- Reliability 8/20
- This is a static review with no cached manifest and no CI workflow files or actual test source shown — only references to `npm test`/`npm run test:types` commands in the README, so the declared behavior of the 42 tools cannot be cross-checked against real implementation. The README itself discloses a known npx binary-resolution bug requiring a `cd /tmp &&` workaround, indicating a known fragility in the startup path. It also claims dual-protocol support (2026-07-28 plus legacy eras, stateless core) without verifiable evidence. Per the static calibration rule, without real CI plus committed tests covering key paths, the score cannot exceed 12; overall this sits at 'happy path plausible but evidence thin.'
- Security and permissions 11/20
- Credentials are passed via the `AIRTABLE_TOKEN` env var and examples use placeholders rather than real secrets — a positive sign. A scopes table is provided, but the Quick Start instructs users to 'grant all scopes listed' rather than the minimum needed, weakening least-privilege guidance. `create`/`update` are documented as requiring a dryRun diff review, and `delete_table`/`delete_field` require confirmation, but destructive operations like `delete_record`, `batch_delete_records`, `delete_webhook`, and `delete_comment` have no documented confirmation mechanism — an inconsistent safety design and a clear gap. Additionally, the one-command Claude Code installer uses `curl -fsSL ... | bash`, a common but risky pattern of executing an unreviewed remote script. These issues do not rise to the clear red-line bar of 'irreversible actions defaulting with no confirmation whatsoever' (since higher-impact table/field deletions do require confirmation), so this was not scored 0-4, but it warrants deductions into the 10-12 range.
- Maintenance 13/20
- The repo is MIT licensed, versioned at 5.1.0, and the README links to a CHANGELOG and a release-notes directory, indicating some release/version discipline. 87 stars and 0 open issues could reflect either low engagement or fast triage — insufficient evidence to distinguish. No SECURITY.md or explicit vulnerability-reporting channel is mentioned, and there is no verifiable recent commit/release timeline. Overall this shows signs of ongoing maintenance but with governance and security-response gaps.
- Documentation 16/20
- The README is fairly comprehensive: install examples for multiple clients (Claude Desktop, Claude Code, Codex, Cursor, Windsurf, VS Code), a token-scope table, an environment-variable table, the full list of 42 tools with brief descriptions, 10 AI prompt templates, a troubleshooting section, and project structure — reasonably well layered. However, tool-level input/output schemas are not documented (only one-line descriptions), there is no discussion of Airtable API rate limits, quotas, or cost implications, and the troubleshooting section is generic rather than tied to specific tool error conditions, so it falls short of full marks.
- Setup experience 13/20
- The project offers a no-install npx path and a one-command curl installer, with concrete configuration examples for several mainstream clients — overall a clear, low-step path to a working connection. However, per the static calibration rule, setup cannot score above 15 absent verifiable execution evidence (real CI plus tests covering key paths). The README's own disclosure of an npx binary-resolution issue and its workaround also signals the install path is not fully robust, warranting a further deduction within that ceiling.