Fake Star Audit
About
Audits a GitHub repository's stargazers for signs of fake-star injection across five deterministic axes (burst, suffix-farm, sequential-id cluster, same-second cluster, inter-star gap regularity) over two windows (oldest 100 + newest 30), plus extended signals. Returns LOW / MEDI
Explore
- Zero dependencies – pure Python standard library
- No token, no account – uses anonymous GitHub API
- One-file portable audit.py – just copy and run
- AI-native – works as a Claude Code skill
- Transparent verdicts – every flag shows its evidence
- Conservative heuristics – minimises false accusations
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Fake Star AuditCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
python3 audit.py --repo facebook/react
python3 audit.py --repo facebook/react --json # machine-readable
``
Or install from PyPI (pip install fake-star-audit) and run thefake-star-audit-cli
command. Note: the bare fake-star-audit` command is the
MCP server (see below), not the CLI.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"fake star audit": {
"fake-star-audit": {
"command": "python3",
"args": [
"/absolute/path/to/fake-star-audit/mcp_server.py"
]
}
}
}
}McpServers
{
"fake-star-audit": {
"command": "python3",
"args": [
"/absolute/path/to/fake-star-audit/mcp_server.py"
]
}
}<!-- mcp-name: io.github.ardev-lab/fake-star-audit -->
A transparent, dependency-free GitHub fake-star checker. One Python file, no
token, no install — point it at a repo and get a LOW / MEDIUM / HIGH
risk verdict with every rule explained.
$ python3 audit.py --repo someowner/somerepo
🔴 someowner/somerepo — risk: HIGH
422★ / 0 forks / age 66.9h
windows: earliest=100, latest=22
axes: page1_sliding_window, sequential_id_cluster, same_second_cluster
[FLAG] page1_sliding_window earliest: BURST: 100 stars in 0.55h (~183 stars/h)
[FLAG] sequential_id_cluster earliest: 4+ time-consecutive stargazers within id range <200k
[FLAG] same_second_cluster earliest: max 4 stars within a 30s window
Why
GitHub stars are used as a proxy for trust — by investors doing due-diligence,
by engineers picking dependencies, by recruiters reading résumés. But there is
a paid market for fake stars: bot accounts and "star farms" inflate a repo to
look popular. (See the CMU study estimating millions of suspected fake stars.)
fake-star-audit gives you a fast, explainable gut-check: is this repo's
star count believable?
What makes it different
There are already excellent fake-star tools — see How it compares.
This one is deliberately the smallest, most portable option:
- Zero dependencies. Pure Python standard library. No pip install.
- No token, no account. Uses the anonymous GitHub API. It never reads your
GITHUB_TOKEN or any environment variable, and never writes files.
- One file. Copy audit.py anywhere and run it.
- AI-native. Ships as a Claude Code skill — ask "is this repo fake-starred?"
in natural language and get a structured report.
- Transparent. No machine-learning black box. Every flag is a named rule
with its evidence printed.
It is not trying to replace at-scale academic crawlers or full due-diligence
suites. It's the dependency-free, AI-friendly first look.
Quick start
CLI
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
