- Reliability 3/20
- The static material provides no cached server manifest, transport details, tool list, parameter schemas, initialization-handshake evidence, tests, or CI coverage. The README merely claims MCP integration, so startup success and consistency between declared and actual tools cannot be verified; substantial points are deducted, and static calibration prevents a score above 12.
- Security and permissions 8/20
- The README mentions token-security rules, scoped deployment, optional native features, signed releases, and supply-chain verification, but these are unverified documentation claims. There is no evidence for an MCP-specific permission model, authentication, data flows, network scope, confirmation of dangerous actions, or isolation boundaries, so least privilege and controllable side effects are unproven. No explicit fact establishes a security red line.
- Maintenance 11/20
- The repository is not archived and has an MIT license, 168 stars, and 1 open issue; the README also describes versioned releases and signing. These provide only basic maintenance signals. There is no evidence of commit cadence, actual release history, dependency updates, a vulnerability-response channel, or MCP-specific ownership, so significant points are deducted.
- Documentation 8/20
- The README is extensive for the overall framework, installation, platform deployment, troubleshooting, and feature inventory, but its MCP coverage is only high-level. It lacks reviewable server-manifest details, tool parameters, connection configuration, authentication, limits, error behavior, cost information, and MCP troubleshooting. Conflicting counts and platform claims in the README also reduce confidence, so a high score is not justified.
- Setup experience 4/20
- The README gives Node.js and CLI installation steps and mentions MCP as an integration surface, but it provides no server-specific launch command, transport configuration, mainstream MCP-client example, authentication procedure, or tool-verification workflow. Because the MCP setup path is not reproducible from the supplied material, the score is low.