Skip to main content

🎵 vibescore

Grade your vibe-coded project. One command. Instant letter grade.

PyPI Downloads License Python CI Tests OpenSSF Scorecard

"Vibe coding" is the new reality — you prompt, AI writes, you ship.
But is your vibe-coded project actually good?
Find out in 10 seconds.

demo

$ vibescore .

🎵 Vibe Check  v0.1.0
══════════════════════════════════════════════

  Project:   tokonomics
  Files:     40 (32 Python, 8 other)
  Lines:     4,658
  Scanned in 0.12s

┌──────────────────┬────────┬───────┐
│ Category         │ Score  │ Grade │
├──────────────────┼────────┼───────┤
│ Code Quality     │   52.0 │ F     │
│ Security         │  100.0 │ A+    │
│ Dependencies     │   98.0 │ A+    │
│ Testing          │  100.0 │ A+    │
├──────────────────┼────────┼───────┤
│ Overall          │   87.6 │ B+    │
└──────────────────┴────────┴───────┘

🟡 Warnings (11)
  VC201  Function 'export_svg_chart' too long (102 lines)
  VC202  Function '_build_cli' high complexity (30)
  VC203  Function 'export_svg_chart' has 6 parameters (>5)
  ...

💡 Tips
  • Reduce function complexity and add type annotations

Install

pip install vibescore

That's it. Zero dependencies. Works with Python 3.9+.

Usage

# Grade the current directory
vibescore .

# Grade a specific project
vibescore /path/to/project

# JSON output (for CI pipelines)
vibescore . --format json

# Fail CI if score is below threshold
vibescore . --min-score 70

As a Python library

from vibescore import scan

report = scan(".")
print(f"Grade: {report.overall_grade} ({report.overall_score:.0f}/100)")

for category in report.categories:
    print(f"  {category.name}: {category.grade}")

What It Checks

Category Checks Codes
Code Quality Function length, cyclomatic complexity, parameter count, type annotations, nesting depth, star imports, docstrings, mutable defaults VC201–VC209
Security Hardcoded secrets, AWS keys, SQL injection, shell injection, unsafe deserialization, eval/exec, debug mode, private keys VC301–VC309
Dependencies Version pinning, lock files, deprecated setup.py, wildcard pins VC401–VC405
Testing Test file presence, test count, CI configuration, conftest.py, test-to-code ratio VC501–VC506

Grading Scale

Grade Score Grade Score
A+ 97–100 C+ 77–79
A 93–96 C 73–76
A- 90–92 C- 70–72
B+ 87–89 D+ 67–69
B 83–86 D 63–66
B- 80–82 D- 60–62
F 0–59

CI Integration

GitHub Actions

- name: Vibe Check
  run: |
    pip install vibescore
    vibescore . --min-score 70

Pre-commit (manual)

# In your Makefile or CI script
vibescore . --min-score 70 --format json > vibe-report.json

Pre-commit

repos:
  - repo: https://github.com/stef41/vibescore
    rev: v0.1.0
    hooks:
      - id: vibescore
        args: ["--min-score", "70"]

How Scoring Works

Each category is scored 0–100 independently. The overall score is a weighted average:

Category Weight
Security 30%
Code Quality 25%
Testing 25%
Dependencies 20%

Security is weighted highest because a security bug in vibe-coded projects can be catastrophic.

Why vibescore?

Vibe coding means AI writes most of your code. That's fast, but it introduces risks:

  • AI hallucinates long functions that are hard to debug
  • AI skips security basics like input validation and secret management
  • AI often omits tests or writes superficial ones
  • AI uses loose dependency pins that break on updates

vibescore catches these patterns in seconds, so you can ship fast and ship safe.

FAQ

Q: Does this only work with Python?
A: Currently Python-focused for code quality and testing analysis. Security and dependency checks work with any project type. More languages coming soon.

Q: Does it phone home or require an API key?
A: No. Zero network requests. Zero dependencies. Runs entirely offline.

Q: How is this different from pylint/ruff/flake8?
A: Those are line-level linters. vibescore gives you a project-level grade across security, quality, testing, and dependencies — a holistic view of your vibe-coded project's health. Use both.

See Also

Tools in the same ecosystem:

License

Apache-2.0

Metadata

Release files for vibescore 0.5.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for vibescore 0.5.0
File Size Uploaded Provenance
vibescore-0.5.0.tar.gz 48.5 kB Without provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for vibescore 0.5.0
File Interpreter ABI Platform
vibescore-0.5.0-py3-none-any.whl Python 3 none any Details

Total release size: 87.7 kB

Release files / vibescore-0.5.0.tar.gz

Download URL vibescore-0.5.0.tar.gz
Size 48.5 kB
Tags Source
SHA-256 checksum
How to use checksums
c14d60f7adb0aa3cce8b613dde061483143316bc4e699cf11b17577f57773ef5
BLAKE2b-256 checksum
How to use checksums
a7f68c9cbb9438da558861ac2abd5790fdf97d0ed91773bfb5bdb6add4aa386e
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.10.12

Release files / vibescore-0.5.0-py3-none-any.whl

Download URL vibescore-0.5.0-py3-none-any.whl
Size 39.2 kB
Tags Python 3
SHA-256 checksum
How to use checksums
f87a72bf3e16564015b9e33a9b953627015ae517554578a286982168734b9aeb
BLAKE2b-256 checksum
How to use checksums
afecfd085c7f3759c4d23770ece224bae83caa135a2ea85d5e147108398ce811
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.10.12

Security for vibescore 0.5.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page