- Reliability 11/20
- The project is a mature CLI tool with a well-documented MCP server startup command (`backlog mcp start`) and client integration commands. However, there is no separate server manifest file, and no dedicated MCP server tests or explicit CI evidence verifying the MCP handshake. The primary reliability evidence comes from the CLI's maturity and widespread use (dogfooded), but static review cannot confirm actual MCP initialization and tool-list behavior. Therefore, per static calibration, award no more than 12, and deduct for lack of tests and CI evidence specific to the MCP path.
- Security and permissions 14/20
- The tool is local-first by default, with no telemetry, and data is stored in local files only. The MCP server is started via `backlog mcp start` and supports `BACKLOG_CWD` and `--cwd` to pin the project. Documentation emphasizes that remote Git operations are optional and the server only operates within the client's MCP roots. No sensitive credential handling or external network calls were found. However, permission and confirmation mechanisms are not explicitly documented for MCP, and dangerous operations like rename/delete may require confirmation but are not clearly mentioned. Thus, no red lines triggered, but explicit least-privilege and confirmation statements are lacking, giving 14.
- Maintenance 17/20
- The repository is highly active, with 6414 stars, 37 open issues, and not archived. README shows frequent version updates (e.g., v1.40) and mentions progress. MIT license is explicit. Evidence of sustained maintenance includes release history, community tools (VS Code extension), and public talks. No security-response channel seen, but overall strong maintenance, giving 17.
- Documentation 17/20
- Documentation is comprehensive, including full CLI reference, advanced configuration guide, troubleshooting (e.g., Apple Silicon) and detailed MCP client configuration examples (Claude Code, Codex, Gemini CLI, etc.). Workflow guides are also included. However, details on MCP tool parameters, limits, and costs are missing, and installation README lacks step-by-step for all platforms. Layered docs with sufficient examples are present, but some hidden assumptions (e.g., need to initialize project first) exist, thus deducting to 17.
- Setup experience 13/20
- Installation is simple: `npm i -g backlog.md` or `npx backlog.md`. Multiple platforms (macOS, Linux, Windows) are supported with Homebrew and Nix. MCP setup requires first running `backlog init` then configuring the client, with clear commands for each client. However, manual config requires environment variables or args, and troubleshooting steps are not provided. Static review lacks execution evidence, so cap at 15, and complexity of external runtime (Node/Bun) increases fragility, giving 13.