Vinv

Why Vinv

84% of developers now use or plan to use AI coding tools — but more of them distrust the output (46%) than trust it (33%), and distrust nearly doubled in a year (Stack Overflow 2025, 49k developers).

The reason is familiar: the agent edits the wrong handler, invents return shapes, then grades its own homework while the server won't even start. Or it loops — test fails, agent edits the same function, test fails again — burning your context window on "let me verify."

Both failures share one root cause: the agent has never watched your code run. It argues from static text.

The industry automated writing code and left proving it entirely manual. Vinv automates the proving — and only then the finding and the fixing.

Install

Vinv works three ways — an editor extension, a CLI, or an MCP server for any agent. All three share the same local engines.

Editor extension

One click — install from vinv.ai, which opens the extension directly in your editor (VS Code, Cursor, Windsurf, VSCodium, Trae and Insiders). The listing lives on Open VSX and the VS Code Marketplace.

Or from your editor's CLI:

_{First run builds the engines — about 3 minutes, mostly compiling the Rust index; it also fetches a one-time ~100 MB local embedding model (uv and Rust required). First trace lands about a minute after that; everything after is seconds.}

CLI (Python engines)

pip install vinv          # every engine as a console script# or run one with zero install:uvx --from vinv exerciser campaign <repo> --budget 20

MCP server (any agent)

Give Claude Code, Cursor, or any MCP client Vinv's tools — one global config that finds your open workspace automatically via MCP roots.

Claude Code, Codex, Gemini CLI — installed once for every folder you open, not just the current one:

claude mcp add --scope user vinv -- npx -y vinv-mcp

codex mcp add vinv -- npx -y vinv-mcp

gemini mcp add --scope user vinv npx -- -y vinv-mcp

_{Claude Code defaults to the current directory and Gemini CLI to the current project, so both take --scope user; Codex always writes to ~/.codex/config.toml and has no scope flag.}

_{Other clients: add { "command": "npx", "args": ["-y", "vinv-mcp"] } under mcpServers.vinv. See vinv-mcp — 16 tools: semantic search, dead code, fault localization, runtime values/slices/coverage, and the verify/optimize loop.}

git clone https://github.com/VinvAI/VinvAI ~/.vinv/engines && cd ~/.vinv/engines && ./install.sh

git clone https://github.com/VinvAI/VinvAI $HOME\.vinv\engines; cd $HOME\.vinv\engines; .\install.ps1

The loop, in one picture

Run → Test → Find → Prove. Point Vinv at a Python repo; it does the rest — no code changes, no API keys.

flowchart LR  T[Trace] --> I[Index] --> S[Serve MCP] --> V[Verify] --> L[Learn] --> T

• Run — brings every service up under tracing with zero edits, capturing timings, arguments, return values and call trees from the real run.
• Test — drives real requests through every endpoint (valid, boundary, negative, authenticated) and banks each response as a regression case.
• Find — surfaces what actually broke or slowed down — server errors, crashes, latency hotspots, dead code — each tied to the exact source line.
• Prove — hands the evidence to the agent you already use, then verifies its fix against acceptance tests written before the fix that it never sees. A "faster" change that alters any output is auto-reverted.

_{Your agent is the only LLM — no new bill, no model picker, no provider keys. See the full walkthrough on vinv.ai/#under-the-hood.}

See it in action

Not a lab benchmark — real findings, filed on real projects (scikit-learn, watermarks-remover, semantica, FastAPI, Typer, smolagents), every one with an upstream thread you can open. All of it driven by Cursor running Composer 2.5 with Vinv installed — not a frontier model. The evidence did the work, not the model. The full set with screenshots: vinv.ai/#catches.

Dead code — proven by what never ran

Static tools only prove "nothing references this." Vinv proves "no capture ever executed this," carries each untraced island with the live callers that still point at it, and lets your agent return the verdict — integrate, delete, or keep.

_{semantica#1176 is the discipline in one thread: a maintainer flagged two symbols as importable downstream, Vinv restored them with deprecation warnings, and the same maintainer merged.}

Optimization — a speedup that has to prove itself

Every call is timed and charged to the symbol that spent it. A candidate fix ships only if a paired-bootstrap 95% CI clears zero and the behavior suite replays byte-identical — faster-but-different is auto-reverted.

Bug report — bugs that only exist while something runs

Scanners read source and guess. Vinv drives the service and watches what comes back:

• drive — every discovered endpoint, exercised with inputs nobody wrote.
• judge — a 500 is not a finding on its own; the oracle names the status that should have come back.
• hand over — ships as an evidence pack: repro command, caller chain, real argument values.

On fastapi/full-stack-fastapi-template (~44k★), the authenticated sweep filed discussion #2454 — four endpoints answering 500 to input that should be 4xx, one repro each — then another contributor reproduced all four against master, file-and-line: "checked against master — they're all real."

What Vinv gives your agent

One loop, grouped by what you came to fix. Each capability links to a live walkthrough on the site.

Understand the codebase → vinv.ai/#what-it-does

• Semantic code search — ask by meaning, get ranked symbols with def bodies and line numbers, embedded by a local model.
• Code Graph — a persistent map of every symbol and call edge, updated incrementally on save, with a live runtime overlay.
• Runtime tracing — zero-edit tracing: timing, memory, args, returns, errors, per call, joined to source.
• Ask Vinv — plain-English questions about your running system, every answer citing the exact trace spans and source lines, with a deterministic critic that blocks any claim the evidence can't back.

Find what actually broke → vinv.ai/#catches

• Rank suspects — on any failure, symbols ranked by fault-localization score over real pass/fail requests, with the real error messages attached.
• Behavior exerciser — Vinv doesn't wait for traffic: it drives every discovered endpoint itself, picks strategies with a Thompson-sampling bandit, and banks every response as a permanent regression case.

Clean up dead code → vinv.ai/#what-it-does

• Dead-code sections — untraced islands split into "no references" vs "reached from live code but never taken," each with the live callers that still point at it and a keep-or-cut verdict with reasoning.

Recover latency → vinv.ai/#what-it-does

• Recoverable time — latency hotspots ranked by the milliseconds you'd actually get back, each dispatched as a predicted-then-proven optimization instead of a guess.

Trust the fix → vinv.ai/#under-the-hood

• Verified fixes — replayed start, live port, acceptance tests the agent never sees. One click reverts everything an episode touched.
• Journey — one walkthrough of everything verified: every service, then every endpoint's call tree, latency flamegraph, and exact inputs → outputs, with a form to add your own test inputs that the engine replays forever.
• Auto-Pilot — one click drives discover → set up → trace → exercise → fix → verify, until green or budget; when new trace errors land, the fix episode is already dispatched by the time you see the red ring in the graph.
• Findings — issue clusters, optimization episodes with paired-bootstrap confidence intervals, regression diffs by kind, and a machine-readable findings.json your agent can consume directly.

Honest scope: Python first — services and APIs. Other languages get the index, graph and grounded Q&A, but no runtime evidence yet. TypeScript and Go are next.

Agent alone vs Agent + Vinv

Why agents can't reward-hack under Vinv

Vinv ties every runtime trace to the exact code that produced it and hands your agent a context graph built from that join — so the agent argues from evidence, not vibes. And when it claims victory, Vinv doesn't take its word:

• Acceptance tests are authored before the fix, stored outside the workspace under an opaque token, and must fail deterministically twice on the broken code — a test that passes pre-fix is thrown away.
• A "faster" fix that changes any observable output is auto-reverted — the behavior suite must replay byte-identical and the speedup's paired-bootstrap 95% CI must exclude zero.
• Deliberate 4xx rejections aren't "errors" to fix — the defect classifier knows a service saying no correctly from a service breaking, so the agent is never handed a fake goal it can only game.
• When two attempts stop making progress, a Nash-bargaining stall judge continues only if both an explorer stance and an auditor stance strictly prefer it to asking you.

Proven on itself

Vinv's release gate is Vinv — these numbers come from running the loop on this repository:

_{The full learning walk — reward, propensity, gating math, with file:line for every claim — is docs/learning.md. The test ontology is docs/testing-ontology.md.}

Works with your agent

One command (Register Vinv MCP in Agent Tools) writes the servers into every agent it detects:

The engines

pip install vinv ships every engine as a console script — or use any one standalone:

FAQ

Privacy

• Everything on your machine — per-repo state in .vinv/ (auto-gitignored), per-machine in ~/.vinv/. No account, no API keys, no telemetry — none.
• One outbound request, and you can read it: a GET of a static JSON file at notices.vinv.ai on activation, for broken-release and security notices only. No query string, no identifiers, nothing uploaded; at most once per 12 hours; disable with vinv.notices.enabled.
• The only download is the embedding model (Hugging Face, once, ~100 MB); everything else builds from this repo.
• Traces store bounded summaries, not raw values; sensitive parameter names (password, token, api_key, …) are redacted, never captured.
• The only LLM Vinv talks to is the coding-agent CLI you configured, through its own auth.

Contributing & license

See CONTRIBUTING.md — uv sync, cargo build in index/, npm install && npm run check in extension/, keep tests/e2e/planted_bug_golden/run.py green. Good first issues are labeled. By taking part you agree to our Code of Conduct; to report a vulnerability, see SECURITY.md. Apache License 2.0 © 2026 VinvAI.