- Reliability 4/20
- The README alone cannot confirm that the MCP server starts cleanly, completes the init and tool-list handshake, or that declared tools match actual behavior. No source code, tests, or CI artifacts are provided as verifiable execution evidence, and error paths/dependencies cannot be diagnosed. Under static review and missing-evidence rules, I deducted rather than assumed a happy path, so the score is 4.
- Security and permissions 6/20
- The README discloses anonymous telemetry and an opt-out environment variable, and there is no indication of malware, credential theft, or covert exfiltration, so no red line was triggered. However, communication relies on an unauthenticated TCP socket, no confirmation mechanism is mentioned for mutation commands affecting the Ableton session, and source-level verification of data boundaries and least privilege is impossible. Score is 6, with deductions for missing authentication, operation confirmation, and auditable data-flow disclosure.
- Maintenance 8/20
- The repository is not archived, has an MIT license, and names a maintainer, but those are only baseline facts. There is no evidence of commit frequency, releases, dependency updates, or a security response channel; 64 open issues alone do not prove active maintenance. This matches the anchor of 'active but governance/versioning gaps', so the score is 8.
- Documentation 11/20
- The README is fairly comprehensive: it covers installation, Claude/Cursor configuration, Remote Script deployment, capabilities, example commands, troubleshooting, the TCP protocol, limitations, and telemetry opt-out. It is deducted because tool-by-tool parameters, detailed error diagnostics, a changelog, and reviewable verification evidence are missing, and hidden assumptions remain (e.g., Ableton Remote Script folders vary by OS and version). Score is 11, not full marks.
- Setup experience 8/20
- The setup path is described clearly, with examples for Smithery, Claude Desktop, and Cursor. However, it still requires Ableton Live, Python, uv, and manually copying the Remote Script into version-dependent Ableton directories, plus the documented constraint to run only one MCP instance. This is manual and fragile, and no execution evidence exists to verify the steps. Conservatively, the score is 8.