- Reliability 8/20
- The described architecture (local MCP server + browser extension + OpenAI Secure MCP Tunnel) is internally coherent and unusually detailed: a tool table, structured error semantics (COMPACTION_IN_PROGRESS, UNIDENTIFIED_CALLER), fail-closed identity checks, and explicit edge-case handling for compaction and worker slots. A quick-start and troubleshooting section give a plausible reproducible startup path. Deductions are substantial under static review: the SERVER MANIFEST is '[not cached]' and no MCP manifest (server.json or equivalent) is present at the repository root; the README claims `npm run verify` (typecheck, tests, privacy gate) and CI, but no committed workflows or test files are visible to verify; the release is self-described as an unsigned beta requiring a version-matched unpacked extension, plus external tunnel-client and Chrome 116+, where any mismatch breaks the handshake or tool list. With no verifiable execution evidence, the static calibration caps reliability at 12, and the missing verifiable tests/CI keep it in the mid-to-low band.
- Security and permissions 11/20
- Positive evidence is strong: the MCP server is loopback-only behind a random secret path, the browser bridge is separate and exposes no file/command/settings routes, secrets go through Electron safeStorage (DPAPI/Keychain/libsecret/KWallet) with Linux refusing the basic_text fallback, file tools canonicalize and confine paths to approved folders, a single read-only kill switch exists, connection requires a restricted API key scoped to Tunnels: Read/Use, and the README discloses that commands are not folder-sandboxed, desktop control covers the whole screen/input, external MCP plugins run outside CoS's sandbox, and the extension's UI automation may implicate OpenAI's terms. Deductions: high-impact capabilities (command execution, desktop control, clipboard writes) are enabled by default on a fresh Windows install with no per-action confirmation described; the unsigned self-updater relies on checksum verification and the release channel; the extension's UI observation/typing is not a documented API and carries ToS and account risk. No red line is crossed (no malware, credential theft, covert exfiltration, or unconfirmed irreversible defaults), so it is not scored in the 0-4 band, but permissive defaults and the absence of mandatory confirmation hold it at a middle score.
- Maintenance 10/20
- The repository narrative shows release cadence (a 2.0.8 change, CHANGELOG, a release workflow described as running on native Windows/macOS/Linux runners with pinned-and-verified tunnel-client and ripgrep assets), an MIT license, a SECURITY.md private-reporting channel, CONTRIBUTING.md, AGENTS.md as a design record, and published artifacts such as SHA256SUMS and the extension zip; 1662 stars indicate some user attention (a discovery signal only, not scored). Deductions: static review cannot confirm real CI workflows, commit history, last release date, or issue response; the README itself admits beta status, unsigned/un-notarized builds, and features 'not yet verified across every supported desktop environment'; heavy reliance on external services (OpenAI tunnel-client, OpenRouter) adds third-party maintenance risk. It reads as active but with governance/versioning verification gaps.
- Documentation 13/20
- Documentation is the strongest dimension: an install matrix across Windows/macOS/Linux x x64/ARM64, prerequisites (Chrome 116+/Edge, Linux keyring, ChatGPT Developer mode and plan constraints), step-by-step tunnel setup with the exact restricted API key permissions, custom app creation, extension sideloading, a per-tool table with parameter semantics and error returns, plus dedicated 'Security in one page', 'Browser behavior', and 'Troubleshooting' sections. It also discloses limits such as local token estimates not being the provider counter, Pro never auto-compacting, up to 8 workers (2 default), a ~400k token worker ceiling, 30-day retention, and per-user data paths. Deductions: key contracts (docs/tool-surface.md, docs/plugins.md, CHANGELOG.md, AGENTS.md) appear only as links whose content cannot be verified statically; some guidance is version-conditional (2.0.6 vs current source, protocol-13) and easy to misread; cost/rate-limit guidance and plan-dependent availability are stated loosely.
- Setup experience 9/20
- The install path is generally clear: prebuilt installers per platform plus a manual extension zip, explicit 'verify the hash first' guidance, a five-step quick start (install, approve a folder, create tunnel + restricted API key and connect, create Core/Desktop apps in ChatGPT, load the extension), and concrete pointers to Platform Tunnels/API keys with the needed permissions. Deductions: the main path depends on manually loading an unpacked Chrome extension and pressing Reload after every app update, a fragile manual step; users must create an OpenAI Secure MCP Tunnel (or Cloudflare/own HTTPS tunnel) with a restricted key, a high barrier for non-experts; packaging must be done on the target OS; unsigned/un-notarized builds trigger OS warnings; and the docs state the custom app's reviewed action list may need manual refresh in ChatGPT. With no execution evidence, setup is capped at 15, so it lands in the 'workable but manual/externally dependent' band.