- Reliability 9/20
- README claims 7 MCP tools (ctxlint_audit etc.) with read-only annotations, stdio transport, zero runtime dependencies, and a clean single-package startup; manifest matches the npm identifier and version. The happy path is plausible. However, this static review sees no server source, tests, or CI workflows verifying that declared tool behavior matches reality (parameters, error outputs), so edge cases and error handling are unverifiable; scores cannot exceed 12.
- Security and permissions 11/20
- No red-line risk: no network calls claimed, read-only posture, detected secrets shown only as a 6-char redacted prefix, the mutating --fix requires interactive confirmation, and out-of-scope scanning (session/skills/global/home directory) is opt-in with disclosed boundaries — good least-privilege awareness. But all security claims are README self-descriptions; secret-redaction logic, --fix write-path constraints, and actual home-dir scan boundaries are not verifiable from source, so only a middle score.
- Maintenance 9/20
- Version 0.24.1 indicates active iteration, MIT license is explicit, npm/GitHub badges present. But 7 stars, and no evidence of issue response, release cadence, security-response channel, or contributor governance; still 0.x, short of demonstrated sustained maintenance.
- Documentation 15/20
- README is exceptionally thorough: install paths, full CLI option list, config field reference, all 7 MCP tools, multi-client config examples, exit codes, four output formats, and four companion specs — good layering. Deductions: no MCP tool parameter schemas, no troubleshooting section, no token/cost details; README examples show v0.9.10 while the manifest says 0.24.1, and many claims (rule counts, client support) cannot be verified from the supplied material.
- Setup experience 13/20
- Clear install path: one-line npx, complete config examples for Claude Code, .mcp., VS Code, and Claude Desktop (including the Windows cmd /c wrapper), and package identifier consistent with the manifest — low complexity. Deductions: no debugging/stderr-log guidance, the Windows npx path is somewhat fragile, and no verification step for confirming a successful handshake.