- Reliability 4/20
- Only the README and server manifest were supplied; no source code, tests, or CI workflows were available. It is impossible to verify clean startup, the MCP init/tool-list handshake, or whether declared tools match real behavior. Following static calibration, absence of executable evidence forces a conservative score of 4.
- Security and permissions 10/20
- The README claims no DELETE operations, dangerous tools disabled by default via BITBUCKET_ENABLE_DANGEROUS, and credentials passed via environment variables. Installation examples use placeholders, so no real secrets are leaked. However, credential handling, log redaction, network egress scope, and confirmation of dangerous operations cannot be verified from source; data-flow disclosure is also incomplete, so the score is capped at 10.
- Maintenance 10/20
- The repository is not archived, has an MIT license, version 5.0.5, and badges for CodeQL and npm, suggesting ongoing releases. Still, there is no direct evidence of commit frequency, release dates, or issue responsiveness, so sustained maintenance cannot be fully confirmed; a middle-ground score of 10 is appropriate.
- Documentation 14/20
- The README is extensive: installation steps, environment variable table, tool parameters, pagination controls, auth troubleshooting, Cursor integration JSON, and local-build examples are all present. Deductions are made for repeated pagination blocks, minor typos such as 'Checkout out', and missing disclosure of costs, rate limits, and deeper failure modes; final score is 14.
- Setup experience 14/20
- Both npx and npm global/project install options are documented, the environment variable table is clear, and client configuration examples for Cursor plus a local build path are provided. The setup is short and actionable. However, no executable CI test or run log proves the end-to-end install always works, so per static calibration the maximum is 15; with no major flaw, a score of 14 is given.