- Reliability 7/20
- This repository is actually a general-purpose Cloudflare Agent SDK (state, scheduling, voice, workflows, payments, etc.), with MCP being just one of many features rather than a standalone runnable MCP server. No server manifest was cached, and 'repository root' is not a clear single entry point — the README only points to example directories like examples/mcp-server and mcp-worker without showing an actual MCP init/tool-list handshake or verified tool behavior. The README mentions vitest/vitest-pool-workers and Playwright test tooling, indicating some test infrastructure exists, but no CI workflow file or evidence that tests cover the MCP-specific code paths was provided, so per the static calibration rule this cannot score above the capped range.
- Security and permissions 11/20
- The framework includes several higher-risk capabilities — the x402 payment protocol (potential real payments), email send/receive, sandboxed code execution, and MCP client/server connectivity — but the README does not specify their permission scope, least-privilege design, or how credentials are handled. The only visible risk-mitigation signal is that 'Workflows' explicitly mentions human-in-the-loop approval, implying some irreversible actions have a confirmation gate, but this isn't shown to extend to payments, email, or other risky features. No exposed secrets or hard red-line issues were found, but overall permission boundaries and data-flow disclosure are insufficient.
- Maintenance 15/20
- The project uses pnpm workspaces with Nx for task orchestration, has a changeset release process, and lint/typecheck/test scripts, indicating solid engineering practices and active maintenance. MIT license is clear, high star count and issue activity suggest a real user base, and the repo is not archived. However, the README shows no explicit release/version history, security-response channel, or vulnerability disclosure process, and the project states it 'is not accepting external pull requests at this time,' which may limit community contribution — so it does not receive a top score.
- Documentation 14/20
- The README is well organized, listing a feature table, package structure, 30+ example demos, guides, and design decision records, and links out to the official docs site (developers.cloudflare.com/agents), suggesting a layered documentation approach. However, this review only has access to the README itself — specifics for the MCP feature (tool parameters, authentication, rate limits, cost, troubleshooting) are not directly shown and would require inspecting examples/mcp-server and related directories, leaving hidden assumptions about documentation depth unverified.
- Setup experience 9/20
- The README provides two install paths (scaffold template or npm install) plus a wrangler.jsonc configuration example, giving reasonably clear top-level steps. However, this is the setup flow for building a general agent app, not specific instructions for connecting an MCP client, and it additionally requires a Cloudflare account, Durable Objects bindings, and SQLite migrations — a moderately complex multi-step setup limited to the Cloudflare Workers platform. Without verifiable execution evidence (e.g., an actual client connection or CI validation), the static review rules prevent a high score here.