- Reliability 10/20
- The README describes ainl-mcp, multiple tools, exposure controls, limits, diagnostics, and numerous test and CI entry points, providing evidence of a reviewable intended path. However, the server manifest is not cached, so declared tools cannot be checked against implementation; no MCP initialization, tool-list handshake, or tests were executed, and the supplied README is truncated at the end. This supports a plausible happy path but warrants deductions for missing verifiable execution evidence.
- Security and permissions 11/20
- The README identifies core-only default adapters, exposure profiles, capability grants, run limits, HTTP/A2A host controls, redirects off by default, SSRF options, and a security report, showing some least-privilege structure. It also exposes potentially high-impact HTTP, filesystem, SQLite, queue, external-LLM, A2A, Solana, payment, and installation capabilities. The source provided does not establish the actual defaults, complete parameters, confirmation behavior, credential flows, or manifest-level boundaries, so substantial points are deducted. No explicit malicious behavior or real secret was found that would trigger a security red line.
- Maintenance 15/20
- The repository is stated to be non-archived, uses Apache-2.0, and documents release surfaces through versions 1.3.4–1.8.0, release hygiene, contribution paths, SECURITY.md, and vulnerability-reporting areas, with identifiable ownership. There is no supplied evidence of commit cadence, dependency-update practice, issue-response performance, or a concrete security-response process, so the score is below full marks.
- Documentation 15/20
- The README supplies layered installation paths, CLI/HTTP/MCP usage, host integrations, limits, exposure profiles, security concepts, adapters, examples, troubleshooting entry points, benchmark methodology, and disclosed limitations. Points are deducted because the manifest is missing, complete MCP tool parameters and actual behavior cannot be independently reconciled, several performance and product claims depend on files not supplied here, and the provided README excerpt is incomplete.
- Setup experience 13/20
- The source provides pip/pipx installation, ainl setup --auto, stdio startup instructions, a generic MCP configuration fallback, and host-specific commands, making the intended setup fairly clear. Points are deducted because Python 3.10+ is required, host integrations still vary in configuration and additional steps, the manifest is unavailable, and installation or connection was not verified in this static review.