- Reliability 10/20
- README claims CI badge, a structured test directory (9 lib tests, 2 tool tests, server smoke test), and an eval harness, but a static review cannot verify the tests actually cover key paths; manifest and npm versions align (0.16.1), and stdio transport, Node >= 20.18.1, 5K/50K truncation, and error paths (empty extraction, Figma's external-MCP dependency) are documented. Under static calibration this stays at or below 12; scored 10 because claimed tests and error handling are plausible but not verifiably executed.
- Security and permissions 12/20
- No red-line behavior: local-first, network limited to user-directed fetches, optional Brandcode connector, and optional brand_feedback; connector credentials in gitignored .brand/brandcode-auth.; hosted side is read/append-only with bearer-key auth and explicit capture scope; install is dry-run by default, deep-merges, and backs up. Deductions: credential permission details not shown, hosted service is pre-release/approved-only, and data-boundary claims rest on README self-description rather than inspectable code.
- Maintenance 12/20
- MIT license, SECURITY.md private reporting channel, CI badge, npm version advanced to 0.16.1, and specs/eval directories indicate sustained engineering. Deductions: no static evidence of release cadence, dependency-update policy, or issue responsiveness; 14 open issues against 10 stars with no stated triage; the hosted half is not public.
- Documentation 14/20
- Layered docs: per-client setup, CLI reference, tool tables, .brand file details, confidence/source-precedence model, troubleshooting (empty extraction, Figma, logo, 5K limit, startup failures), and eval methodology with disclosed limitations (static-CSS parsing limits, pre-release hosting). Deductions: cost/quota information absent, tool parameter details deferred to code, and Claude Design integration claims lack independent evidence.
- Setup experience 14/20
- Clear install path: npx install supports multiple clients (Claude Code/Cursor/Windsurf/Cline/Codex/Claude Desktop) with .mcp. examples, dry-run default, deep-merge with backup, plus doctor/inspect diagnostics. Deductions: static rules prevent verifying the install actually works; Figma flow requires a separate MCP server and headless Chrome is an implicit dependency, adding setup complexity.