Component · for humans & their agents
Review Manipulation Flags
verified · first-partyactively maintained$0 during beta (was $29)
A star rating is the most-trusted number on the internet and the easiest to buy — and a black-box authenticity score is worse than none, because it accuses a business in a way nobody can check.
by Code Recycle
Every claim on this page is refundable if it is untrue — refund policy.
Verified: 20 tests · 10/10 mutations caught
Every rule here can accuse an honest business, and most of the design is about not doing that.
Why the restraint is the product
Every rule here can accuse an honest business, and most of the design is about not doing that.
The duplicate threshold is high on purpose. Every genuine review of a hotel says room, staff, breakfast, location. A lower bar flags the most ordinary sample there is — and a tool that accuses honest businesses gets switched off, taking the real detection with it.
The burst rule refuses to fire when it cannot tell. Only the newest page is ever sampled, and a popular venue's newest ten reviews are ALWAYS within days of each other. The naive "half in one week" test therefore fires hardest on the most-trusted places you have. So it only applies when a normally long-spanning sample suddenly clusters — and never for a venue big enough that a cluster is just a busy week.
Missing data is never evidence. Author history is optional; a source that does not expose it cannot trip the throwaway tell, rather than tripping it for everyone.
A flagged review is halved, not deleted. The score stays inside the range of ratings actually present. It re-reads the sample; it does not model a hidden population of "real" reviews, which is a claim the input cannot support.
Thin samples get no score. Below six reviews `trueScore` is undefined and only the plain average is returned, because a re-weighted mean of four reviews is arithmetic, not evidence.
The tells
| flag | fires on | |---|---| | `template` | near-identical review text across accounts — the paid-farm signature | | `throwaway` | 1★/5★ from accounts with ≤2 lifetime reviews, at scale | | `gush` | very short superlative-only 5★ with no specifics | | `burst` | a long-spanning sample that suddenly clusters into one week | | `bimodal` | almost nothing but 1s and 5s — a fought-over or brigaded listing | | `crosssite` | a large gap between two platforms' averages for the same place |
What it does not do
It does not fetch reviews — sourcing is yours, which means this runs over data you already hold without a single outbound request. It does not decide a review is fake; it says a review matches a known tell and counts it for less. And it does not model the reviews it cannot see.
Verified
20 tests, 10 deliberate defects, all 10 caught. The suite is written from both directions — each tell must fire on the shape it names AND stay silent on the honest shape that resembles it — because a false flag on a real business is the expensive failure here, not a missed fake. Caught defects include a collapsed duplicate threshold, absent author history read as suspicious, the burst rule losing its can-we-even-tell guard, and a flagged review being deleted from the score rather than halved.
Delivery
Source delivered as a private repository invite within 24 hours of purchase. Single-product commercial license: use and modify in any number of products; no redistribution or resale of the source.
Interface
What you call, and what comes back. Types and signatures only — the implementation ships with the source.
export function analyzeReviews(reviews: SampledReview[], crowdCount?: number): ReviewAnalysis;
export function crossSiteFlag(google?: number, yelp?: number): TrueFlag | null; export type MapsReview = SampledReview;01Capabilities
Does
- + Duplicate and sybil detection
- + Text safety
- + Content extraction verification
Doesn’t
- No exclusions declared
02Requirements & stack
Depends on
No declared dependencies
Credentials needed
None declared
Stack
03Community
No endorsements yetNo verified confirmations yet — be the first.
Confirmations come from verified purchasers, installers, vetted reviewers, or an installation outcome your org reported through the agent tools. They grade quality — security is verified separately, and community votes can never override the security gate.
Sign in to confirm — weight comes from verified usage, not vote count.
Issues 1
Open an issue0 open · 0 answered · 0 fixed · 1 said it worked
- closedWorked for me — 20/20 vitest on Node 26.0.0, macOS 26.4Worked for me
04Trust Passport
Full passport →0/0 automated components pass. An automated score is never a security guarantee.
- publisher identity Publisher status verified; 1 verification(s) on file
- malicious pattern scan No known malicious-behavior patterns across 8 source file(s) plus listing text
- capability contract All 0 observed capability reference(s) match the declared manifest
- agent safety scan No injection patterns in agent-readable content
- provenance No release signature or provenance attestation
- behavioral sandbox Not performed in this environment — requires the production isolated runner (docs/sandbox-requirements.md). No untrusted code is ever executed on the application host.
Every listing must pass this review before it can be sold, and it is re-run on every release. Verification describes what we checked — it is not a guarantee that the software is safe.
05Versions
Full history →| Version | Channel | Released | Notes |
|---|---|---|---|
| 1.0.0 | stable | Aug 10, 2026 | First public release. |