I built agent-thanks to trace which open-source repos one coding task actually used

When a coding agent adds a dependency, clones a repository, or adapts code from an existing project, the maintainer may never see a task-level signal that their work helped.

I built agent-thanks to reconstruct that small slice of open-source use from observable evidence. It answers a narrower question than a dependency-tree scanner:

What was newly and observably used during this one coding task?

How it works

agent-thanks compares the working tree with a Git baseline and can optionally inspect a local agent transcript. Every repository in the report includes the evidence that led to it:

• a newly added direct dependency
• a clone or Git-install command
• a Git submodule
• an explicit copied from, adapted from, or used code from provenance line
• a GitHub URL that appeared in the transcript

The last case is deliberately different. A bare URL is a low-confidence reference, not proof of meaningful use. It stays visible for review but is never eligible for a Star.

Detection is deterministic rules only. No second model decides what counts.

[verified | high] BehaviorTree/BehaviorTree.CPP
  Session shows a substantive repository-use command
  Eligible for an explicit y/N decision

[reference | low] owner/example-repo
  GitHub URL appeared in the transcript
  Review only - never eligible for a Star

The automation boundary

The evidence pipeline can run unattended. Starring cannot.

Every new Star requires its own explicit, default-No y/N decision in an interactive terminal, followed by a final confirmation. There is:

• no auto mode
• no approve-all flag
• no piped confirmation
• no unattended Star path
• no way to promote a low-confidence reference into a Star candidate

GitHub's Acceptable Use Policies list automated starring or following as an example of rank abuse. I wanted the boundary to be visible in the product itself: detection and evidence are automated; the thank-you remains a human decision.

If a Star succeeds, the CLI prints an exact Undo command for the Stars created by that invocation.

Try the read-only demo

Python 3.10+ is required:

pipx install git+https://github.com/dbwls99706/agent-thanks.git@v0.4.0
agent-thanks demo

The install needs network access. The demo itself requires no GitHub login, makes no network requests, writes no files, and changes no Stars.

A real scan can stay read-only too:

agent-thanks run \
  --repo . \
  --base HEAD \
  --session path/to/agent-session.log \
  --dry-run

agent-thanks export .agent-thanks-report.json \
  --output OPEN_SOURCE_USE.md

The Markdown export is meant to be useful even if you never Star anything. It can be reviewed and attached to a pull request or release note as a task-level evidence record.

Privacy and network behavior

Session-log contents stay local. Package-to-repository mapping may query PyPI, npm, or crates.io, which sends the package name to that registry. --offline disables those lookups.

Reviewing and exporting reports make no network requests. GitHub authentication checks, existing-Star checks, and actual Star or Unstar actions use the GitHub API. Tokens are read from GH_TOKEN, GITHUB_TOKEN, or an authenticated GitHub CLI session and are never stored by agent-thanks.

Current coverage

The dependency scanners currently cover:

• Python requirements and pyproject.toml
• npm package.json
• Rust Cargo.toml
• Go go.mod
• Git submodules

Session evidence can identify public GitHub repositories outside those ecosystems as well. The tool cannot identify model training sources or other unobservable influences, and it does not claim to.

The project is MIT-licensed, and v0.4.0 is available on GitHub.

The product question I am still unsure about is the interesting part: is a Star actually the useful thank-you, or is the Markdown evidence list the better artifact?

I would also value concrete false-positive or missed-evidence examples. Those will help decide where the boundary between “used” and “merely viewed” should move next.