Vibescout — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Vibescout (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A high-performance Model Context Protocol (MCP) server and Web Dashboard for local semantic code search and AI-powered assistance. VibeScout transforms your codebase into a searchable, chat-ready knowledge base using local or cloud-based AI providers.
/src/plugins/<name>/<version>/ for built-in plugins.| Provider | Type | Description |
|---|---|---|
| Local | Built-in | Transformers.js (BGE, MiniLM). High-speed, zero config. |
| Ollama | Local API | Full support for local models like Llama 3, Mistral, and Nomic. |
| Z.AI | Cloud | BigModel.cn integration. Supports GLM-4 and dedicated Coding Plans. |
| Bedrock | Cloud | AWS Bedrock (Claude 3, Titan). Supports AWS Profiles. |
| Gemini | Cloud | Google Generative AI (1.5 Flash/Pro) and specialized embeddings. |
| OpenAI | Cloud | Standard OpenAI API or compatible (DeepSeek, Groq, etc). |
| Cloudflare | Cloud | Workers AI & Vectorize integration for cloud-native indexing. |
| LM Studio | Local API | OpenAI-compatible local server preset. |
VibeScout features a powerful plugin system for extending functionality:
/src/plugins/<name>/<version>/)vibescout plugin install <name>~/.vibescout/plugins/# List plugins
vibescout plugin list
# Install from npm
vibescout plugin install vibescout-plugin-nextjs
# Install specific version
vibescout plugin install vibescout-plugin-nextjs@beta
# Uninstall
vibescout plugin uninstall vibescout-plugin-nextjs
# Enable/Disable (via Web UI or config.json)
# Plugins are stored in ~/.vibescout/config.jsonSee /docs/ directory for:
plugin-guide.md - Getting startedplugin-api.md - API referenceplugin-architecture.md - Design patternsplugin-example.md - Complete exampletwo-phase-search.md - Two-phase search with token count previewprofiling-guide.md - Performance profiling and optimizationnpm install -g @sevenseconds/vibescoutLaunch the interactive dashboard:
vibescout uiControl terminal output verbosity:
# Default is INFO (concise)
vibescout ui --log-level warn
# Full debug output (alias for --log-level debug)
vibescout ui --verbose# Index a project manually
vibescout index ./my-app "My Project"
# Semantic search via terminal
vibescout search "how does the auth flow work?"
# Reset the database (clear all data)
vibescout reset
# Or via npm
npm run reset-dbWhen using VibeScout with Claude Desktop, Cursor, or other MCP clients, you can preview search results before consuming tokens:
Phase 1: Preview Token Count
{
"name": "search_code",
"arguments": {
"query": "authentication flow",
"limit": 20,
"previewOnly": true
}
}This returns metadata without actual code:
Phase 2: Fetch Results (if tokens are acceptable)
{
"name": "search_code",
"arguments": {
"query": "authentication flow",
"limit": 10,
"previewOnly": false
}
}Benefits:
limit parameter based on previewpreviewOnly for existing behavior# Profile with 100% sampling (most detailed)
vibescout --profile index ./my-app "My Project"
# Profile with 10% sampling (lower overhead)
vibescout --profile --profile-sampling 0.1 search "authentication"
# Dedicated profiling command
vibescout profile index --folder ./my-app --sampling 1.0
# View traces in chrome://tracing
# Traces saved to ~/.vibescout/profiles/Profiling Features:
See [`docs/profiling-guide.md`](docs/profiling-guide.md) for detailed documentation.
To use VibeScout in a restricted environment without internet access:
--offline flag.--models-path <path> if your models are stored in a non-standard directory.When enabled, VibeScout sets allowRemoteModels: false and disables all attempts to connect to the Hugging Face Hub.
Add VibeScout to your configuration:
{
"mcpServers": {
"vibescout": {
"command": "vibescout",
"args": ["--mcp", "stdio"]
}
}
}MIT License. See LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.