Installation

Every way to install the vibeshield CLI: install script, PowerShell, npx, go install, or build from source. Plus shell completion and the doctor check.

The vibeshield binary is a single static Go build — no runtime, no dependencies, no sudo. Pick whichever install path fits your machine, then run vibeshield doctor to confirm it is wired up.

Install script (macOS & Linux)

curl -fsSL https://raw.githubusercontent.com/rajviyash9136freefr-tech/vibeshield/main/scripts/install.sh | bash

The script downloads the release asset for your OS and architecture, verifies it against the release sha256sums.txt, and installs it on your PATH.

PowerShell (Windows)

irm https://raw.githubusercontent.com/rajviyash9136freefr-tech/vibeshield/main/scripts/install.ps1 | iex

Zero-install (npx)

npx vibeshield scan .

The npm launcher downloads the matching release binary on first run into a cache directory and verifies its checksum before executing it. Set VIBESHIELD_HOME to move the cache, or VIBESHIELD_BIN=/path/to/vibeshield to use a binary you already have.

Go developers

go install github.com/rajviyash9136freefr-tech/vibeshield/scanner/cmd/vibeshield@v3.0.1

Build from source

git clone https://github.com/rajviyash9136freefr-tech/vibeshield.git
cd vibeshield/scanner
go build -o vibeshield ./cmd/vibeshield

Pure Go with CGO_ENABLED=0. It cross-compiles clean for linux, darwin and windows, on both amd64 and arm64.

Shell completion

Completion turns “which flag was it again?” into a Tab press. The scripts are generated by the binary, so they can never describe a command that no longer exists.

vibeshield completion bash   >> ~/.bashrc
vibeshield completion zsh    >  "${fpath[1]}/_vibeshield"
vibeshield completion fish   >  ~/.config/fish/completions/vibeshield.fish
vibeshield completion powershell | Out-String | Invoke-Expression

Verify the install

vibeshield version
vibeshield 3.0.1
rule packs: core 2.0.0 (MIT, 122 rules)
engine:     117 active · 5 reserved (structural — pending the package-intel model)
no code leaves this machine: static analysis only

The 117 active · 5 reserved split is deliberate and explained on the rules page.

Update

Re-run the install command for your platform. VibeShield has no self-updater on purpose: an updater is a network call and a supply-chain surface, and this tool is the one telling you to be careful about those.

Uninstall

rm "$(command -v vibeshield)"        # the binary
rm -rf ~/.cache/vibeshield           # the npx cache, if you used npx

Requirements

OSLinux, macOS, Windows (x86-64 or ARM64)
Runtimenone — a single static binary
Networknever required. The scanner is fully offline
Gitoptional; needed only for --diff, --staged and the pre-commit hook
Goonly if you build from source (1.24+)

Next steps