- Reliability 4/20
- No server manifest was cached, and the README lists no MCP tool names, parameters, input/output schemas, or error-handling conventions. The repository reads more like a desktop client that can 'add/manage' external MCP servers (the README describes a 'Visual MCP manager' for adding third-party MCP servers) rather than clearly exposing itself as an MCP server with tools — this fundamental ambiguity cannot be resolved from the static material provided. No visible CI workflows or committed tests demonstrate the init + tool-list handshake succeeding. Per the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence, and given the severe evidence gap it is scored even lower at 4.
- Security and permissions 8/20
- Several permission/data-boundary concerns are present: 'Computer Use' lets the agent take screenshots, click, type, and control desktop apps (stated as gated 'after authorization' but with no detail on authorization granularity or revocation); one of the 'five permission modes' explicitly allows 'skip permissions,' bypassing confirmation for risky operations when selected; IM integrations (WeChat, Feishu, DingTalk, Telegram, WhatsApp) and H5 remote access allow driving the agent remotely through third-party messaging channels, expanding the attack surface and potential for credential/session hijacking. The README does not describe how API keys/credentials are stored, least-privilege design details, or data-egress boundaries, nor any security-response channel. Because risks are visible but explicit default safeguards, confirmation mechanics, and data-flow disclosure are incomplete (though authorization/confirmation is nominally mentioned), this falls short of a red-line 0-4 score but is scored in the low-middle range.
- Maintenance 15/20
- The repository is not archived, uses the MIT license, has a high star count (13,926), and 135 open issues indicate ongoing user engagement; the README lists sponsors, a contact email, a dedicated documentation site (cchaha.ai), and a Feishu user community, showing clear ownership and communication channels. However, no release history, changelog, or dependency-update cadence is provided, and there is no described security-response process, so recent commit/release activity cannot be verified directly — preventing a top score.
- Documentation 14/20
- Documentation is fairly extensive, with layered links covering getting started, desktop features, IM integrations, CLI usage, and internal architecture. However, because the server manifest was not cached, no concrete MCP tool parameters, invocation examples, rate limits, or cost disclosures appear anywhere — core content expected for an MCP server review is missing. A troubleshooting doc is referenced but its actual content is not present in the supplied material, so its quality cannot be verified, resulting in a deduction.
- Setup experience 9/20
- Two install paths are given: downloading a desktop installer, or running from source via `bun install` + `.env` configuration + `./bin/claude-haha`, with clearly described steps and known caveats for macOS signing/notarization and Windows SmartScreen. However, there is no configuration example for connecting this project as an MCP server to a mainstream client (e.g., a mcp.json snippet), and no CI/test evidence that these steps reproducibly work. Per the static calibration rule, setup is capped at 15 without such evidence, and it is scored in the low-middle range given the missing client-integration example and verifiable execution proof.