- Reliability 10/20
- The only supplied material is the README, the server.json manifest, and repository metadata; no source files, package.json, tests, or CI workflows are provided. We can see the npm identifier, version 1.0.7, and a declared stdio transport, but there are no committed tests and no CI evidence that the MCP init and tool-list handshake completes, so the static calibration caps reliability at 12. The server claims to auto-generate MCP tools from Anytype's OpenAPI spec (global/space search, spaces and members, objects and lists, properties and tags, types and templates); without the generation logic and error-mapping code, argument validation, failure diagnostics, and dependency behavior are uncontrollable and unverifiable. 26 open issues further suggest edge paths may be rough. Score 10: the happy path is plausible, but tests, error handling, and dependency boundaries are opaque.
- Security and permissions 11/20
- Credential handling: OPENAPI_MCP_HEADERS is marked is_secret and required, and the README instructs users to embed a Bearer API key as a JSON string directly in client config files, a common but weak practice with no OS keychain or encrypted storage support. On the plus side, the key is locally generated by the Anytype app and the server defaults to a loopback endpoint (http://127.0.0.1:31009), so the data boundary is largely local and external network exposure is limited. No malware, covert exfiltration, fabricated maintainer identity, or example containing real tokens was found, so no red line applies. Deductions: no disclosed confirmation or dry-run mechanism for dangerous operations (deleting objects/spaces, member changes, bulk edits), no least-privilege or scope statement, and ANYTYPE_API_BASE_URL can redirect traffic to an arbitrary host without any accompanying warning. Score 11: main risks are visible and no red line, but permission scoping and confirmation are incomplete.
- Maintenance 14/20
- There is clear organizational ownership (Anytype/anyproto, a Swiss association) and an MIT license; the README provides a security contact ([email protected]) plus links to code-of-conduct and contributing guides; the manifest shows an active 1.0.7 release and ongoing npm publishing, so the maintenance chain is broadly sound. Deductions: no commit cadence, release timeline, dependency-update policy, or support window is given, and there is no evidence of issue response for the 26 open issues; versioning and governance details must be inferred. Score 14: license, ownership, and security channel are clear, but versioning and governance transparency have gaps.
- Documentation 14/20
- Documentation is layered: installation (npx, global install, claude mcp add), two ways to obtain an API key (in-app and CLI), config snippets for several clients (Claude Desktop, Cursor, Windsurf, Raycast, LM Studio, Kiro), custom API base URL with port notes (31009/31012), and natural-language interaction examples that are copy-paste ready. Deductions: there is no tool inventory or per-tool parameter/return documentation, no pagination, rate-limit, cost, or troubleshooting section, and the exact set and naming of the OpenAPI-derived tools is undisclosed, so users cannot predict which capabilities the assistant will call; error formats are also undocumented. Score 14: usable to get started, but with hidden assumptions and troubleshooting gaps.
- Setup experience 15/20
- The install path is short and clear: `npx -y @anyproto/anytype-mcp` runs the server, and the docs supply mainstream client JSON configs plus a single claude mcp add command and one-click deeplinks, so a user only needs to substitute an API key to connect; no leaked tokens were observed. Deductions: it still depends on the Anytype desktop app enabling its local API and issuing a key, and the differing default local port versus anytype-cli's port requires manual ANYTYPE_API_BASE_URL configuration; no Node/Bun runtime version requirements, Windows/macOS/Linux compatibility notes, or troubleshooting steps are given (the from-source build requires Bun, an extra barrier for newcomers). Under the static calibration, without real CI and test evidence setup may not exceed 15. Score 15: solid config examples and a clear path, minus external dependencies and absent automated verification.