F-Droid apps get rated for how much LLM code they contain
A developer who describes themselves as a FOSS app maintainer and a student set out to answer a question sparked by noticing an app with an obviously AI-generated icon on F-Droid: how much of the software on the Android FOSS store is now written by an LLM. Frustrated that online discourse only offers two extremes, LLMs as "god reincarnate" or as "glorified autocomplete," they say there is no reliable way to prove code was vibe-coded, but that there are "smells" worth checking for, especially in a repository's infrastructure. The author is explicit about their own position going in: LLMs are useful and capable, people can now build "medium scale games and software in half an hour," and the author praises the Linux kernel's use of LLMs to find and sometimes fix bugs. At the same time, the author says they personally dislike what LLMs have done to programming, citing skill atrophy, "plausibly sounding misinformation" and climate cost, and singles out projects that let an LLM write the README from scratch and then review its own commits with direct repo access.
The review uses a three-tier system. "Mostly AI" covers apps the author expects are more than half LLM-authored; any repo with agentic coding infrastructure (such as a Claude Code or Codex setup) is automatically placed here, because the author says they do not believe AI can be used responsibly from within a coding harness. "Hard to say / Mostly human / Other" covers apps expected to be under half LLM-authored, including ones with occasional AI commits or an explicit policy permitting limited LLM use. "No signs of AI" covers apps where nothing suspicious turned up, or that carry a strict anti-LLM policy. The scope is the 102 apps in F-Droid's update batch from September 12, 2026, judged only by their most recent commits and branding, not project history; an app maintained since 2014 with a recent AI-generated commit is still tagged "Mostly AI." The author calls the ratings superficial, says no automated "slop detector" was built, and warns the tiers are loose enough to contain errors.
Among the apps tagged "Mostly AI" in the reviewed portion: Amber, a Nostr event signer, for having Claude Code and Codex infrastructure present and accepting pull requests from agents; BayesianBahn, an unofficial Deutsche Bahn timetable tool, because "all commits are Claude co-authored"; DeltaSync, a KeePass sync tool, whose recent commits are co-authored by "Claude Opus 5"; and Feeder, an RSS reader the author calls out as the one app on the list they personally use, still rated "Mostly AI" over LLM-generated commits and agent-submitted pull requests. Only a handful of the apps covered came back clean, including Aria for Misskey, Atmo Engine, Aves Libre, Binary Eye and Klick'r: Smart AutoClicker, each cleared because nothing suspicious was found. Two entries resisted classification: DuressKeyboard, whose maintainer appears never to have used git properly and instead hand-edits code through GitHub's web file editor, in development since November 2025; and Harp, whose SourceHut repository the author could not inspect because of bot-detection blocking, beyond spotting one Claude-co-authored commit. The author separately flags that Chompass, a calorie tracker, is hosted on Codeberg in what the author believes likely violates Codeberg's terms of use. The text obtained for this story runs through dozens of these per-app entries before cutting off mid-list, ahead of any results summary the author may have written.
Key facts
- The author manually reviewed the 102 apps in F-Droid's update batch from September 12, 2026, rating each on a three-tier scale: "Mostly AI" (over half the code expected to be LLM-authored), "Hard to say / Mostly human / Other" (under half), and "No signs of AI."
- Any repo with agentic coding infrastructure, such as a Claude Code or Codex setup, is automatically placed in "Mostly AI," because the author says they do not believe AI can be used responsibly from within a coding harness.
- In the portion of the list captured, apps tagged "Mostly AI" heavily outnumbered clean ones; only a handful, including Aria for Misskey, Atmo Engine, Aves Libre, Binary Eye and Klick'r: Smart AutoClicker, were tagged "No signs of AI."
- Two apps could not be classified: DuressKeyboard, whose maintainer appears to hand-edit code through GitHub's web file editor without properly using git, and Harp, whose SourceHut repo was blocked from inspection by bot detection.
- The author separately flags that Chompass, a calorie-tracking app, is hosted on Codeberg in a way the author believes likely violates Codeberg's terms of use.
Why it matters
F-Droid's appeal rests on being a curated, trustworthy alternative to commercial app stores for free and open source Android software, and users generally assume the apps there were written and reviewed by people who care about them. This informal review is an early attempt to actually test that assumption against a real batch of updates, at a moment when merging an LLM-written pull request has become close to effortless. Whatever the method's limits, the signals it looks for, agentic tooling checked into a repo, Claude-co-authored commits, AI-reviewed AI pull requests, point at a real shift in how much of "open source" software is now written by a machine rather than a person.
Who it affects
F-Droid users who install apps expecting community-vetted, human-maintained software; the maintainers of the reviewed repositories, some named and publicly tagged "Mostly AI" for their own projects, including Feeder, an RSS app the author says they personally use; F-Droid's curators, whose store's reputation for FOSS purity the piece implicitly tests; and Codeberg, which the author separately calls out over the Chompass calorie tracker's hosting there.
How to use it
The author's tiers double as a checklist anyone can run against a repository before trusting it: look for agentic-coding config files, such as a Claude Code or Codex setup, committed alongside the code; scan recent commit messages for "Co-authored-by: Claude" or similar; check whether pull requests are merged straight from bots or agents rather than reviewed by a maintainer; and note whether the README or app icon reads as AI-generated. None of these signals alone proves a project is unsafe, but together they are what pushed most of the reviewed apps in the portion of the list captured into "Mostly AI."
How solid is it
The author is upfront that the method is not rigorous: there is no automated detector, only a manual look at recent commits and a project's branding, and the tiers are described as "quite loose" with likely errors. Coverage is limited to one day's batch, the 102 updates F-Droid pushed on September 12, 2026, not the whole catalog, and only an app's most recent commits count toward its rating, regardless of how long the project has existed. Two entries could not be rated at all, DuressKeyboard for its unusual lack of real git history and Harp for a blocked repository, and the author discloses a personal dislike of LLM-assisted coding that is worth weighing against the individual calls.
Risks and caveats
By the author's own admission, mislabeling is likely: the tiers are superficial, and the line between "Mostly AI" and "Hard to say" rests on how a repo looks rather than a verified count of AI-written lines. Publicly tagging named, still-maintained projects as "Mostly AI" carries reputational stakes for their maintainers that a single reviewer's superficial pass cannot fully justify. The author also raises a legal caveat for Chompass, whose Codeberg hosting is said to likely violate Codeberg's terms of use, without detail on which term applies. The piece additionally airs, as the author's own opinion rather than a demonstrated finding, broader concerns about LLMs including skill atrophy, misinformation and climate cost, alongside praise for their role in Linux kernel bug-finding, offered as context rather than evidence tied to this specific review.
“But my god is it hard to find human-written software now.”
— the author