- Reliability 8/20
- The README describes a plausible startup chain involving the MCP server, WebSocket server, and Figma plugin, and lists the declared tools and prompts. However, no verifiable manifest, source-level execution evidence, CI, tests, handshake validation, or detailed error-handling evidence is provided; tool declarations cannot be fully verified, so points are deducted.
- Security and permissions 7/20
- The README shows WebSocket communication with the Figma plugin and exposes destructive and high-impact design operations, including node deletion and batch deletion. It also instructs WSL users to listen on 0.0.0.0. Authentication, authorization, access controls, data boundaries, network exposure, and confirmation requirements for dangerous actions are not documented, so the score is limited. No explicit credential theft, malware, or real secret is shown in the supplied material.
- Maintenance 10/20
- The repository is not archived, has an MIT license, and has a clear public repository location. However, the supplied material contains no evidence of commit cadence, releases, dependency maintenance, security-response channels, maintainer commitments, or issue-resolution practices. Stars and open issue counts are discovery signals only and do not add points, so this remains a middle score.
- Documentation 11/20
- The README covers project structure, installation, Cursor configuration, WebSocket startup, plugin connection, tool names, and several usage practices. It lacks the manifest, tool parameters and return schemas, authentication details, permission model, limits, compatibility versions, cost information, detailed troubleshooting, and reproducible test evidence; several important behaviors depend on unstated assumptions.
- Setup experience 11/20
- The README provides Bun installation, setup, WebSocket startup, Cursor configuration, plugin installation, and a WSL guide, making the main path understandable. However, it requires multiple processes, manual plugin and channel connection steps, and source modification for Windows/WSL; dependency versions, verification steps, recovery guidance, and cross-platform evidence are missing, so the setup is usable but fragile.