starlog — MCP server for Claude Code: setup
Checks packages before an agent uses them, covering vulnerabilities, licensing, and maintenance. Useful when dependency choices need current facts.
claude mcp add starlog -e STARLOG_API_KEY=<STARLOG_API_KEY> -- npx -y starloghqWhat starlog does
starlog adds MCP tools for checking a named package, finding libraries for a capability, and reviewing repeated custom implementations. The agent can see known CVEs and supply-chain incidents, the SPDX license and its risk, maintenance state, and the package’s effect surface. Results carry a date, while an unlisted package gets an explicit no-record result.
The server runs locally and connects to Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, and the other listed platforms. Running npx starloghq init adds the MCP server and a post-tool hook that surfaces package facts after npm install, pnpm add, yarn add, or pip install. The hook is advisory, so it does not stop the installation.
Private package data and organization rules can be supplied through STARLOG_PRIVATE_FACTS, STARLOG_POLICY, and STARLOG_API_KEY. The local path works without an API key; setting one enables hosted facts and search tiers with local fallback.
What it helps with
- check a package for CVEs and supply-chain incidents
- review license terms before adding a dependency
- discover libraries for a required capability
- spot abandoned or compromised packages
- replace repeated custom code with a vetted library
Example prompts for the agent
- Check
ua-parser-jsbefore adding it to this project. - Find authentication packages, then assess the selected one before I use it.
- Review repeated custom capability code and suggest a suitable package.
How to install starlog
Platform CLI
claude mcp add starlog -e STARLOG_API_KEY=<STARLOG_API_KEY> -- npx -y starloghqReplace <…> with your own values
Platform CLI
codex mcp add starlog --env STARLOG_API_KEY=<STARLOG_API_KEY> -- npx -y starloghqReplace <…> with your own values
Config file
{
"mcpServers": {
"starlog": {
"command": "npx",
"args": [
"-y",
"starloghq"
],
"env": {
"STARLOG_API_KEY": "<STARLOG_API_KEY>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"starlog": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"starloghq"
],
"env": {
"STARLOG_API_KEY": "<STARLOG_API_KEY>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e STARLOG_API_KEY=<STARLOG_API_KEY> starlog npx -y starloghqReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about starlog
How do I install starlog in Claude Code?
Run claude mcp add starlog -e STARLOG_API_KEY=<STARLOG_API_KEY> -- npx -y starloghq.
What does starlog do?
It gives an agent package checks, capability discovery, and advice on replacing repeated custom code. The results cover licensing, maintenance, and known security incidents.
Does starlog require an API key?
No. Its local mode works without a key or network access. STARLOG_API_KEY enables hosted facts and search, while the local corpus remains available as a fallback.
