- Reliability 2/20
- Only the server manifest and repository-level README were reviewed; no source code, tests, or CI evidence for this specific server was supplied. The manifest describes an npm package over stdio and the concept is plausible, but there is no way to verify startup, the initialization handshake, or whether declared tools match real behavior. Under static calibration, unverifiable execution evidence caps the score. Deducted for missing implementation and test evidence.
- Security and permissions 4/20
- The manifest and README show no malware, leaked credentials, or red-line violations. However, there is no code-level evidence of credential handling, least privilege, data boundaries, or external network behavior. By description the server reads OpenAPI specs and HTTP logs, which can contain sensitive data, yet no confirmation flow or scoping disclosure is provided. Deducted for an entirely undocumented security posture.
- Maintenance 9/20
- The repository is not archived, has an MIT license, and the README indicates active releases and a validation pipeline; these are repository-level maintenance signals. However, there is no changelog, commit history, dependency update trail, or security response channel attributable to conversational-api-debugger specifically, so full marks were not given.
- Documentation 2/20
- No dedicated documentation for this server was provided. The repository README contains only a one-line catalog entry, and the manifest has just a name, title, and short description. Tool parameters, auth requirements, limits, costs, and troubleshooting are absent, making the server effectively undocumented for a new user.
- Setup experience 3/20
- The manifest declares an npm identifier and stdio transport, but the README only shows generic ccpi installation commands. There is no client configuration example, platform compatibility note, or verification step for this MCP server. Without real CI or test evidence showing a clean install path, the setup score is necessarily low.