- Reliability 11/20
- README and server.json are mutually consistent: local stdio transport, npx launch, read-only SQL, three well-scoped tools (health_schema/health_query/health_report), with disclosed memory cap, explicit fail-rather-than-spill behavior, per-process DuckDB rebuild and no date window. Path looks plausible. However, per the static calibration rule, the repository shows no verified CI workflows and no committed tests covering the server's key paths (README only mentions an npm test command), so init/handshake and tool-behavior parity cannot be confirmed; CSV-layout-only support and duplicate-measurement handling (sourceName) remain unverified edge cases. Scored at the "plausible happy path, thin tests/edge cases" anchor.
- Security and permissions 15/20
- No credentials, tokens or network uploads; data is read locally, nothing is spilled to a temp directory, only READ_ONLY queries are exposed, and HEALTH_DATA_DIR is the single required input—an appropriately narrow scope. README discloses that results passed to the MCP client may reach that client's model provider and warns to only attach trusted clients, which is clear data-flow disclosure. Deductions: no described confirmation mechanism for sensitive operations, no sandboxing/hardening guidance, and no dependency-audit or lockfile evidence for the DuckDB/npm supply chain. No red line is triggered.
- Maintenance 12/20
- MIT license, semantic version 1.4.2, published npm package, only 5 open issues and not archived indicate active maintenance. But stars (567) are a discovery signal only and add no points; there is no evidence of commit/release dates, issue response time, a security-response channel (SECURITY.md), or a dependency-update policy (e.g., Dependabot). Governance and versioning transparency gaps keep this mid-range rather than full marks.
- Documentation 15/20
- Docs are layered: runtime requirement (Node 22), export-app steps, Claude Desktop config example, env-var table with required/defaults, tool-purpose table, pointers to the data-model/querying guide, memory estimation (~1 GiB for two years), and explicit limitations (no export.xml support, no date window, no persistent incremental import, not medical advice). Gaps: no per-tool parameter detail with example outputs, no troubleshooting section, no quantified cost/performance boundaries, and no separate security/privacy policy document, so it falls short of the top anchor.
- Setup experience 14/20
- The install path is clear: a single npx -y command with a copy-pasteable JSON config; only HEALTH_DATA_DIR is required, with sensible defaults for the rest, and a mainstream client (Claude Desktop) example is provided. However, users must first install the third-party iOS app Simple Health Export CSV, export, unzip and transfer CSVs to the host, plus have Node 22+; platform compatibility (Windows/Linux) is untested/undeclared and the proprietary-app prerequisite is a non-standard manual step. Given the static cap of 15 and the manual, mildly fragile prerequisite, it stays below that ceiling.