- Reliability 8/20
- The README documents multiple connection paths (hosted OAuth, npx mcp-remote bridging, local stdio self-hosting) and links out to docs/tool-surface.md and others, indicating the tool surface is documented, but no server manifest was available (marked 'not cached') and no CI workflow files or committed tests were provided as verifiable execution evidence. Per the static calibration rule, reliability is capped at 12 without real CI plus tests covering key paths. Since there is no way to confirm declared tools match actual behavior or how errors/dependencies are controlled, this is judged as 'plausible happy path but thin evidence,' scoring 8.
- Security and permissions 12/20
- The hosted service uses an OAuth 2.1 browser flow with explicit scope approval and no plaintext keys appear in setup examples; the self-hosted mode uses a project API key, a standard practice not exposed with real secrets in the docs — no red line is triggered. However, the Appwrite MCP server exposes backend operations across databases, users, functions, and storage, and the README gives no detail on confirmation steps or least-privilege scoping for potentially destructive actions (e.g., delete, deploy), and no tool-level permission manifest was available to verify. This evidence gap caps the score at a moderate 12 rather than higher.
- Maintenance 13/20
- The repo is MIT-licensed, not archived, has 71 stars and 4 open issues, and the README displays an MCP Registry version badge indicating an active publishing/versioning pipeline. However, no commit history, release cadence, issue-response times, or dependency-update policy were provided as evidence, so activity level cannot be fully confirmed, yielding a moderate 13.
- Documentation 16/20
- Documentation is well-layered: the README provides concrete configuration snippets for over a dozen mainstream clients (Claude Code, Claude Desktop, Cursor, VS Code, Codex, OpenCode, Windsurf, Gemini CLI, Antigravity, GitHub Copilot CLI, Zed, Warp, JetBrains, Cline) and links to separate docs for tool surface, authentication, documentation search, self-hosting, local development, and contributor guidelines. However, detailed tool parameters, limits, cost, and troubleshooting content are not directly included in the provided material and can only be inferred to exist via external links, so it falls short of full marks at 16.
- Setup experience 14/20
- For the hosted server, setup is streamlined — most clients need only a short config block or single command, with browser-based OAuth removing the need to manage keys; self-hosting is also separately documented. Per the static calibration rule, setup cannot exceed 15 without verifiable execution evidence (real CI plus tests covering key paths), and the absence of a cached manifest means the described setup steps could not be independently verified, resulting in a score of 14.