- Reliability 4/20
- Only the README was available; no MCP server manifest, source tree, tests, or CI logs could be inspected. The README claims a local Express backend, SSE, workflows, and MCP support, but nothing demonstrates an MCP initialization handshake or tool-list return at the repository root. Deducted for missing executable evidence and absent MCP protocol details.
- Security and permissions 7/20
- No malware or real secrets were found; the README describes local-first storage and API keys being sent only to configured providers. However, the local API surface is broad, and the .env.example implies default JWT/SESSION/ENCRYPTION_KEY values must be changed in production; no least-privilege model, no confirmation flow for destructive actions (delete/pay/deploy/remote commands), and no MCP permission boundary are documented. Deducted for missing permission/confirmation evidence and default-secret risk.
- Maintenance 8/20
- The repository is not archived, the README shows version 0.6.5, tag-driven release scripts, and CI/CD documentation; however, no commit history, dates, issue-response evidence, dependency-update policy, or security-response channel were provided. The license is declared as Custom License and GitHub reports NOASSERTION, weakening verifiable governance. Deducted for missing maintenance evidence and ambiguous license.
- Documentation 7/20
- The README is comprehensive for the AGNT application itself (install modes, architecture, providers, plugins, API families). But MCP-server specifics are absent: no server manifest, no client configuration example, no MCP tool schemas/limits, and no MCP troubleshooting. Deducted for missing MCP-layer documentation and unverified linked docs.
- Setup experience 4/20
- Install steps for the application are given (Node 18+, npm install, frontend install, npm start, port 3333), but there is no MCP client setup (e.g., JSON configuration), no one-command MCP launch, and no proof of a successful MCP connection. Production requires building the frontend and configuring secrets. Deducted for manual multi-step setup and no MCP client examples.