AI wrote it. vibetrace sees what it actually does.
You're vibe coding. AI is writing your project.
It installs packages, modifies files, runs commands.
You have no idea what's actually happening.
vibetrace fixes that.
AI modifies auth.js
→ vibetrace: "3 modules affected. Risk: HIGH. Stop and review."
AI runs rm -rf node_modules
→ vibetrace: "BLOCKED. Dangerous command detected."
App crashes after AI patch
→ vibetrace: "Here's the prompt. Paste it to your AI."
AI fix → another fix → another fix → project structure collapse
Git tracks changes. SonarQube checks quality.
But nothing watches AI changes in real time and tells you when to stop.
vibetrace does.
Not for humans to read. For AI to understand.
New project:
npm install -g vibetrace
cd your-project
vibetrace init
vibetrace watch --intent="Build auth system"Existing project (3~5 years old):
npm install -g vibetrace
cd your-project
vibetrace scan # current state — health score, risk files
vibetrace hotspot # files AI should review first
vibetrace watch # start tracking from hereExisting project
↓
vibetrace scan → health score, risk files, unused deps
↓
vibetrace hotspot → files ranked by change freq + risk + deps
↓
vibetrace watch → auto diff+risk on every file change
↓
AI Intention Tracker → "fix login" but modified webpack? flagged
↓
Diff Analysis → what changed, which lines, change type
↓
Impact Graph → which modules are affected
↓
Risk Scoring → LOW / MED / HIGH
↓
Shell Wrapper → auto-intercept npm/node commands
↓
Command Guard → blocks dangerous commands
↓
Project Score → completeness / stability / AI confidence
↓
Prompt Builder → error + stack trace → AI-ready prompt
↓
Growth Tracker → AI% vs me% over time
↓
History → project evolution log
── Extension ─────────────────────────────────────
MCP Server → Claude Desktop / Cursor integration
should_proceed → agent stops when risk HIGH
vibetrace scan════════════════════════════════════════════════════
vibetrace — Project Scan
════════════════════════════════════════════════════
Files scanned : 234
Total lines : 48,291
Packages used : 87
Test files : 12
Code health : 71%
Stability : 63%
Test coverage : 22%
Dep health : 84%
⚠ unhandled promise: 47
⚠ possible null access: 31
⚠ Unused dependencies: 12
High risk files:
→ src/auth/login.js
→ src/payment/stripe.js
→ src/db/query.js
Next: vibetrace hotspot (find files to review first)
vibetrace watch (start tracking changes)
════════════════════════════════════════════════════
vibetrace hotspot══════════════════════════════════════════════════════════════════════
vibetrace — Hotspot Analysis
Files AI should review first before modifying
──────────────────────────────────────────────────────────────────────
File Changes Deps Risk
──────────────────────────────────────────────────────────────────────
src/auth/login.js 47 12 HIGH
→ authentication · changed 47x · 5 stability issues
src/api/user.js 38 9 HIGH
src/db/query.js 29 15 MED
src/middleware/auth.js 21 8 MED
══════════════════════════════════════════════════════════════════════
⚠ 2 high-risk files — review before AI modification
Next: vibetrace watch (start tracking changes)
vibetrace watch
vibetrace watch --intent="Fix login bug" [HIGH] src/auth/login.js 7 lines changed
⚠ critical: authentication
→ affects: session.js, user.js
⚠ Intent Mismatch Detected
Intent : "Fix login bug"
Modified: webpack.config.js (build config)
→ AI modified build config while intent was "Fix login bug"
vibetrace diff src/auth.js═══════════════════════════════════════════════════════════
vibetrace — AI Diff Analysis
═══════════════════════════════════════════════════════════
File: src/auth.js
Changed lines: 7
Change type: null safety fix, error handling added
~ [81] return data.profile.name
[81] return data.profile?.name
Impact:
→ src/middleware/session.js
→ src/api/user.js
AI Change Risk: HIGH
· critical path: authentication
· 3 modules affected
⚠ AI modified critical module — recommend review
═══════════════════════════════════════════════════════════
vibetrace run-cmd "npm install axios" # LOW → allowed
vibetrace run-cmd "rm -rf node_modules" # HIGH → BLOCKED
vibetrace run-cmd "git push --force" # HIGH → BLOCKED
vibetrace cmdlog # execution history
vibetrace setup-wrapper # auto-intercept npm/node ✓ npm install axios LOW
✗ rm -rf node_modules HIGH (blocked)
⚠ git reset --hard MED
vibetrace score API completeness ████████████░░░░░░░░ 75%
Architecture █████████████████░░░ 83%
Dependency health ██████████████░░░░░░ 68%
Runtime stability ████████████████░░░░ 81%
Test coverage ██████████████░░░░░░ 68%
completeness ████████████████░░░░ 79%
stability ████████████████░░░░ 74%
AI confidence ████████████████░░░░ 76%
Overall project health: 76%
vibetrace prompt─────────────────────────────────────────────────────
vibetrace — AI-Ready Prompt
Copy and paste this to your AI assistant:
─────────────────────────────────────────────────────
I encountered an error in my Node.js project.
## Environment
- Node: v20.10.0
- OS: win32
- Command: npm run dev
## Error
Module not found: Can't resolve 'core-js-pure'
## Stack Trace
at Object.<anonymous> (src/app.js:12:1)
at Module._compile (node:internal/modules/cjs/loader:1376)
## Recent AI Changes
- File: src/service.js
- Changed lines: 12
- Change type: dependency change
- Risk level: MED
## High Risk Files
- src/auth/login.js [HIGH] deps: 12
- src/api/user.js [HIGH] deps: 9
## Request
Please identify the root cause and provide the exact fix.
─────────────────────────────────────────────────────
vibetrace growth AI ████████████░░░░░░░░ 61%
Me ████████░░░░░░░░░░░░ 39%
Weekly progress
week 8 AI: 89% me: 11%
week 9 AI: 71% me: 29% ↑
week 10 AI: 61% me: 39% ↑
→ Getting there. Keep reviewing AI changes.
vibetrace mcpConnect Claude Desktop / Cursor to vibetrace:
{
"mcpServers": {
"vibetrace": {
"url": "http://localhost:3741"
}
}
}| Tool | Description |
|---|---|
analyze_diff |
Analyze AI code changes, get risk level |
should_proceed |
Returns proceed: false when risk is HIGH → agent stops |
execute_command |
Run terminal command with safety guard |
evaluate_project |
Get full project quality scores |
get_history |
Project evolution history |
get_growth |
AI vs manual code ratio |
record_step |
Add evolution step |
AI agent about to modify auth.js
→ calls should_proceed
→ { "proceed": false, "risk": "HIGH", "reason": "critical path: authentication" }
→ agent stops and asks user for confirmation
# ── Existing project (start here) ──────────────────
vibetrace scan Scan entire project — health score, risk files
vibetrace hotspot Files AI should review first (change freq + risk)
vibetrace watch Auto diff+risk on every file change
vibetrace watch --intent="Fix login" Track AI intent vs actual changes
# ── Active development ──────────────────────────────
vibetrace init Initialize tracking
vibetrace diff <file> Analyze AI changes (vs git HEAD)
vibetrace impact <file> Show affected modules
vibetrace risk Latest AI change risk
vibetrace score Project quality score
vibetrace run <cmd> Run command with runtime tracing
vibetrace step "desc" Record evolution step
vibetrace history Project evolution history
vibetrace growth AI vs manual code ratio
vibetrace prompt Generate AI-ready prompt from error
# ── Command Guard ───────────────────────────────────
vibetrace run-cmd "<cmd>" Run command with AI guard
vibetrace cmdlog Command execution history
vibetrace setup-wrapper Auto-intercept npm/node (shell PATH)
# ── Extension ───────────────────────────────────────
vibetrace mcp [--port=3741] Start MCP server for AI agent integration
# Global flags
--json Machine-readable JSON output (AI-friendly)
--quiet, -q Errors only
--verbose Full internal logs{
"devDependencies": {
"vibetrace": "^0.1.0"
},
"scripts": {
"scan": "vibetrace scan",
"hotspot": "vibetrace hotspot",
"watch": "vibetrace watch",
"trace": "vibetrace score",
"prompt": "vibetrace prompt",
"growth": "vibetrace growth",
"guard": "vibetrace cmdlog"
}
}AI will automatically use these when verifying the project:
AI: "Let me check the project health"
→ npm run scan
→ reads output
→ fixes issues
→ npm run trace
→ "stability improved to 84%"
vibetrace works standalone. With dryinstall (npm), you get full coverage:
dryinstall → install-time: blocks malicious packages
vibetrace → runtime: traces what code actually does + AI change control
npm install -g dryinstall vibetrace
dryinstall install <pkg> # secure install
vibetrace diff src/app.js # analyze what AI changed| Version | What changed |
|---|---|
| v0.1.0 | Initial release — scan, hotspot, watch, diff tracker, command guard, shell wrapper, growth tracker, MCP server, project score, AI-ready prompt, intent mismatch detection |
Cognitive Injection — A new npm attack vector targeting AI agents via stdout. Bypasses all static security scanners.
MIT