-scoring whitepaper — the published methodology, CC BY 4.0
• Public DriftRisk Index — real scans of well-known open-source repositories
• README badges — put your DriftScore on your own repo

Compared with what you already run

• vs Renovate · vs Dependabot · vs Snyk
• What "code drift intelligence" means

Also

• Marketplace · Security · Pricing · Mission
• Report an issue