From first scan to release policy.

Installation

Vyper Guard requires Python 3.10 or newer. Install the stable package from PyPI. Add the matching Vyper compiler when compiler semantics are required.

pip install "vyper-guard[vyper]"
vyper-guard --version

First scan

Scan a contract or directory. The recommended detector profile favors rules with stronger evidence and lower expected review cost.

vyper-guard analyze contract.vy
vyper-guard analyze contracts/ --detectors recommended
vyper-guard analyze contracts/ --severity-threshold HIGH --ci

Analysis modes

source mode parses and analyzes source without requiring a matching compiler. compiler mode requires the compatible Vyper compiler and fails honestly when it cannot provide the requested semantics.

vyper-guard analyze contract.vy --semantic-mode source
vyper-guard analyze contract.vy --semantic-mode compiler

Output formats

Terminal output is intended for triage. JSON supports automation, SARIF integrates with code scanning, Markdown supports review records, and HTML creates a portable report.

vyper-guard analyze contracts/ --format json --output report.json
vyper-guard analyze contracts/ --format sarif --output report.sarif
vyper-guard analyze contracts/ --format html --output report.html

CI policy and baselines

Record existing finding fingerprints, then enforce only the difference. This keeps legacy debt visible without allowing new instances into a pull request.

vyper-guard analyze contracts/ --format json \
  --write-baseline .guardian-baseline.json

vyper-guard analyze contracts/ --ci --severity-threshold HIGH \
  --baseline-file .guardian-baseline.json

Configuration

Run vyper-guard init to create project configuration. Commit detector selection, severity policy, and semantic-mode expectations alongside the contracts.

vyper-guard init
vyper-guard detectors
vyper-guard help

Command index

Limitations

Vyper Guard is static analysis, not a security audit or proof of correctness. Results depend on compiler compatibility, detector support, contract context, and reviewed labels. Cross-contract economics and protocol invariants often require dedicated modeling and human review.