Starlog MCP Server

Vet a package before your AI coding agent uses it - authoritative facts (CVEs, license, maintenance), free, local, no account.

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-08-07 · ★ 9 · #48 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

NOASSERTION · TypeScript servers · how we verify → /methodology

01 · Install Starlog

before you install - you'll need

Set STARLOG_TELEMETRY, DO_NOT_TRACK before connecting.

Claude Code

claude mcp add starloghq-index -- npx -y starloghq

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "starloghq-index": {
      "command": "npx",
      "args": [
        "-y",
        "starloghq"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license no standard license detected - usage rights unclear; check the repo before commercial use

npm package starloghq - unscoped; check the name against the project README before installing

registry namespace io.github.starloghq is GitHub-verified and matches the repo owner

03 · What Starlog can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.2.0 · 2026-06-04

v0.2.0 - Facts-first: vet a package before your agent uses it · Hero is now vetting by name: starlog facts <package> returns authoritative, · dated facts (CVEs/incidents, SPDX license + risk, maintenance) - or an…

04 · Who maintains Starlog

starlog is maintained by starloghq. It's the only MCP server we track from this author; the repo dates to Jun 2026.

05 · Facts

repository: github.com/starloghq/index
category: security - ranked #48 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 1 release in the last 90 days (latest 2026-06-04)
registry: io.github.starloghq/starlog (active, first published 2026-06-02 · 5 versions)
packages: npm:starloghq

06 · Starlog FAQ

What is Starlog?

Vet a package before your AI coding agent uses it - authoritative facts (CVEs, license, maintenance), free, local, no account.

Is Starlog still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-07 and it shipped 1 release in the last 90 days. We re-verify nightly.

How do I install Starlog?

Run `npx -y starloghq`. The README documents 2 environment variables (STARLOG_TELEMETRY, DO_NOT_TRACK) to set first. Set STARLOG_TELEMETRY, DO_NOT_TRACK before connecting. You can also paste the ready-made client config above.

Does Starlog run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Starlog

Alternatives to Starlog

Maintained security servers if Starlog isn't the fit.

Pairs well with

Servers that cover what Starlog doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Code Inspectus · Wass MCP · Universal Connector MCP · Totem · Thingctx

More TypeScript MCP servers · Starwind UI MCP Server · Partd MCP · Shortcut MCP · Mintclub · Fred MCP Server · see all