https://github.com/sumant1122/vigil
A universal supply chain health dashboard for Rust, Go, NPM, and Python. Monitor vulnerabilities (OSV), maintenance metrics, and dependency bloat directly from your terminal.
https://github.com/sumant1122/vigil
cli depedency-management devsecops health-check osv ratatui rust securty-tools static-analysis supply-chain-security terminal-ui vulnerability-scanner
Last synced: about 2 months ago
JSON representation
A universal supply chain health dashboard for Rust, Go, NPM, and Python. Monitor vulnerabilities (OSV), maintenance metrics, and dependency bloat directly from your terminal.
- Host: GitHub
- URL: https://github.com/sumant1122/vigil
- Owner: sumant1122
- License: mit
- Created: 2026-05-14T16:24:14.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2026-05-14T18:15:12.000Z (3 months ago)
- Last Synced: 2026-05-14T18:39:05.997Z (3 months ago)
- Topics: cli, depedency-management, devsecops, health-check, osv, ratatui, rust, securty-tools, static-analysis, supply-chain-security, terminal-ui, vulnerability-scanner
- Language: Rust
- Homepage:
- Size: 32.2 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
README
# 👁️ Vigil
**The Universal Supply Chain Health Dashboard.**
> "Is your dependency tree a house of cards? Find out before it collapses."
**Vigil** is a high-fidelity terminal UI (TUI) that gives you an instant, holistic view of your project's supply chain risk. It doesn't just find vulnerabilities; it measures the **vitality** of your dependencies.
---
## ✨ Features
- **🌍 Universal Support**: Analyze Rust (`Cargo.lock`), Node.js (`package-lock.json`), Python (`requirements.txt`, `uv.lock`), and Go (`go.mod`) in one tool.
- **⚡ Blazing Fast**:
- **OSV Batching**: One single network request to check your entire dependency tree for security vulnerabilities.
- **Persistent Cache**: Subsequent runs are near-instant thanks to a local cache (`~/.cache/vigil`).
- **🩺 Vitality Scoring**: Goes beyond CVEs. Vigil measures maintenance health:
- **Bloat Index**: Visualize the transitive weight of your dependencies.
- **Staleness**: Real-time "heartbeat" monitoring via crates.io, npm, and PyPI registries.
- **Severity-Weighted Security**: Security scores now weigh severity (Critical/High/Low) into the composite health.
- **🛡️ Security First**: Direct, high-speed integration with **OSV.dev** (Open Source Vulnerabilities).
- **📊 Gorgeous TUI**: A premium dashboard with a summary stats bar and a dual-pane drill-down view.
- **🔍 Real-Time Search**: Press `/` inside the TUI to filter the dependency inventory instantly by name.
- **🚀 Zero Config**: Run `vigil` in any repo, and it automatically detects your stack.
---
## 🚀 Installation
### From Source
Ensure you have Rust and Cargo installed, then run:
```bash
git clone https://github.com/sumant1122/vigil.git
cd vigil
cargo install --path .
```
---
## ⚡ Usage
Vigil is designed to be **Zero-Config**. Just navigate to your project's root and run:
```bash
vigil
```
### Advanced Usage
Analyze a specific project directory:
```bash
vigil --path /path/to/your/project
```
---
## 🏗️ Architecture
Vigil is structured as both a library and a binary target:
- **`src/lib.rs`**: Exports all core logic (`models`, `scanners`, `sources`, `ui`) as a reusable library.
- **`src/main.rs`**: A thin binary wrapper that initializes the terminal application and invokes the CLI engine.
- **`tests/`**: Dedicated integration tests that verify the behavior of public APIs (like cache storage and multi-ecosystem lockfile scanning) from an external integration context.
---
## 🧪 Testing
Vigil includes a robust suite of unit and integration tests covering the ecosystem scanners, cache managers, and API deserialization layers.
To run the entire test suite:
```bash
cargo test
```
---
## 💡 How to Read the Dashboard
When you run Vigil, it scans your lockfiles and presents an interactive dual-pane dashboard:
### 1. The Inventory (Left Pane)
- **Dependency**: The name of the package/crate.
- **Version**: The specific version currently locked in your project.
- **Score**: A composite health score (0-100).
- **Green (80-100)**: Healthy, active, and secure.
- **Yellow (50-79)**: Minor concerns (e.g., slightly stale or low bus factor).
- **Red (0-49)**: **Critical Risk**. Usually indicates a known security vulnerability (CVE) or an abandoned project.
### 2. The Drill-Down (Right Pane)
- **Security Status**: Real-time status from OSV database.
- **Dependency Breakdown**: Direct vs. Transitive dependency counts (The Bloat Index).
- **Maintenance Signals**: Live data from registries (Last updated date, total downloads, etc.).
- **License**: Legal status of the dependency.
---
## 🛠️ Supported Ecosystems
| Ecosystem | Detected File |
| :--- | :--- |
| **Rust** | `Cargo.lock` |
| **Node.js** | `package-lock.json` (v2+) |
| **Python** | `requirements.txt`, `uv.lock` |
| **Go** | `go.mod` |
---
## 🛠️ Why Vigil?
In **2026**, "zero vulnerabilities" is the bare minimum, not the goal. A library with no CVEs can still be a **liability** if it was last updated three years ago or is maintained by a single, overwhelmed individual.
Vigil treats your supply chain like a living organism. It monitors the **vitality** of your dependencies—staleness, bloat, and bus factor—giving you the insight to cut out dead weight before it becomes a crisis. Don't just scan for the past; audit for the future.
---
## 🤝 Contributing
We are in early development! If you want to help build the future of supply chain security, check out our [Contributing Guide](CONTRIBUTING.md).
---
## ⚖️ License
Distributed under the MIT License. See `LICENSE` for more information.