trustdb
trustdb records something you reviewed in .vulkro/trust.toml, so every Labs command trusts that exact version until it changes.
vulkro-live trustdb add express@4.18.2 --note "reviewed 2026-07-05"
vulkro-live trustdb add --ecosystem pypi flask@3.0.0
vulkro-live trustdb add --manifest ./tools.json
vulkro-live trustdb add --skill ./.claude/skills/x
vulkro-live trustdb add --memory ./MEMORY.md
vulkro-live trustdb list
vulkro-live trustdb remove <key>
vulkro-live trustdb clear
$ vulkro-live trustdb add express@4.18.2 --note "reviewed 2026-07-05"
Cleared express (npm) 4.18.2 in ./.vulkro/trust.toml
$ vulkro-live trustdb list
package npm:express express (npm) 4.18.2 # reviewed 2026-07-05
Commit .vulkro/trust.toml: your team and CI then share the same reviewed set, and adding an entry is a change a reviewer sees.
- Pinned to content. A package is trusted at one version; a manifest, skill or memory file by its content. A new version or a one-byte change is flagged again.
- Visible. Trusted items still appear in output, marked
trusted (cleared in .vulkro/trust.toml).
verify, inspect, audit, warden, skillscan, memcheck and foresee all read the store.
Flags for add
| Flag | Effect |
|---|---|
[PACKAGE] | name@version (a version is required) |
--ecosystem <ECOSYSTEM> | npm (default), pypi or crates |
--manifest <file> | An MCP tool manifest, by content |
--skill <file> | A skill, command or instruction file, by content |
--memory <file> | A memory file, by content |
--note <text> | Why you cleared it |
--dir <dir> | Project holding .vulkro/trust.toml (default: current) |
Exit codes: 0 success, 2 error. It never exits 1, and it works offline.