- Reliability 8/20
- The repository provides a tool manifest (scripts/tools.json) and a CLI entry (npx @cloudbase/cloudbase-mcp), but no test files or CI configuration to verify the MCP handshake and tool behavior. README claims support for multiple modes (local, hosted, cloud), but lacks reproducible verification evidence. Reliability is capped at 8 because key paths are plausible but untested.
- Security and permissions 13/20
- The repository provides a cloud-mode environment variable (CLOUDBASE_MCP_CLOUD_MODE) to disable local file/process tools and recommends confirmation of sensitive actions, but no code-level evidence (e.g., permission controls, confirmation mechanisms) is present. No malicious behavior or credential leakage found. Since least privilege and confirmation mechanisms are not verifiable from source, and hosted mode requires user-supplied keys, security scores 13.
- Maintenance 15/20
- The repository is active, with recent releases (v2.25.x) and a clear changelog, and an explicit MIT license. npm version and download badges indicate ongoing maintenance. However, no security response channel or dependency update policy is evidenced. Score 15.
- Documentation 13/20
- README provides detailed install instructions, multiple IDE integration config examples, and FAQs, but tool parameters, limits, and cost information are mainly in external docs, not verifiable from the repo. Troubleshooting steps are limited. Score 13.
- Setup experience 10/20
- README provides clear setup steps and multiple client config examples (e.g., MCP config JSON), but depends on external services (CloudBase environment) and npm package, and lacks local testing or verification steps. Setup score limited to 10 due to missing reproducible install verification evidence.