How it works
Three steps, and none of them is configuration.
VibeCaddie audits the code you did not fully write. Point it at a repository, run it, and get a ranked list of what to fix before it bites you.
Point it at a repo
Read-only access to the repositories you want watched. Nothing to configure.
VibeCaddie reads your code and nothing else. It needs no write access, opens no pull requests, and changes nothing in your repository. There are no rules to write and no configuration file to maintain, because the thing that decides what to check is the agent, not a config.
The agent picks its skills
It reads the repo, works out what kind of codebase it is, and loads the review skills that matter for it.
A review skill is a narrow specialist: one that knows how session handling goes wrong, one that knows what an unverified webhook looks like. The agent reads the dependency manifest, the directory shape and the code itself, decides which specialists are relevant, and runs only those. A Stripe integration gets the webhook skill. A CLI with no network surface does not.
You get a report
Findings ranked by severity, with exact files and lines, a plain explanation, and a suggested fix.
Every finding names the file and the line, says what is wrong in a sentence, says why it matters in terms of what an attacker or an outage would actually do, and shows the change that would fix it. No severity scores without explanation, and no findings you have to research before you can act on them.
A run, in order
What the agent does between install and report.
Clean means nothing we looked for turned up. It does not mean nothing is there. The run below is the sample from the home page, shown as the sequence it actually follows.
Read. The agent walks the repository at the commit you ran against, reading source, the dependency manifest and configuration. It does not clone a permanent copy.
Detect. From what it read it works out the shape of the codebase: framework, data layer, whether money moves through it, whether it takes uploads.
Select. It loads the review skills that match. This is the step you would otherwise be doing by hand, badly, in a config file.
Audit. Each skill reviews the code it is responsible for, and findings that survive review are ranked by severity.
Report. You get the file, the line, the reason and the fix. Then you decide what is worth doing.
The loop
A loop, not a gate.
Run the audit. Fix what it found. Run it again. Each run costs the same 12 credits, so you always know what the next pass will cost before you start it.
Repeat until the report comes back clean, or until you decide the rest can wait. That call is yours.
Did you run it through a caddie?
The GitHub app is not built yet. Nothing here can be installed or bought. Leave an address and we will write when there is something to try.