- Reliability 8/20
- The manifest specifies an identifiable npm package, streamable HTTP transport, authentication headers, and a port, while the README describes the API/MCP service and several operating modes, so a normal initialization and tool-list flow is plausible. However, this is a static review with no source code, CI, or committed tests proving MCP handshake behavior, tool fidelity, error handling, or dependency control. The manifest default port 3000 also conflicts with the README's API port 3013, so substantial points are deducted.
- Security and permissions 9/20
- The API key is supplied through a required secret environment variable and an Authorization Bearer header, remote transport uses HTTPS, and the materials describe local-instance and agent-ID boundaries. No malware, credential theft, real secrets, or other red-line issue is evidenced. However, the system can orchestrate Docker workers, persistent memory, external integrations, scripts, and third-party routes, creating a broad side-effect surface. There is no source evidence for least privilege, tenant isolation, dangerous-operation confirmation, auditing, or data-flow controls, so the score remains moderate.
- Maintenance 12/20
- The repository is not archived and provides an MIT license, an identifiable maintainer organization, version 1.129.0, documentation, and contribution paths. The README also claims daily evolution, which is a positive maintenance signal. Still, there is no reviewable commit history, release cadence, dependency-update evidence, CI status, vulnerability-response process, or explicit security contact. The issue count alone does not demonstrate response quality, so points are deducted.
- Documentation 14/20
- The README covers architecture, use cases, integrations, CLI, deployment, Docker, environment-variable entry points, workflows, and many linked guides. It includes onboarding, npm/npx, and Docker examples, providing relatively broad layered coverage. It does not provide reviewable per-tool parameters, permission boundaries, limits, cost information, troubleshooting, or complete mainstream-client configuration evidence. The port examples also conflict with the manifest, and many capabilities remain unverified claims, so points are deducted.
- Setup experience 11/20
- The project offers bunx/npx onboarding, manual Docker Compose setup, API/worker/lead commands, and local endpoints, making a working instance plausible after runtime preparation. It still requires Docker, at least one harness credential, environment-file editing, and potentially additional integration configuration. No complete mainstream MCP-client connection example is supplied, remote deployment guidance is summarized rather than operationally complete, and the 3000/3013 port mismatch adds fragility, so the score is moderate.