Log inSubmit server
Starlog logo

Starlog

Locally vets packages for vulnerabilities, licensing, maintenance, and fit through MCP tools and a CLI.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Starlog

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "starlog": {
      "command": "npx",
      "args": [
        "-y",
        "starloghq"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

The install command installed and started the server, which then stopped for configuration (such as an API key) that our sandbox does not have — expected for servers that connect to your account.

npx -y starloghq

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 14d ago.

Overview

The starlog MCP server gives AI coding agents local package facts, including known CVEs, supply-chain incidents, SPDX licensing, maintenance status, and effect surface. It exposes tools for vetting named packages, finding candidates by capability, and advising on whether repeated or DIY code should become a dependency. Run it through npx with no account or API key for the local corpus, or configure hosted facts and search with an API key. Reach for it when an agent needs current, sourced package information before recommending or installing a dependency.

Use cases

  • Vet a package before adding it to a project
  • Find libraries for a required capability
  • Review internal packages by name or capability
  • Surface dependency facts after installation commands
  • Replace repeated DIY code with a vetted library

Key features

  • Package facts for CVEs, incidents, licenses, and maintenance
  • Capability-based package discovery
  • Migrate-or-packageize code advisories
  • Local private facts and organization policies
  • Advisory package-install hook
  • CLI and MCP interfaces

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

11/11 checks healthy over the last 61d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · starloghq (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars13Stargazers on the source repository.
npm downloads367Package downloads in the last 30 days.
Last commit1mo agoMost recent push to the default branch.
Install checkRunsOur sandbox started it; it then asked for an API key or config.

How Starlog works

What the starlog MCP server does

The starlog MCP server helps coding agents evaluate dependencies using a local facts corpus rather than relying only on training recall. Its primary lookup accepts a package name and reports known vulnerabilities or supply-chain incidents, SPDX license information and risk, maintenance state, and effect-surface data. Results include an "as of" date when facts are available, while unknown packages return an explicit no-record result.

The server also supports package discovery and code-structure guidance. A search operation finds candidate packages for a capability, while an advisory operation can recommend migrating repeated or DIY capability code to a suitable library. The bundled discovery data includes 26 capability manifests across seven categories.

How it works

Starlog runs locally as an MCP server and can also expose the same functions through its command-line interface. The default keyless path uses the local engine and corpus without an account, API key, or network connection. A package-install hook can inspect packages when an agent runs npm, pnpm, yarn, or pip installation commands. The hook is advisory: it surfaces available facts but does not prevent installation.

Package information is assembled from separate layers. Capability and effect-surface information is treated as stable, while vulnerability, license, reputation, and maintenance information can change and carries recency data. Organization policy adds allow, deny, or flag outcomes. Local private facts and policy can extend the public corpus for internal packages and organization-specific decisions.

Setup and configuration

Use npx starloghq init to configure the integration. The initializer adds the MCP server to Claude Code settings, installs the post-install hook, and can place project guidance in CLAUDE.md. It previews changes, asks before writing, and can be rerun safely. --dry-run, --project, and --uninstall provide preview, project-documentation, and removal modes.

A global npm installation is also supported with npm install -g starloghq, followed by starlog init. The command can generate an agent setup prompt with --agent-prompt. Set STARLOG_PRIVATE_FACTS to a JSON file for local fact overlays and STARLOG_POLICY for organization policy. STARLOG_API_KEY enables hosted facts and search tiers, with the local corpus available as fallback; the CLI can upload organization overlays and policy with starlog facts push.

Tools and capabilities

The starlog MCP server exposes these agent tools:

  • starlog_facts vets a package by name and returns its recorded facts.
  • starlog_search finds package candidates for a capability, prioritizing organization-sanctioned options where available.
  • starlog_advise recommends MIGRATE or PACKAGEIZE for DIY or repeated capability code and records patterns in .starlog/patterns.json.

The CLI provides corresponding facts, search, advise, and patterns commands. starlog org sync can inspect npm and Python package manifests in a directory of checkouts, derive private facts from manifests, license files, and git recency, and build a private discovery corpus.

Limitations and notes

The installation hook informs the agent but does not block a dependency. A package absent from the corpus produces no facts rather than a safety verdict. Local information can therefore be incomplete or dated, although recorded results show their fact date. Hosted tiers require an API key, while the keyless mode is local and does not need network access. Optional integration with Socket is available through init --with-socket, but package names checked by that service are sent to socket.dev.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Starlog

starlog is an MCP server that connects AI coding agents to a local package facts and discovery corpus. Its main tools, starlog_facts, starlog_search, and starlog_advise, vet packages for incidents, licenses, and maintenance, find candidates by capability, and advise whether DIY code should migrate to a library or be packageized.

Run `npx starloghq init` to configure it. The initializer adds the MCP server to Claude Code, installs the package-install hook, and can add project guidance. You can instead install `starloghq` globally with npm and run `starlog init`.

Yes, starlog supports Cursor setup guidance. The initializer drops instruction files for Cursor and can generate a ready-to-paste agent prompt for setup.

No, the local facts and discovery path does not require an account or API key. Set `STARLOG_API_KEY` only when you want to use the hosted facts and search tiers, which retain the local corpus as a fallback.

Yes, private package information can be supplied through local overlays and organization policy. `STARLOG_PRIVATE_FACTS` points to a JSON overlay, while `STARLOG_POLICY` supplies allow, deny, or flag rules; `starlog org sync` can derive data from local npm and Python checkouts.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewStarlog AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/starlog?style=directory)](https://allmcps.com/mcp/starlog)
HTML Embed
<a href="https://allmcps.com/mcp/starlog"><img src="https://allmcps.com/api/badge/starlog?style=directory" alt="Starlog on AllMCPs" /></a>