# starlog [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/starloghq/index  
**GitHub Stars:** 13  
**npm Downloads (last month):** 367  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/starlog

## Description
Local capability index so AI coding agents pick libraries by fit, not popularity. No account.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "starlog": {
    "command": "npx",
    "args": ["-y","starloghq"]
  }
}
```

## Documentation

## What the starlog MCP server does

The starlog MCP server helps coding agents evaluate dependencies using a local facts corpus rather than relying only on training recall. Its primary lookup accepts a package name and reports known vulnerabilities or supply-chain incidents, SPDX license information and risk, maintenance state, and effect-surface data. Results include an "as of" date when facts are available, while unknown packages return an explicit no-record result.

The server also supports package discovery and code-structure guidance. A search operation finds candidate packages for a capability, while an advisory operation can recommend migrating repeated or DIY capability code to a suitable library. The bundled discovery data includes 26 capability manifests across seven categories.

## How it works

Starlog runs locally as an MCP server and can also expose the same functions through its command-line interface. The default keyless path uses the local engine and corpus without an account, API key, or network connection. A package-install hook can inspect packages when an agent runs npm, pnpm, yarn, or pip installation commands. The hook is advisory: it surfaces available facts but does not prevent installation.

Package information is assembled from separate layers. Capability and effect-surface information is treated as stable, while vulnerability, license, reputation, and maintenance information can change and carries recency data. Organization policy adds allow, deny, or flag outcomes. Local private facts and policy can extend the public corpus for internal packages and organization-specific decisions.

## Setup and configuration

Use `npx starloghq init` to configure the integration. The initializer adds the MCP server to Claude Code settings, installs the post-install hook, and can place project guidance in `CLAUDE.md`. It previews changes, asks before writing, and can be rerun safely. `--dry-run`, `--project`, and `--uninstall` provide preview, project-documentation, and removal modes.

A global npm installation is also supported with `npm install -g starloghq`, followed by `starlog init`. The command can generate an agent setup prompt with `--agent-prompt`. Set `STARLOG_PRIVATE_FACTS` to a JSON file for local fact overlays and `STARLOG_POLICY` for organization policy. `STARLOG_API_KEY` enables hosted facts and search tiers, with the local corpus available as fallback; the CLI can upload organization overlays and policy with `starlog facts push`.

## Tools and capabilities

The starlog MCP server exposes these agent tools:

- `starlog_facts` vets a package by name and returns its recorded facts.
- `starlog_search` finds package candidates for a capability, prioritizing organization-sanctioned options where available.
- `starlog_advise` recommends `MIGRATE` or `PACKAGEIZE` for DIY or repeated capability code and records patterns in `.starlog/patterns.json`.

The CLI provides corresponding `facts`, `search`, `advise`, and `patterns` commands. `starlog org sync` can inspect npm and Python package manifests in a directory of checkouts, derive private facts from manifests, license files, and git recency, and build a private discovery corpus.

## Limitations and notes

The installation hook informs the agent but does not block a dependency. A package absent from the corpus produces no facts rather than a safety verdict. Local information can therefore be incomplete or dated, although recorded results show their fact date. Hosted tiers require an API key, while the keyless mode is local and does not need network access. Optional integration with Socket is available through `init --with-socket`, but package names checked by that service are sent to socket.dev.

_Full upstream README: https://allmcps.com/mcp/starlog/readme_