Fake Star Audit MCP server

fake-star-audit

<!-- mcp-name: io.github.ardev-lab/fake-star-audit -->

A transparent, dependency-free GitHub fake-star checker. One Python file, no token, no install — point it at a repo and get a LOW / MEDIUM / HIGH risk verdict with every rule explained.

$ python3 audit.py --repo someowner/somerepo
🔴  someowner/somerepo  —  risk: HIGH
    422★ / 0 forks / age 66.9h
    windows: earliest=100, latest=22
    axes: page1_sliding_window, sequential_id_cluster, same_second_cluster
      [FLAG] page1_sliding_window     earliest: BURST: 100 stars in 0.55h (~183 stars/h)
      [FLAG] sequential_id_cluster    earliest: 4+ time-consecutive stargazers within id range <200k
      [FLAG] same_second_cluster      earliest: max 4 stars within a 30s window

Why

GitHub stars are used as a proxy for trust — by investors doing due-diligence, by engineers picking dependencies, by recruiters reading résumés. But there is a paid market for fake stars: bot accounts and "star farms" inflate a repo to look popular. (See the CMU study estimating millions of suspected fake stars.)

fake-star-audit gives you a fast, explainable gut-check: is this repo's star count believable?

What makes it different

There are already excellent fake-star tools — see How it compares. This one is deliberately the smallest, most portable option:

GITHUB_TOKEN or any environment variable, and never writes files.

• Zero dependencies. Pure Python standard library. No pip install.
• No token, no account. Uses the anonymous GitHub API. It never reads your

in natural language and get a structured report.

• One file. Copy audit.py anywhere and run it.
• AI-native. Ships as a Claude Code skill — ask "is this repo fake-starred?"

with its evidence printed.

• Transparent. No machine-learning black box. Every flag is a named rule

It is not trying to replace at-scale academic crawlers or full due-diligence suites. It's the dependency-free, AI-friendly first look.

Quick start

CLI

# no install needed — just the one file
python3 audit.py --repo facebook/react
python3 audit.py --repo facebook/react --json   # machine-readable

Or install from PyPI (pip install fake-star-audit) and run the fake-star-audit-cli command. Note: the bare fake-star-audit command is the MCP server (see below), not the CLI.

Claude Code skill

Drop the skill/ folder into ~/.claude/skills/ (see skill/SKILL.md), then in Claude Code:

You: is github.com/someowner/somerepo fake-starred?

Claude: HIGH risk — 100 stars landed in the first 33 minutes after the

repo was created, with near-sequential account IDs. That's a bootstrap

injection pattern, not organic growth.

MCP server (Claude Desktop, Cursor, …) — optional

An optional MCP wrapper exposes the audit as the auditrepo tool. It runs over stdio** — your MCP client launches it as a local subprocess; it opens no network server and reads no environment variables.

Easiest — via the package (uvx). Published on PyPI as fake-star-audit and in the MCP Registry as io.github.ardev-lab/fake-star-audit. Register it with your client, e.g. Claude Desktop's claudedesktopconfig.json:

{
  "mcpServers": {
    "fake-star-audit": {
      "command": "uvx",
      "args": ["fake-star-audit"]
    }
  }
}

From a local checkout. Requires Python 3.10+ and the mcp package (the core audit.py itself needs neither):

pip install -r requirements.txt   # installs `mcp`

{
  "mcpServers": {
    "fake-star-audit": {
      "command": "python3",
      "args": ["/absolute/path/to/fake-star-audit/mcp_server.py"]
    }
  }
}

Now ask your assistant "audit the stars on owner/repo" and it will call the audit_repo tool.

How it works

Shortened. The full README is on GitHub.