FAQ and limits
VibeRaven reads files in your repository and reports what they show; it does not connect to your database, your Vercel project or any provider. These answers cover what that means in practice.
npx -y viberaven@1.7.8 checkThe check that every answer below is about. Or ask your coding agent to "run npx -y viberaven@1.7.8 check and fix what it reports".
The result
Does a clear result mean my app is ready to launch?
No. It means the repository checks found no blocker. It does not show what is live in Supabase or Vercel, and it is not a security audit. You decide when to ship.
Does it connect to my database?
No. It reads migration files. The Supabase dashboard shows which RLS policies are live. The experimental rls-test runs your migrations in a local PGlite imitation of Supabase, which is closer, but still not your database.
A finding is wrong for my app. What now?
Each finding names the file and line it read. Supabase findings apply only if the app uses Supabase. If the evidence is wrong, open an issue at github.com/ohad6k/VibeRaven with the finding id and a redacted snippet.
What is the score?
A summary of the findings, weighted by severity. The verdict line and the blockers are what to act on.
Privacy
Does my code leave my computer?
Not for the check. In the CLI's own words: "Everything runs locally against your repo. No account, no API key, no telemetry." Results go to .viberaven/ in your project.
What does the hosted MCP server see?
Only the arguments your agent sends it, such as migration SQL. It logs the tool name and the client, not the arguments or results. Redact keys before you pass anything.
Platforms
Does it work on Windows?
Yes. In PowerShell, use npx.cmd if the execution policy blocks npx.
My app does not use Vercel or Supabase. Is it useful?
Some checks, such as an unverified Stripe webhook, env var drift or a secret under a public prefix, apply to other Next.js apps too. The check is built for Vercel + Supabase, and most of its depth is there.
Which version should I run?
Pin one, as in npx -y viberaven@1.7.8 check, in CI and in scripts, so a result does not change with a release. Without a version, npx runs the latest.
Cost
Is it free?
The local check, changes, fix, init and both MCP servers are free with no account. Pro is $20 a month for app changes and full checks; see Account and Pro.
Limits
- It reads files. Provider dashboards, live databases and deployed runtimes are not checked.
- A finding is evidence in the repo, not proof that something can be exploited in production.
- No finding is not the same as no problem: the check covers the ids in the findings reference.
- It is advice, not a gate. It fails a CI step only when you add it to CI.
Next
Checked
Checked on November 3, 2026, against the published viberaven 1.7.8, with a real run on a small Next.js + Supabase + Stripe fixture repo.