A command-line tool that asks you to explain the code, packages and services in your own repo, then shows the difference between what you claimed and what you could actually produce. Other tools explain your codebase to you, which feels like understanding and is not; Vouch makes you produce the answer first. Installed as codevouch, MIT, and it never blocks you or stops you using AI.
What it’s for, in plain terms
AI writes code fast, and you merge it faster than you understand it. Vouch asks you to explain your own repo, then shows you the difference between what you thought you knew and what you could actually produce.
You are reading your own commit like a stranger wrote it. Vouch makes that gap visible while it's still cheap: it asks you the question now, in a quiet moment, instead of the incident asking it for you.
One command lists the dependencies nothing in your source imports. On a real Next.js app that was 16 packages and 10.7 MB of install weight, updates and supply-chain surface, carried for nothing.
Instead of guessing where you're weak, the map colours your own repo by what you can defend. The dark red is what someone will ask about.
A few minutes after a work session, Vouch picks the five things that landed and asks one real question about each, then tells you the answer, the install size, the licence, the known vulnerabilities and what the service costs at scale.
Getting the best out of it
- Run vouch unused on day oneTwo minutes, no setup, no AI key, no account. Deleting what you aren't using pays for the install before you learn anything.
- Be honest in vouch init, and lean towards “outsourced”Nobody needs to stay sharp on CSS scaffolding. Auth and payments are a different matter. Marking everything as important is the fastest way to abandon the tool.
- Rate your confidence before you answerThe rating is the point. The gap between what you claimed and what you produced is the only number here that's hard to argue with.
- You'll get some wrong, and that's the valueA digest where you score full marks taught you nothing. Five questions, a few misses, every couple of days.
- Check what leaves your machineNo account, no server, no telemetry. Redacted excerpts go to Anthropic through your own CLI, package names go to public registries for licence and vulnerability data, and .env files, keys and certificates are never sent. vouch purge deletes everything.
What it does
vouch unused lists what nothing in your source imports. On a real Next.js app: 16 findings, 10.7 MB installed, zero false positives.
vouch digest takes five things that landed and asks one real question each. Rate your confidence first, and find out where you were wrong about yourself.
vouch defend shows you only the filenames and asks you to reconstruct the change, then reveals the brief written when the code landed.
The Gap: how far your confidence runs ahead of what you can actually produce, per area of the repo. Watching it shrink is the whole point.
No account, no server, no telemetry. Redaction runs before every model call and the outbound host list is enforced in code. vouch purge leaves nothing behind.
Not a linter, not a code reviewer, and it never gets between you and AI. vouch unused, the map and the cards need no AI at all.
Screenshots
