- Reliability 8/20
- This repository is an MCP client (AI as Workspace), not an MCP server; no server manifest is provided at the repository root, so a static review cannot verify MCP initialization, the tools/list handshake, or whether declared tools match real behavior. The README only states support for Tools/Prompts/Resources over STDIO and HTTP, with no committed tests covering those key paths and no visible CI workflow evidence, which caps reliability at 12 under static calibration. The README explicitly marks the project deprecated in favor of Nya AI, further weakening confidence in clean startup. The feature set and stack (Quasar/Vue, local-first) are plausible and the happy path seems workable, but absent reproducible execution evidence and edge/error-handling detail, it scores 8.
- Security and permissions 11/20
- No signs of malware, credential theft, or covert exfiltration were found, and no real tokens or secrets appear in examples, so no red line is triggered. However, static evidence shows multiple external-network and side-effect paths: STDIO and HTTP remote MCP servers, marketplace and Gradio plugin installation, SearXNG web search and URL crawling, and cloud sync. The README and docs do not disclose a least-privilege model, confirmation flows for external MCP calls, plugin sandbox boundaries, or data-flow details (encryption and location of synced local-first data). Artifact read/write permission control is mentioned but lacks concrete scope and confirmation detail. Main risks are visible while permissions, confirmation, and scoping are incomplete, so slightly above the 10 anchor, scoring 11.
- Maintenance 6/20
- A clear open-source license (BSD-3-Clause) is present, and stars and issue counts indicate prior community use, but the README's first line declares the project deprecated and succeeded by Nya AI with a migration guide, indicating maintenance has ended, with no ongoing issue fixes or dependency updates. No release cadence, security-response channel, or governance structure is evidenced. Against anchors of 0 for archived/abandoned and 10 for active with governance gaps, this sits on the abandoned side but retains a license and a history of activity, scoring 6.
- Documentation 12/20
- The README plus docs-site links (usage, self-hosting, MCP, Artifacts, plugins, prompt variables, migration) form a reasonably layered set covering feature overview, dependency install (pnpm i, quasar dev/build), platform support, and the plugin ecosystem, making it usable documentation. It lacks MCP client connection config examples, external-server auth methods, tool parameter and limit descriptions, cost and rate-limit notes, and a troubleshooting section. No contradictions between the README and claimed capabilities, matching the 10 anchor. Detail is adequate but hidden assumptions and troubleshooting gaps remain, scoring 12.
- Setup experience 10/20
- The install path is given via dependency install and build commands (pnpm i, quasar dev, quasar build, build -m pwa), with a web version, download page, Microsoft Store listing, and self-hosting guide. Client configuration examples for mainstream clients are absent (as a client rather than a server, there is no example of wiring it into Claude/Cursor). Steps depend on a Node/pnpm runtime and the Quasar toolchain, a workable but manual flow requiring self-managed build and deployment. Under static calibration with no execution evidence, setup is capped at 15; given clear multi-platform distribution channels but missing connection config examples, it scores 10.