The Growing Threat of AI Bot Pollution
Open-source startup Archestra posted a $900 bounty to implement "MCP Apps" support, expecting legitimate developer contributions. Instead, automated AI bots inundated the issue with 253 comments, derailing discussions with nonsensical implementation plans and maintainer-directed aggression. The maintainers also received 27 untested pull requests for an x.ai provider integration, forcing team members to waste half a day every week clearing automated garbage.
Archestra initially attempted automated moderation using "London-Cat," a custom bot designed to calculate contributor reputation scores. When that failed to curb the noise, they deployed an "AI sheriff" bot, which inadvertently closed valid pull requests submitted by human contributors. CTO Ildar Iskhakov reported that the mounting friction threatened to force the team to stop offering bounties and candidate test tasks altogether.
How the Git Identity Whitelist Mechanism Works
To restrict repo access without abandoning public collaboration, Archestra leveraged GitHub's native "Limit to prior contributors" setting. Under this policy, only accounts with existing main-branch commits can comment or open pull requests. To bypass this barrier for genuine new developers, Archestra engineered an automated onboarding pipeline:
- CAPTCHA Onboarding: New contributors complete a five-step registration form on Archestra's website, accepting ethical AI rules and solving a CAPTCHA.
- API Identification: A GitHub Action triggers on submission and retrieves the user's unique numeric account ID via the GitHub API.
- Commit Emulation: The workflow adds the developer's handle to
EXTERNAL_CONTRIBUTORS.mdand pushes a commit tomainusinggit commit --author="username <[email protected]>". - Automated Whitelisting: Pushing this authored commit to the main branch causes GitHub to register the developer as a prior contributor, instantly granting full repository permissions.
Trade-Offs and Open-Source Impact
Archestra acknowledged that enforcing web-based onboarding is a severe measure for a venture-backed startup evaluated on public activity. The extra step adds friction for real developers and prevents spontaneous contributions from first-time visitors. However, maintainers emphasized that unvetted AI bots impose severe team burnout and security vulnerabilities, citing past automated manipulation attempts on repositories like LiteLLM.
Why it matters
As AI-generated code floods open-source platforms, raw contribution metrics like pull request volume no longer indicate project health. Archestra's workaround demonstrates how maintainers are being forced to adopt strict identity verification mechanisms to shield human developers from systemic automated noise.