Fake Star Audit

What is Fake Star Audit?

A transparent, zero-dependency GitHub fake-star checker. It inspects a repository’s stargazer history via the anonymous GitHub API and returns a LOW / MEDIUM / HIGH risk verdict with every rule explained. Designed for investors, engineers, recruiters, and AI agents who need a fast, accountable gut-check on star count believability.

How to use Fake Star Audit?

The tool can be invoked as a standalone CLI (python3 audit.py --repo owner/repo), installed from PyPI (pip install fake-star-audit) and run as fake-star-audit-cli, or used as a Claude Code skill. Its optional MCP server exposes the audit_repo tool over stdio; register it in your MCP client (e.g., Claude Desktop’s config) with uvx fake-star-audit or a local path to mcp_server.py.

Key features of Fake Star Audit

• Zero dependencies – pure Python standard library
• No token, no account – uses anonymous GitHub API
• One-file portable audit.py – just copy and run
• AI-native – works as a Claude Code skill
• Transparent verdicts – every flag shows its evidence
• Conservative heuristics – minimises false accusations

Use cases of Fake Star Audit

• Due diligence for investors evaluating startup repositories
• Quick trust check for engineers choosing open-source dependencies
• Resume and portfolio verification for recruiters
• Automated repository assessment by LLM agents

FAQ from Fake Star Audit

What risks does it detect?

It flags 5 axes – burst injection, farm suffixes, sequential account IDs, same-second clusters, and machine-regular gaps – plus extended hard signals like fork-star inversion or single-repo mass injection. A deterministic rule combines them into a LOW / MEDIUM / HIGH verdict.

How does it compare to other fake-star tools?

Unlike at-scale research tools (StarScout, Dagster) or install-heavy suites (StarGuard, Astronomer), this tool is the smallest and most portable: no dependencies, no token, instant forensic check of a single repo’s first and latest stargazer windows.

Does it require a GitHub token or any environment variables?

No. It uses the anonymous GitHub API only and never reads a GITHUB_TOKEN or any environment variable.

What are its limitations?

It samples only the oldest ~100 and newest 30 stargazers (not the full history), skips the bootstrap window for repos older than ~90 days, is subject to the anonymous 60‑request/hour rate limit, and is heuristic – not proof of fakery.

How do I connect it to my MCP client?

For Claude Desktop, add to claude_desktop_config.json: command "uvx" with args ["fake-star-audit"]. Or from a local checkout, command "python3" with args pointing to mcp_server.py. The server runs over stdio.