- Reliability 4/20
- The repository root provides no reviewable server manifest, and the README states that actual reading is delegated to multiple upstream CLI/MCP tools. Therefore MCP initialization, tool-list handshakes, and declared-versus-real behavior cannot be verified. The README claims backend probing and doctor diagnostics, but provides no committed tests, CI, or reproducible execution evidence; substantial points are deducted under the static-review rule.
- Security and permissions 8/20
- The README claims that cookies and tokens remain local with mode 600, and documents safe and dry-run modes as well as the account risk of treating cookies as full login credentials. Points are deducted because no implementation, data-flow evidence, permission boundary, or confirmation mechanism is reviewable. The default installation also auto-installs Node.js, gh CLI, mcporter, and other system dependencies and configures external services, so the claimed controls cannot be verified from the supplied material.
- Maintenance 12/20
- The project states that it uses the MIT license, is actively maintained, replaces failed backends, and provides an update path and GitHub Issues. Its non-archived status and large issue count indicate ongoing attention, but popularity is not scored. Points are deducted because the supplied material lacks verifiable release history, commit evidence, dependency-update policy, response targets, or a formal security-response channel.
- Documentation 13/20
- The README covers supported platforms, zero-configuration and login-state requirements, installation, updating, uninstall, safe mode, dry-run, diagnostics, cost notes, and capability limits, with several platform restrictions disclosed. Points are deducted because there is no manifest, tool schema, parameter/return-value documentation, error contract, or test evidence; many capabilities and backend selections remain unverified documentation claims.
- Setup experience 9/20
- The README provides a one-line installation flow aimed at Claude Code, OpenClaw, Cursor, and similar clients, and explains some permission, login-state, and server-proxy prerequisites. Points are deducted because the path depends on a remote installation document, runs pip and system-infrastructure installation, and provides no concrete MCP client configuration, connection example, or verified end-to-end evidence. Platforms requiring cookies or browser login state remain materially more complex.