🎵 vibescore
Grade your vibe-coded project. One command. Instant letter grade.
"Vibe coding" is the new reality — you prompt, AI writes, you ship.
But is your vibe-coded project actually good?
Find out in 10 seconds.
$ vibescore .
🎵 Vibe Check v0.1.0
══════════════════════════════════════════════
Project: tokonomics
Files: 40 (32 Python, 8 other)
Lines: 4,658
Scanned in 0.12s
┌──────────────────┬────────┬───────┐
│ Category │ Score │ Grade │
├──────────────────┼────────┼───────┤
│ Code Quality │ 52.0 │ F │
│ Security │ 100.0 │ A+ │
│ Dependencies │ 98.0 │ A+ │
│ Testing │ 100.0 │ A+ │
├──────────────────┼────────┼───────┤
│ Overall │ 87.6 │ B+ │
└──────────────────┴────────┴───────┘
🟡 Warnings (11)
VC201 Function 'export_svg_chart' too long (102 lines)
VC202 Function '_build_cli' high complexity (30)
VC203 Function 'export_svg_chart' has 6 parameters (>5)
...
💡 Tips
• Reduce function complexity and add type annotations
Install
pip install vibescore
That's it. Zero dependencies. Works with Python 3.9+.
Usage
# Grade the current directory
vibescore .
# Grade a specific project
vibescore /path/to/project
# JSON output (for CI pipelines)
vibescore . --format json
# Fail CI if score is below threshold
vibescore . --min-score 70
As a Python library
from vibescore import scan
report = scan(".")
print(f"Grade: {report.overall_grade} ({report.overall_score:.0f}/100)")
for category in report.categories:
print(f" {category.name}: {category.grade}")
What It Checks
| Category | Checks | Codes |
|---|---|---|
| Code Quality | Function length, cyclomatic complexity, parameter count, type annotations, nesting depth, star imports, docstrings, mutable defaults | VC201–VC209 |
| Security | Hardcoded secrets, AWS keys, SQL injection, shell injection, unsafe deserialization, eval/exec, debug mode, private keys | VC301–VC309 |
| Dependencies | Version pinning, lock files, deprecated setup.py, wildcard pins | VC401–VC405 |
| Testing | Test file presence, test count, CI configuration, conftest.py, test-to-code ratio | VC501–VC506 |
Grading Scale
| Grade | Score | Grade | Score |
|---|---|---|---|
| A+ | 97–100 | C+ | 77–79 |
| A | 93–96 | C | 73–76 |
| A- | 90–92 | C- | 70–72 |
| B+ | 87–89 | D+ | 67–69 |
| B | 83–86 | D | 63–66 |
| B- | 80–82 | D- | 60–62 |
| F | 0–59 |
CI Integration
GitHub Actions
- name: Vibe Check
run: |
pip install vibescore
vibescore . --min-score 70
Pre-commit (manual)
# In your Makefile or CI script
vibescore . --min-score 70 --format json > vibe-report.json
Pre-commit
repos:
- repo: https://github.com/stef41/vibescore
rev: v0.1.0
hooks:
- id: vibescore
args: ["--min-score", "70"]
How Scoring Works
Each category is scored 0–100 independently. The overall score is a weighted average:
| Category | Weight |
|---|---|
| Security | 30% |
| Code Quality | 25% |
| Testing | 25% |
| Dependencies | 20% |
Security is weighted highest because a security bug in vibe-coded projects can be catastrophic.
Why vibescore?
Vibe coding means AI writes most of your code. That's fast, but it introduces risks:
- AI hallucinates long functions that are hard to debug
- AI skips security basics like input validation and secret management
- AI often omits tests or writes superficial ones
- AI uses loose dependency pins that break on updates
vibescore catches these patterns in seconds, so you can ship fast and ship safe.
FAQ
Q: Does this only work with Python?
A: Currently Python-focused for code quality and testing analysis. Security and dependency checks work with any project type. More languages coming soon.
Q: Does it phone home or require an API key?
A: No. Zero network requests. Zero dependencies. Runs entirely offline.
Q: How is this different from pylint/ruff/flake8?
A: Those are line-level linters. vibescore gives you a project-level grade across security, quality, testing, and dependencies — a holistic view of your vibe-coded project's health. Use both.
See Also
Tools in the same ecosystem:
- tokonomics — LLM token cost management
- injectionguard — Prompt injection detection
- vibesafe — AI code safety scanner
- castwright — Synthetic training data generator
- infermark — LLM inference benchmarking
License
Apache-2.0
Metadata
Release files for vibescore 0.5.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| vibescore-0.5.0.tar.gz | 48.5 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| vibescore-0.5.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 87.7 kB
Release files / vibescore-0.5.0.tar.gz
| Download URL | vibescore-0.5.0.tar.gz |
|---|---|
| Size | 48.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
c14d60f7adb0aa3cce8b613dde061483143316bc4e699cf11b17577f57773ef5
|
|
BLAKE2b-256 checksum How to use checksums |
a7f68c9cbb9438da558861ac2abd5790fdf97d0ed91773bfb5bdb6add4aa386e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.10.12
|
Release files / vibescore-0.5.0-py3-none-any.whl
| Download URL | vibescore-0.5.0-py3-none-any.whl |
|---|---|
| Size | 39.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f87a72bf3e16564015b9e33a9b953627015ae517554578a286982168734b9aeb
|
|
BLAKE2b-256 checksum How to use checksums |
afecfd085c7f3759c4d23770ece224bae83caa135a2ea85d5e147108398ce811
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.10.12
|
Security for vibescore 0.5.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.