MCP.Market

Starlog MCP server

by starloghq·io.github.starloghq/starlog·v0.9.0·10 stars
No reviews yet

Vet a package (CVEs, license, maintenance) before your AI agent uses it, plus capability discovery.

C62/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C62/100

full report

Adoption
Growing

10 stars48 downloads/wk

Reviews

Write one

Nobody has reviewed Starlog yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Starlog tools (3)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • starlog_advise
  • starlog_facts
  • starlog_search

    Discover candidate packages for a capability: surfaces options for a need (org-sanctioned/private ones first when configured), with integration effort, best-for and skip-when notes. This is discovery \u2014 it surfaces what exists; to vet a specific named package (CVEs, license, maintenance), call starlog_facts. Use after you have a capability/need and want candidate package names.

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

2 medium
  • Code scan32 source files scanned15/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 49 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (2)

  • mediumnpm install lifecycle script presentinstall.script
  • mediumnpm install lifecycle script presentinstall.script
    package.json: …m run gen:facts && node build.mjs", "postinstall": "node postinstall.mjs", "prepublish…
Overall 62/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Starlog compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
62/100
higher than 18% of 4,460 AI and agents servers
Tools
3
the typical AI and agents server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
10
more than 84% of 2,711 AI and agents servers
Downloads a week
48
more than 40% of 1,538 AI and agents servers with a package

What its tools let an agent do: 3 read

Install Starlog in Claude Code, Cursor or VS Code

Runs npx -y starloghq on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add starlog -- npx -y starloghq
Add to Cursor

What the publisher says

From the Starlog repository's README, as published. We do not edit it. Read it on GitHub

Starlog

Vet a package before your AI coding agent uses it — authoritative facts (CVEs, license, maintenance), free, local, no account.

Vet a package in one command — nothing to install, no API key, no account:

npx starloghq facts ua-parser-js

Then wire it into your coding agent (Claude Code, Cursor, Copilot, Codex):

npx starloghq init

Source-available under BUSL-1.1 — free to use, modify, and self-host; converts to Apache-2.0 in 2030. Details ↓

Why

AI coding agents (Claude Code, Cursor, Copilot) pick libraries from training recall — a snapshot of scraped code, frozen at a cutoff date and ranked by how often an option appeared, not by what fits your task or what's safe now. That recall can't know about a CVE disclosed last week, and it has never seen your company's internal libraries. The agent recommends anyway, with the same confidence either way.

The failure modes are measurable: research finds ~49% of AI-suggested dependencies carry known vulnerabilities and ~34% are hallucinated outright — the package doesn't exist. And for whole categories — most dangerously auth — agents default to hand-rolling custom code instead of reaching for a vetted library.

You can't fix recall by prompting harder. Starlog puts authoritative, dated facts in front of your agent at decision time. Its hero surface is vetting by name — starlog facts returns known CVEs/incidents, SPDX license + risk, and maintenance status (or an honest "no facts on file") — so the install/avoid/pick call rides on facts, not recall. It runs entirely on your machine as an MCP server and a package-install hook, no API key, no sign-up. A companion starlog_search finds candidate packages for a capability; facts vet the pick.

Does it actually change what the agent decides? Yes — measured before/after, on the venue that matters (private libraries and post-cutoff advisories). → the validated result.

What you get

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Starlog: common questions

Is Starlog MCP server safe?
With care: it is graded C, so read the findings first (62/100). Read the Starlog safety report
How do I install Starlog?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Starlog need an API key?
Yes. The registry entry asks for STARLOG_API_KEY.
Is Starlog maintained?
The last commit was 89 days ago (2026-08-07). The latest release is v0.9.0.
What can I use instead of Starlog?
Servers from other publishers that do the same job: Decionis MCP server, Alibaba Cloud DashScope — Qwen MCP server and Agent Security Scanner MCP server.
How does Starlog compare with other AI and agents MCP servers?
safety score 62/100 (higher than 18% of 4,460 AI and agents servers); tools 3 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Starlog

Same job from other publishers: the closest match first, then the best rated.

  • Decionis
    Authorize consequential AI agent actions before execution
    A
  • Alibaba Cloud DashScope — Qwen
    Alibaba Cloud DashScope MCP: Qwen chat, embeddings, and model discovery on your own account.
    B
  • Agent Security Scanner
    Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.
    C