{"id":51029272,"url":"https://github.com/sumant1122/vigil","last_synced_at":"2026-06-21T22:30:59.505Z","repository":{"id":357884275,"uuid":"1238971483","full_name":"sumant1122/vigil","owner":"sumant1122","description":"A universal supply chain health dashboard for Rust, Go, NPM, and Python. Monitor vulnerabilities (OSV), maintenance metrics, and dependency bloat directly from your terminal.","archived":false,"fork":false,"pushed_at":"2026-05-14T18:15:12.000Z","size":33,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-14T18:39:05.997Z","etag":null,"topics":["cli","depedency-management","devsecops","health-check","osv","ratatui","rust","securty-tools","static-analysis","supply-chain-security","terminal-ui","vulnerability-scanner"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sumant1122.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-14T16:24:14.000Z","updated_at":"2026-05-14T18:15:10.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/sumant1122/vigil","commit_stats":null,"previous_names":["sumant1122/vigil"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/sumant1122/vigil","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sumant1122%2Fvigil","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sumant1122%2Fvigil/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sumant1122%2Fvigil/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sumant1122%2Fvigil/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sumant1122","download_url":"https://codeload.github.com/sumant1122/vigil/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sumant1122%2Fvigil/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34628453,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","depedency-management","devsecops","health-check","osv","ratatui","rust","securty-tools","static-analysis","supply-chain-security","terminal-ui","vulnerability-scanner"],"created_at":"2026-06-21T22:30:59.101Z","updated_at":"2026-06-21T22:30:59.500Z","avatar_url":"https://github.com/sumant1122.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 👁️ Vigil\n\n**The Universal Supply Chain Health Dashboard.**\n\n![Vigil TUI Screenshot](./vigilscreenshot.png)\n\n\u003e \"Is your dependency tree a house of cards? Find out before it collapses.\"\n\n**Vigil** is a high-fidelity terminal UI (TUI) that gives you an instant, holistic view of your project's supply chain risk. It doesn't just find vulnerabilities; it measures the **vitality** of your dependencies.\n\n---\n\n## ✨ Features\n\n- **🌍 Universal Support**: Analyze Rust (`Cargo.lock`), Node.js (`package-lock.json`), Python (`requirements.txt`, `uv.lock`), and Go (`go.mod`) in one tool.\n- **⚡ Blazing Fast**: \n    - **OSV Batching**: One single network request to check your entire dependency tree for security vulnerabilities.\n    - **Persistent Cache**: Subsequent runs are near-instant thanks to a local cache (`~/.cache/vigil`).\n- **🩺 Vitality Scoring**: Goes beyond CVEs. Vigil measures maintenance health:\n    - **Bloat Index**: Visualize the transitive weight of your dependencies.\n    - **Staleness**: Real-time \"heartbeat\" monitoring via crates.io, npm, and PyPI registries.\n    - **Severity-Weighted Security**: Security scores now weigh severity (Critical/High/Low) into the composite health.\n- **🛡️ Security First**: Direct, high-speed integration with **OSV.dev** (Open Source Vulnerabilities).\n- **📊 Gorgeous TUI**: A premium dashboard with a summary stats bar and a dual-pane drill-down view.\n- **🔍 Real-Time Search**: Press `/` inside the TUI to filter the dependency inventory instantly by name.\n- **🚀 Zero Config**: Run `vigil` in any repo, and it automatically detects your stack.\n\n---\n\n## 🚀 Installation\n\n### From Source\nEnsure you have Rust and Cargo installed, then run:\n\n```bash\ngit clone https://github.com/sumant1122/vigil.git\ncd vigil\ncargo install --path .\n```\n\n---\n\n## ⚡ Usage\n\nVigil is designed to be **Zero-Config**. Just navigate to your project's root and run:\n\n```bash\nvigil\n```\n\n### Advanced Usage\n\nAnalyze a specific project directory:\n```bash\nvigil --path /path/to/your/project\n```\n\n---\n\n## 🏗️ Architecture\n\nVigil is structured as both a library and a binary target:\n- **`src/lib.rs`**: Exports all core logic (`models`, `scanners`, `sources`, `ui`) as a reusable library.\n- **`src/main.rs`**: A thin binary wrapper that initializes the terminal application and invokes the CLI engine.\n- **`tests/`**: Dedicated integration tests that verify the behavior of public APIs (like cache storage and multi-ecosystem lockfile scanning) from an external integration context.\n\n---\n\n## 🧪 Testing\n\nVigil includes a robust suite of unit and integration tests covering the ecosystem scanners, cache managers, and API deserialization layers.\n\nTo run the entire test suite:\n```bash\ncargo test\n```\n\n---\n\n## 💡 How to Read the Dashboard\n\nWhen you run Vigil, it scans your lockfiles and presents an interactive dual-pane dashboard:\n\n### 1. The Inventory (Left Pane)\n- **Dependency**: The name of the package/crate.\n- **Version**: The specific version currently locked in your project.\n- **Score**: A composite health score (0-100).\n    - **Green (80-100)**: Healthy, active, and secure.\n    - **Yellow (50-79)**: Minor concerns (e.g., slightly stale or low bus factor).\n    - **Red (0-49)**: **Critical Risk**. Usually indicates a known security vulnerability (CVE) or an abandoned project.\n\n### 2. The Drill-Down (Right Pane)\n- **Security Status**: Real-time status from OSV database.\n- **Dependency Breakdown**: Direct vs. Transitive dependency counts (The Bloat Index).\n- **Maintenance Signals**: Live data from registries (Last updated date, total downloads, etc.).\n- **License**: Legal status of the dependency.\n\n---\n\n## 🛠️ Supported Ecosystems\n\n| Ecosystem | Detected File |\n| :--- | :--- |\n| **Rust** | `Cargo.lock` |\n| **Node.js** | `package-lock.json` (v2+) |\n| **Python** | `requirements.txt`, `uv.lock` |\n| **Go** | `go.mod` |\n\n---\n\n## 🛠️ Why Vigil?\n\nIn **2026**, \"zero vulnerabilities\" is the bare minimum, not the goal. A library with no CVEs can still be a **liability** if it was last updated three years ago or is maintained by a single, overwhelmed individual.\n\nVigil treats your supply chain like a living organism. It monitors the **vitality** of your dependencies—staleness, bloat, and bus factor—giving you the insight to cut out dead weight before it becomes a crisis. Don't just scan for the past; audit for the future.\n\n---\n\n## 🤝 Contributing\n\nWe are in early development! If you want to help build the future of supply chain security, check out our [Contributing Guide](CONTRIBUTING.md).\n\n---\n\n## ⚖️ License\n\nDistributed under the MIT License. See `LICENSE` for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsumant1122%2Fvigil","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsumant1122%2Fvigil","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsumant1122%2Fvigil/lists"}