- Reliability 7/20
- No server manifest was cached, so this review relies solely on README prose with no way to confirm that declared tools/resources/prompts match actual runtime behavior or that the MCP init/tool-list handshake works as described. The README mentions GitHub Action packaging for Windows/Linux builds but supplies no CI workflow files or committed test suite as verifiable execution evidence. Per the static calibration rule, reliability is capped at 12 without verifiable CI+test evidence, and given the total absence of manifest data it is scored lower at 7.
- Security and permissions 6/20
- This is a local-first Electron desktop client that bundles a 'code execution' inMemory MCP service and supports 'remote control' via Telegram, Feishu/Lark, QQBot, Discord, and WeChat iLink — including remotely answering pending permission prompts, stopping runs, and opening desktop sessions. This suggests local confirmation dialogs could be bypassed by a bound remote bot, which is a real overreach/least-privilege concern. The README only offers marketing-level claims ('Security-First Design', 'reserved encryption interfaces') without concrete detail on permission scoping, data boundaries, or the strength of the /pair authentication mechanism for remote binding. No evidence of credential theft or fabricated results was found, so this does not meet the 0-4 red-line bar, but the disclosed risk surface is real and underspecified, warranting a score of 6.
- Maintenance 15/20
- The project uses the Apache-2.0 license, has 6200 stars, only 9 open issues, ships through multiple channels (GitHub Releases, official website, macOS Homebrew cask), and references contribution guidelines, a wiki, and multilingual docs — signs of an actively governed project. However, the supplied material contains no explicit recent-commit or release-date evidence to confirm update cadence, so it falls short of full marks, scored 15.
- Documentation 13/20
- The README is well-structured with a table of contents and sections covering features, Tape/Trace, Skills, ACP, and Remote Control, linking out to docs/README.md and a developer guide. However, as the object under review is nominally an 'MCP server,' the documentation lacks concrete tool parameter specs, limits, cost information, or a troubleshooting section, and the missing manifest prevents cross-checking documented behavior against actual tool implementation, scored 13.
- Setup experience 11/20
- Three install paths are offered (GitHub Releases binaries, official website, macOS Homebrew), plus development setup steps (pnpm install, runtime install, a documented Windows symlink permission caveat) and per-platform build commands — reasonably clear for an Electron app. Per the static calibration rule, setup is capped at 15 without verifiable CI+test execution evidence; additionally, this project is itself an MCP client/host rather than a typical MCP server with a one-step client config example for mainstream MCP clients, so it is scored 11.