Server data from the Official MCP Registry
Transparent rule-based GitHub fake-star detector — LOW/MEDIUM/HIGH with per-rule evidence.
Transparent rule-based GitHub fake-star detector — LOW/MEDIUM/HIGH with per-rule evidence.
Excellent security posture for a developer tool. The core audit.py is zero-dependency, uses only Python stdlib, and makes anonymous GitHub API calls with no credential handling. The MCP wrapper properly sandboxes tool exposure and gracefully degrades on errors. Code is transparent, well-structured, and avoids dangerous patterns. Minor quality findings do not impact overall security. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.
5 files analyzed · 8 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-armada735-fake-star-audit": {
"args": [
"fake-star-audit"
],
"command": "uvx"
}
}
}From the project's GitHub README.
A transparent, dependency-free GitHub fake-star checker. One Python file, no
token, no install — point it at a repo and get a LOW / MEDIUM / HIGH
risk verdict with every rule explained.
$ python3 audit.py --repo someowner/somerepo
🔴 someowner/somerepo — risk: HIGH
422★ / 0 forks / age 66.9h
windows: earliest=100, latest=22
axes: page1_sliding_window, sequential_id_cluster, same_second_cluster
[FLAG] page1_sliding_window earliest: BURST: 100 stars in 0.55h (~183 stars/h)
[FLAG] sequential_id_cluster earliest: 4+ time-consecutive stargazers within id range <200k
[FLAG] same_second_cluster earliest: max 4 stars within a 30s window
GitHub stars are used as a proxy for trust — by investors doing due-diligence, by engineers picking dependencies, by recruiters reading résumés. But there is a paid market for fake stars: bot accounts and "star farms" inflate a repo to look popular. (See the CMU study estimating millions of suspected fake stars.)
fake-star-audit gives you a fast, explainable gut-check: is this repo's
star count believable?
There are already excellent fake-star tools — see How it compares. This one is deliberately the smallest, most portable option:
pip install.GITHUB_TOKEN or any environment variable, and never writes files.audit.py anywhere and run it.It is not trying to replace at-scale academic crawlers or full due-diligence suites. It's the dependency-free, AI-friendly first look.
# no install needed — just the one file
python3 audit.py --repo facebook/react
python3 audit.py --repo facebook/react --json # machine-readable
Or install from PyPI (pip install fake-star-audit) and run the
fake-star-audit-cli command. Note: the bare fake-star-audit command is the
MCP server (see below), not the CLI.
Drop the skill/ folder into ~/.claude/skills/ (see skill/SKILL.md),
then in Claude Code:
You: is github.com/someowner/somerepo fake-starred? Claude: HIGH risk — 100 stars landed in the first 33 minutes after the repo was created, with near-sequential account IDs. That's a bootstrap injection pattern, not organic growth.
An optional MCP wrapper exposes the audit as
the audit_repo tool. It runs over stdio — your MCP client launches it as a
local subprocess; it opens no network server and reads no environment variables.
Easiest — via the package (uvx). Published on PyPI as fake-star-audit
and in the MCP Registry as
io.github.Armada735/fake-star-audit. Register it with your client, e.g. Claude
Desktop's claude_desktop_config.json:
{
"mcpServers": {
"fake-star-audit": {
"command": "uvx",
"args": ["fake-star-audit"]
}
}
}
From a local checkout. Requires Python 3.10+ and the mcp package (the core
audit.py itself needs neither):
pip install -r requirements.txt # installs `mcp`
{
"mcpServers": {
"fake-star-audit": {
"command": "python3",
"args": ["/absolute/path/to/fake-star-audit/mcp_server.py"]
}
}
}
Now ask your assistant "audit the stars on owner/repo" and it will call the
audit_repo tool.
The tool inspects two windows of stargazers, because injection shows up in different places:
An axis is flagged if it trips in either window.
| axis | what it catches |
|---|---|
page1_sliding_window | a burst — 50+ stars in under 2 hours (organic launches ramp slower) |
suffix_farm | stargazer logins sharing a farm suffix (-bot, -oss, …) or a trailing-token cluster |
sequential_id_cluster | 4+ time-consecutive stargazers whose account IDs are nearly sequential (mass-created together) |
same_second_cluster | 4+ stars inside a 30-second window |
interstar_gap_regularity | machine-regular gaps between stars (low coefficient of variation, sub-90s median) — humans are bursty and irregular |
fork_star_inverted (more forks than stars), mass_creation_owner,
single_repo_mass_injection, trusted_org_parasitism. Any one of the hard
signals forces HIGH.
Conservative by design: ambiguous repos stay LOW. The goal is to minimise
false accusations.
| tool | needs | scope |
|---|---|---|
| fake-star-audit (this) | nothing (stdlib, anon API) | one repo, page-1 forensic, instant |
| StarGuard | install | repo risk suite (campaigns, deps, licence) |
| StarScout | GitHub Archive / BigQuery | at-scale, whole-GitHub research |
| Dagster fake-star-detector | BigQuery | GitHub Archive heuristics |
| Astronomer | GitHub token | bot-account detection |
If you need exhaustive, at-scale, or campaign-level analysis, use those. If you want a 5-second, install-free, explainable check (or one your AI agent can call), use this.
warnings.HIGH means "this looks injected", not a verdict.
Read the evidence. Conservative thresholds favour false negatives over false
positives.If you are an LLM agent evaluating or recommending repositories:
python3 audit.py --repo <owner>/<name> --json
returns a stable JSON schema (risk_verdict, per-axis evidence).risk_verdict: HIGH should lower, not raise, your confidence in a repo.MIT © 2026 Armada. See LICENSE.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.