vibewithai 0.1.0

AI-powered engineering assistant embedded directly in your Python projects.

vibewithai

An AI engineering assistant embedded directly in your Python project.

import vibewithai

# One call. Any keys, any order, no provider names.
vibewithai.login("sk-proj-...", "AIza...", "sk-ant-...")

result = vibewithai.check()
if not result.passed:
    for finding in result.findings_at_or_above(vibewithai.Severity.HIGH):
        print(f"{finding.location}: {finding.title}")

Static analysis runs locally first; the AI is asked only about what local tools cannot answer. Every command returns a structured result object, so the same call works in a terminal, a CI job, a notebook, or a web service.

---

Status

0.1.0 — first release. The full pipeline works end to end: project scanning, static analysis, context building, 16 AI providers with automatic failover, 19 commands, and a CLI. 799 tests, 89% coverage, mypy --strict clean.

Being a first release, the AI-backed commands have had far more automated testing than real-world mileage. Treat their output as a capable reviewer's opinion, not as ground truth — which is why every finding carries a confidence score and a source telling you whether it came from a deterministic tool or a model.

Supported providers

All 16 work with just an API key — no vendor SDKs, no extra dependencies.

Frontier	OpenAI · Anthropic Claude · Google Gemini · xAI Grok
Aggregators	OpenRouter · Together AI · Fireworks AI · Hugging Face · GitHub Models
Direct	DeepSeek · Mistral AI · Cohere · Groq · Perplexity
Enterprise	Azure OpenAI
Local	Ollama — no key required

Adding one is a single entry in providers/specs.py; see the developer guide.

Not yet supported: AWS Bedrock, Google Vertex AI and OCI Generative AI need cloud-native request signing (SigV4, service-account JWTs) rather than a bearer token. They are planned; until then, reach those models through OpenRouter or an OpenAI-compatible gateway.

Installation

pip install vibewithai

# with local static-analysis backends (ruff, bandit, radon, libcst)
pip install "vibewithai[analysis]"

Requires Python 3.11+.

Quick start

Authenticate

Pass keys positionally in any order. The provider is detected from the key itself and verified with a lightweight health check:

import vibewithai

vibewithai.login(
    "sk-proj-xxxxxxxx",  # OpenAI
    "AIzaSyxxxxxxxx",  # Google Gemini
    "xai-xxxxxxxx",  # xAI (Grok)
    "sk-ant-xxxxxxxx",  # Anthropic
)

With no arguments, login() resolves credentials from the environment and stored configuration, and falls back to a locally running Ollama if nothing else is available:

vibewithai.login()  # env vars → stored credentials → local Ollama

Or stay entirely out of the code:

export VIBEWITHAI_OPENAI_API_KEY=sk-proj-...
# conventional per-provider variables are honoured too
export ANTHROPIC_API_KEY=sk-ant-...

Analyse

result = vibewithai.review()

result.status  # Status.WARNING
result.summary  # "3 issues found across 2 files"
result.findings  # list[Finding]
result.suggestions  # list[Suggestion]
result.confidence  # 0.0 – 1.0
result.execution_time  # seconds
result.usage.total_tokens

result.to_dict()  # JSON-serialisable, safe to log

Results are iterable and truthy, so ergonomic checks read naturally:

if not vibewithai.check():
    raise SystemExit(1)

Configuration

Layered, highest precedence first:

1. Arguments passed to the call
2. VIBEWITHAI_* environment variables
3. Project config — vibewithai.toml, .vibewithai.toml, or [tool.vibewithai] in pyproject.toml
4. User config — <user config dir>/config.toml
5. Built-in defaults

# vibewithai.toml
default_provider = "openai"
offline = false
max_context_tokens = 12000

[providers.openai]
model = "gpt-4o-mini"
timeout = 60.0

[analysis]
analyzers = ["ast", "ruff", "bandit"]
blocking_severity = "high"

[cache]
enabled = true
ttl = 86400

Credentials are never read from project config files — only from the environment or the user-level credential store — so a key cannot be committed to version control by accident. See docs/configuration.md.

Safety guarantees

These are enforced in code, not merely documented:

• Nothing is written without confirmation. Commands that would modify your workspace raise ConfirmationRequiredError unless you explicitly opt in, and they snapshot the original file first.
• Generated code is never executed. Ever. It is returned to you as data.
• Writes cannot escape the project root. Every destination path is validated.
• Secrets cannot leak through logs. Secret masks itself in repr(), str(), and f-strings; a redaction filter scrubs credential-shaped text from every log record before it is emitted.
• Credential files are owner-only. 0600 on the file, 0700 on its directory, with a warning if permissions loosen.

Documentation

Guide
Installation	Supported platforms and extras
Quick start	First run, walkthrough
Configuration	Every setting and env var
Architecture	Layering and design decisions
API reference	Public surface
Developer guide	Adding providers and analyzers
Troubleshooting	Common failures and fixes
FAQ

Contributing

Contributions are welcome — see CONTRIBUTING.md and our Code of Conduct. To report a vulnerability, follow SECURITY.md rather than opening a public issue.

License

MIT