Docs — VFault

Quick start

The fastest way to try VFault is the VS Code extension. It scans your code on save and underlines any hallucinated, deprecated, or verified functions inline.

1. Install the extension

Open VS Code or Cursor, then run:

ext install exceed-web-services.vfault

Or use the command palette: search for VFault in the Extensions panel and click Install.

2. Open a PHP file

Open any PHP file containing WordPress function calls. Save the file. VFault will scan it automatically and show results.

3. Read the results

Red underline means the function doesn't exist — hover for suggestions. Yellow underline means it's deprecated — hover for the replacement. Green dotted underline means it's verified. The status bar at the bottom shows a summary.

4. Use quick fixes

Click the lightbulb icon on a red-underlined function. VFault offers one-click replacements based on fuzzy matching against the real API.

CLI tool

Clone the repo and run VFault from the command line.

Install

git clone https://github.com/Digitalcdj/vfault.git
cd vfault
pip install -r requirements.txt

Verify text

python vfault.py "Use wp_register_scripts() and get_currentuserinfo()"

Look up a function

python vfault.py --lookup wp_enqueue_script

Compare parameters

python vfault.py --compare wp_enqueue_script "bool \$in_footer"

VS Code settings

Open VS Code settings (Ctrl+,) and search for "VFault" to customise.

vfault.apiUrl

API base URL. Default: https://exceedweb.pythonanywhere.com. Change this if you self-host.

vfault.verifyOnSave

Automatically verify on file save. Default: true.

vfault.enabledLanguages

Toggle verification per language. PHP, Python, JavaScript, TypeScript, Blade all enabled by default.

vfault.showVerifiedHints

Show green dotted underlines on verified functions. Default: true.

vfault.debounceMs

Delay before API call after save. Default: 500ms. Increase if on slow connection.

Commands

Press Ctrl+Shift+P and type "VFault" to see all available commands.

VFault: Verify Current File

Manually trigger verification on the active file.

VFault: Verify Selection

Verify only the highlighted code.

VFault: Look Up Function

Enter a function name to look up directly.

VFault: Clear Diagnostics

Remove all VFault underlines from the current file.

Shards

Each shard is a verification database parsed from actual source code. Shards are isolated — no cross-ecosystem collisions.

FREE

WordPress up to 7.0

4,591 functions · 2,346 hooks · 27 class methods
25,306 triples · 402 deprecated

PRO

WooCommerce up to 11.x

819 functions · 473 classes · 4,239 methods
32,451 triples · 332 deprecated · 2,533 hooks

PRO

Python 3.12 stdlib

2,386 functions · 1,617 classes · 6,590 methods
36,558 triples · 428 deprecated · 268 modules

PRO

JavaScript ES2024 + Web APIs + Node.js

540 functions · 1,225 interfaces · 10,284 methods
31,605 triples · 755 deprecated

PRO

Laravel 11.x

2,414 classes · 15,547 methods · 31 facades
41,570 triples · 52 deprecated

PRO

React + Next.js React 19 + Next.js 15

87 functions · 14 classes · 12 methods
335 triples · 17 deprecated · Hooks + DOM + Server

PRO

Django Django 6.1

994 functions · 1,357 classes · 6,020 methods
33,149 triples · Views + Models + Forms + Templates + URLs

More shards coming soon. Pro subscribers get new shards automatically.

Authentication

Free users don't need an API key — just call the endpoints directly. You get 100 requests per day, rate-limited by IP.

Pro and Team users authenticate by including an X-API-Key header with every request. You receive your API key automatically after subscribing.

Example with API key

curl -H "X-API-Key: vf_pro_a8f3k2m9x7q1p5v0b4n6c8d2e" \
  https://exceedweb.pythonanywhere.com/lookup/wp_enqueue_script

In the VS Code extension, keys will be configurable via settings once paid shards go live.

Supported languages

The VS Code extension activates automatically for these file types:

PHP	.php files — WordPress, Laravel
Python	.py files — standard library (Pro)
JavaScript	.js, .jsx files — Node, React (Pro)
TypeScript	.ts, .tsx files (Pro)
Blade	.blade.php files — Laravel templates

You can enable or disable individual languages in VS Code settings under vfault.enabledLanguages.

API reference

Base URL: https://exceedweb.pythonanywhere.com

All endpoints accept an optional X-API-Key header. Without a key, you're on the free tier (100 requests/day). Pro users include their API key for higher limits.

POST /verify

Send a block of text. VFault extracts function names and verifies each one. Optionally pass a whitelist array of namespace prefixes to skip your private/custom code.

Request

curl -X POST https://exceedweb.pythonanywhere.com/verify \
  -H "Content-Type: application/json" \
  -H "X-API-Key: vf_pro_your_key_here" \
  -d '{"text": "Use wp_enqueue_script() and wp_register_scripts()"}'

Request with whitelist

curl -X POST https://exceedweb.pythonanywhere.com/verify \
  -H "Content-Type: application/json" \
  -d '{"text": "get_my_custom_data() and wp_enqueue_script()",
       "whitelist": ["get_my_custom_"]}'

Response

{
  "summary": {
    "total_claims": 2,
    "verified": 1,
    "deprecated": 0,
    "not_found": 1,
    "unknown": 0,
    "whitelisted": 0,
    "param_issues": 0,
    "class_mismatches": 0,
    "context_issues": 0,
    "hallucination_rate": "50.0%"
  },
  "verified": [
    {"name": "wp_enqueue_script", "status": "verified", "since": "2.1.0"}
  ],
  "not_found": [
    {"name": "wp_register_scripts", "status": "not_found",
     "suggestions": ["wp_register_script", "wp_deregister_script"]}
  ],
  "unknown": [],
  "whitelisted": [],
  "param_issues": [],
  "class_mismatches": [],
  "plan": "free",
  "daily_remaining": 97
}

Unknown vs not found

VFault distinguishes between functions that should exist in a shard and don't (hallucinations) versus functions outside any shard's scope (private/custom code). Functions matching a known shard namespace (e.g. wp_, wc_, Python stdlib modules, JS built-ins) return not_found. Everything else returns unknown. Custom React hooks (e.g. useShoppingCart) are treated as unknown since custom hooks are expected. Hallucination rate only counts not_found.

Whitelist

Pass a whitelist array of namespace prefixes in your /verify request to skip your private functions. Any extracted function matching a whitelisted prefix gets whitelisted status and is excluded from verification.

Example whitelist response

{"name": "get_my_custom_data", "status": "whitelisted",
 "message": "Skipped — matches whitelist prefix 'get_my_custom_'."}

Usage context rules (third pass)

VFault checks whether verified functions are used in the correct context. For example, wp_enqueue_script should be inside an add_action('wp_enqueue_scripts') callback, wp_redirect must be followed by exit;, useEffect must not be async directly, and eval() is flagged as a security risk. 45 rules across all 7 ecosystems. Issues are flagged with a severity of warning or error in the context_issues array.

Example context issue

{
  "id": "redirect_exit",
  "function": "wp_redirect",
  "status": "context_issue",
  "severity": "error",
  "message": "wp_redirect must be followed by exit; or die; to prevent further execution."
}

Disabling rules

Pass a disable_rules array in your /verify request to skip specific context rules. You can pass function names (e.g. "eval") or stable rule IDs (e.g. "redirect_exit"). This only affects context rules. Existence checking, parameter comparison, and class/method pairing are not affected.

Request with disable_rules

curl -X POST https://exceedweb.pythonanywhere.com/verify \
  -H "Content-Type: application/json" \
  -d '{"text": "eval(user_input)",
       "disable_rules": ["eval"]}'

GET /rules

List all active context rules grouped by ecosystem, with severity and descriptions. No authentication required.

Request

curl https://exceedweb.pythonanywhere.com/rules

Response

{
  "total_rules": 45,
  "ecosystems": {
    "wordpress": [
      {"function": "wp_enqueue_script", "id": "wp_enqueue_hook",
       "severity": "warning", "rule_type": "required",
       "message": "wp_enqueue_script should be called inside an add_action('wp_enqueue_scripts', ...) callback."}
    ],
    "react": [...],
    "python": [...],
    "javascript": [...],
    "laravel": [...]
  },
  "usage": "Rules are checked automatically on /verify. To disable specific rules, pass disable_rules: [\"func_name\"] in your /verify request."
}

Parameter checking (second pass)

When your input contains function calls with PHP-style $param references, VFault automatically compares them against the stored signature. Renamed, missing, or extra parameters are flagged in the param_issues array.

Example param issue

{
  "function": "wp_enqueue_script",
  "status": "param_mismatch",
  "message": "PARAMETER MISMATCH: Missing params: $args; Extra/wrong params: $in_footer; $in_footer was renamed to $args in WP 6.3.0",
  "stored_params": "(string) $handle, (string) $src = '', ..., (array|bool) $args = array()",
  "stated_params": "$handle, $src, $deps, $ver, $in_footer",
  "param_history": [
    {"param": "$in_footer", "was": "$in_footer", "became": "$args",
     "version": "6.3.0", "type": "renamed_overloaded",
     "note": "Boolean $in_footer replaced by $args array."}
  ]
}

Class/method pairing (second pass)

When your input contains ClassName::method or ClassName->method patterns, VFault checks that the method actually belongs to the stated class. Mismatches are flagged in the class_mismatches array.

Example class mismatch

{
  "method": "get_total",
  "stated_class": "WC_Product",
  "actual_classes": ["WC_Abstract_Order", "WC_Cart"],
  "status": "class_mismatch",
  "message": "CLASS MISMATCH: WC_Product::get_total but get_total belongs to WC_Abstract_Order, WC_Cart."
}

GET /lookup/{name}

Look up a single function by name.

curl https://exceedweb.pythonanywhere.com/lookup/wp_enqueue_script

GET /search/{prefix}

Search functions by prefix. Returns up to 50 matches.

curl https://exceedweb.pythonanywhere.com/search/wp_enqueue

POST /compare_params

Compare stated parameters against the actual source.

curl -X POST https://exceedweb.pythonanywhere.com/compare_params \
  -H "Content-Type: application/json" \
  -d '{"function": "wp_enqueue_script", "stated_params": "bool $in_footer"}'

GET /usage

Check your current usage and remaining daily requests.

curl -H "X-API-Key: vf_pro_your_key_here" \
  https://exceedweb.pythonanywhere.com/usage

Response

{
  "plan": "pro",
  "daily_limit": 5000,
  "daily_used": 42,
  "daily_remaining": 4958
}

GET /health

Check API status and loaded shards.

curl https://exceedweb.pythonanywhere.com/health

GET /stats

View shard statistics — function count, hooks, class methods.

curl https://exceedweb.pythonanywhere.com/stats

Rate limits

Requests are limited per day and per minute. When you hit the limit, the API returns a 429 status code with details about your usage.

Free (no key)	100/day	15/min
Pro (1 dev)	5,000/day	60/min
Team (5 devs)	15,000/day	90/min
Business (15 devs)	50,000/day	200/min
Enterprise	100,000/day	300/min

Error responses

The API returns standard HTTP status codes. Error responses include a JSON body with details.

401 Unauthorized

Invalid or inactive API key.

{"error": "Invalid or inactive API key."}

429 Rate limit exceeded

Daily or per-minute limit reached. Includes your current plan, limit, and usage.

{
  "error": "Daily rate limit exceeded.",
  "plan": "free",
  "limit": 100,
  "used": 100,
  "upgrade_url": "https://vfault.com/#pricing"
}

400 Bad request

Missing required fields or invalid input.

{"error": "Missing 'text' field"}

413 Payload too large

Input text exceeds the 50,000 character limit.

{"error": "Input too large. Max 50000 characters."}

Self-hosting

Run VFault on your own infrastructure for unlimited requests and full control.

git clone https://github.com/Digitalcdj/vfault.git
cd vfault
pip install fastapi uvicorn
uvicorn vfault:create_app --factory --host 0.0.0.0 --port 8000

Then in VS Code settings, set vfault.apiUrl to http://localhost:8000.

Get started with VFault

Quick start

1. Install the extension

2. Open a PHP file

3. Read the results

4. Use quick fixes

CLI tool

VS Code settings

Commands

Shards

Authentication

Supported languages

API reference

Unknown vs not found

Whitelist

Usage context rules (third pass)

Disabling rules

Parameter checking (second pass)

Class/method pairing (second pass)

Rate limits

Error responses

Self-hosting