- Reliability 6/20
- The README presents a coherent architecture, a quick-start flow, and an engine compatibility matrix with tested versions, so the happy path is plausible and a test command is referenced in the contributing guide. However, the server manifest was not cached and the supplied evidence contains no CI workflow contents or committed tests, so the MCP init/tool-list handshake and the claimed 65 tools cannot be verified against real behavior. Under static calibration the README is untrusted evidence; with no verifiable execution evidence the score must stay below 12.
- Security and permissions 8/20
- No red-line findings: no malware indicators, credential theft, covert exfiltration, or real tokens in install examples are visible in the source. The README documents BYOK, cookie-based dashboard auth, and a CLAWO_MCP_TOOLS allowlist, showing some boundary control. Yet the server's core function is executing coding CLIs as subprocesses plus autonomous and deploy-style workflows, and the README gives no confirmation mechanism for dangerous operations, no credential-scoping details, and no data-flow disclosure, so least privilege and explicit confirmation remain incomplete.
- Maintenance 10/20
- The evidence indicates an active project: the repository is not archived, and the README shows an MIT license, an npm version badge, a CI badge, a contributing guide with build/lint/format/test checks, and a defined update path. Deductions: the badges and repo stats are untrusted discovery signals, and the supplied source gives no verifiable commit frequency, release cadence, dependency update history, issue-response evidence, or security-response channel, leaving governance and versioning gaps.
- Documentation 13/20
- The README is layered and detailed: a feature table with per-capability doc references, quick-start examples, CLI/OpenClaw/MCP integration commands, an engine compatibility matrix with tested versions, and mention of per-host stdio config snippets and a tool allowlist. Deductions: the actual tool-parameter list, limits/cost notes, and troubleshooting guidance exist only as references and are not present in the evidence, and authentication details are thin, so the docs cite more than they show.
- Setup experience 12/20
- The setup path is clear in principle: one global npm install puts clawo-mcp on PATH, then register it in a supported MCP client, with the README claiming per-host stdio config snippets for mainstream clients such as Claude Desktop, Cursor, Cline, and Windsurf. Deductions: the actual config snippets are not in the evidence, each coding engine CLI must be pre-installed separately, and Node/platform prerequisites are unspecified; with no verifiable CI/test evidence the static calibration caps setup at 15, hence 12.