viberaven-core-0c7dfd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited viberaven-core-0c7dfd (Rules) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="./assets/viberaven-mascot.png" width="112" alt="VibeRaven mascot logo" /> </p>
AI got your app to demo. VibeRaven gets it to production.
VibeRaven Studio is the open-source local workspace for production-aware AI coding: chat with your connected CLI, attach provider and release context, inspect diffs, and verify launch readiness without leaving localhost.
VibeRaven is a local launch-control workspace for AI-built apps. It gives vibe coders and coding agents one place to review launch blockers, connect coding CLIs, attach provider and release context to chat, inspect production evidence, and keep the release gate visible before anyone says "ship it."
VibeRaven Project Mission Control localhost UI
The localhost console is designed around the work that usually gets missed between demo and production:
.viberaven/prp.json, .viberaven/gate-result.json, and supporting evidence files.VibeRaven runs the VibeRaven Production Protocol through a local-first open-source CLI/UI. The local console opens a localhost launch workspace; agent mode writes .viberaven/prp.json, .viberaven/gate-result.json, and supporting protocol artifacts so AI coding agents can keep operating until decision.status is not blocked and the gate is clear or a provider/user blocker remains.
Current npm live release: [email protected], @viberaven/[email protected], and @viberaven/[email protected].
If this repo helps, star it so other AI app builders can find the gate. Use Watch -> Custom -> Releases if you want release notifications. Shipping with VibeRaven? Add the README badge snippet so your repo links back to the launch gate.
VibeRaven public repo is the agent discovery and installation surface. Product source code and service internals live in a private repository.
VibeRaven looks for repo evidence that an AI coding agent can actually inspect before it claims an app is production-ready:
Authentication required after deploy, 401 Unauthorized after successful login, or auth cookies are set but not recognized.preflight request does not have HTTP ok status on preview or Vercel deployment protection breaks preflight.Sentry SDK is not sending any data, events not appearing in my project, or recordings are not being captured.Example scan output · Redacted launch-gap case study · Roadmap · Support · Contributing · What the gate checks · Full agent reference

What did your AI-built app miss before deploy? Add it to the feedback discussion or open a focused issue:
Repositories: Public discovery -> ohad6k/VibeRaven (this repo). Private product development -> ohad6k/viberaven-dev (not public).
The local-first boundary matters: the open-source local CLI/UI does not require login and does not use Ohad's OpenAI API key.
Open the local launch console:
npx -y viberavenExplicit UI and gate commands:
npx -y viberaven ui .
npx -y viberaven --agent-mode .
npx -y viberaven --verify .Make Codex, Claude Code, Cursor, Copilot, and Gemini use VibeRaven before deploy:
npx -y viberaven init --agents all
npx -y viberaven doctor --agentsPreview without writing files:
npx -y viberaven init --agents all --dry-runThis installs bounded rules (<!-- VIBERAVEN:START --> ... <!-- VIBERAVEN:END -->) into:
AGENTS.md, CLAUDE.md, GEMINI.md.cursor/rules/viberaven-core.mdc (+ scoped Supabase, deploy, payments rules).github/copilot-instructions.md.viberaven/agent-context.md, .viberaven/mission-map.mdnpx -y viberaven --agent-mode .Non-interactive production gate for agents and CI.
Read .viberaven/prp.json first, then .viberaven/gate-result.json and .viberaven/context-map.json. Apply safe repo-code fixes directly when VibeRaven provides a supported heal or MCP action. Respect batchSize, verify once per batch, and do not claim production-ready while decision.status is blocked or gate.status is not clear.
Then:
npx -y viberaven --verify .
npx -y viberaven --strictFor Vercel + Supabase local evidence:
npx -y viberaven audit --vercel-supabaseMCP tools include viberaven_prp_current, viberaven_prp_findings, viberaven_prp_next_action, viberaven_check_readiness, viberaven_heal_apply, and viberaven_verify. MCP resources include prp://current, prp://findings, prp://next-actions, prp://mission-map, and prp://context-map.
Do not stop at "scan complete." The loop is done when decision.status !== "blocked" and gate.status === "clear", or a provider/user blocker remains.
Normal git push is not gated. VibeRaven gate language is about launch/deploy-readiness claims, not ordinary pushes.
This repo includes skills.sh.json and the viberaven skill.
npx -y skills add ohad6k/VibeRaven --skill viberavenexamples/nextjs-supabase-vercel-production-ready-template - agent rules and viberaven:* scripts for Next.js + Supabase + Vercel.
.viberaven/prp.json?nextActionsVibeRaven is listed in the MCP registry for agents that prefer tools over raw terminal commands.
{ "viberaven": { "command": "npx", "args": ["-y", "viberaven", "--mcp"] } }Prefer viberaven_prp_current or prp://current when MCP is available; use viberaven_validate_npm_package before adding npm dependencies.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.