# starlog

Checks packages before an agent uses them, covering vulnerabilities, licensing, and maintenance. Useful when dependency choices need current facts.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 12
- Author: starloghq
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/starloghq/index
- Updated: 2026-10-01
- HTML: https://affpapa.org/en/nevibecode/mcp/starlog

## What it does

starlog adds MCP tools for checking a named package, finding libraries for a capability, and reviewing repeated custom implementations. The agent can see known CVEs and supply-chain incidents, the SPDX license and its risk, maintenance state, and the package’s effect surface. Results carry a date, while an unlisted package gets an explicit no-record result.

The server runs locally and connects to Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, and the other listed platforms. Running `npx starloghq init` adds the MCP server and a post-tool hook that surfaces package facts after `npm install`, `pnpm add`, `yarn add`, or `pip install`. The hook is advisory, so it does not stop the installation.

Private package data and organization rules can be supplied through `STARLOG_PRIVATE_FACTS`, `STARLOG_POLICY`, and `STARLOG_API_KEY`. The local path works without an API key; setting one enables hosted facts and search tiers with local fallback.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `STARLOG_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add starlog -e STARLOG_API_KEY=<STARLOG_API_KEY> -- npx -y starloghq
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add starlog --env STARLOG_API_KEY=<STARLOG_API_KEY> -- npx -y starloghq
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "starlog": {
            "command": "npx",
            "args": [
                "-y",
                "starloghq"
            ],
            "env": {
                "STARLOG_API_KEY": "<STARLOG_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "starlog": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "starloghq"
            ],
            "env": {
                "STARLOG_API_KEY": "<STARLOG_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e STARLOG_API_KEY=<STARLOG_API_KEY> starlog npx -y starloghq
```
Replace <…> with your own values

## When to use it
- check a package for CVEs and supply-chain incidents
- review license terms before adding a dependency
- discover libraries for a required capability
- spot abandoned or compromised packages
- replace repeated custom code with a vetted library

## Example prompts
- Check `ua-parser-js` before adding it to this project.
- Find authentication packages, then assess the selected one before I use it.
- Review repeated custom capability code and suggest a suitable package.

## Similar
- [ghost-scan-deps](https://affpapa.org/en/nevibecode/skills/ghost-scan-deps.md) — skill · 4300 installs
- [ghost-repo-context](https://affpapa.org/en/nevibecode/skills/ghost-repo-context.md) — skill · 3800 installs
- [dependency-checker](https://affpapa.org/en/nevibecode/hooks/dependency-checker.md) — hook · 2314 installs
- [dependencies-audit](https://affpapa.org/en/nevibecode/skills/dependencies-audit.md) — skill · 1900 installs
- [dependency-check](https://affpapa.org/en/nevibecode/skills/dependency-check.md) — skill · 748 installs
- [dependency-scan](https://affpapa.org/en/nevibecode/skills/dependency-scan.md) — skill · 355 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md