- Reliability 8/20
- The README shows three transports (stdio/SSE/Streamable HTTP), four auth methods, and links to tool docs, indicating a well-structured declared capability surface. However, all judgments come only from the README and the supplied metadata; there is no cached server manifest, no source tree, no CI workflows, and no committed tests, so MCP init + tool-list handshake, whether declared tools match real behavior, and error/dependency control cannot be verified. Static calibration caps reliability at 12 without verifiable execution evidence (real CI plus tests covering key paths); with no test or error-handling evidence at all, a conservative 8 is given.
- Security and permissions 9/20
- The README's local example injects DOCSPACE_API_KEY via environment variables and uses placeholders rather than real secrets; support for OAuth 2.0 and request-level auth headers suggests credential isolation awareness. No malware, covert exfiltration, or unconfirmed dangerous-by-default operations are evident, so no red line is triggered. Still, permission scoping, confirmation requirements for delete/archive operations, token storage, and log redaction are not documented, so evidence is incomplete and the score is reduced to 9.
- Maintenance 11/20
- The MIT license is explicit, the repo is not archived, and it reports 0 open issues, indicating an active project with clear ownership by the official ONLYOFFICE organization; the README references multiple distribution channels (Docker Hub, Docker MCP, npm, MCP bundle). But version numbers, commit cadence, issue response times, dependency update policy, and a security-response channel are absent, so sustained maintenance cannot be confirmed; a conservative 11 is assigned.
- Documentation 14/20
- Documentation is layered: the README gives an overview, features, use cases, remote and local connection guidance, environment variable descriptions, and links to docs for tools, global configuration, request-level configuration, per-client setup, and distribution, plus tool and installation examples. The gap is that linked docs are not part of the supplied material, so tool parameters, limits, and troubleshooting cannot be verified, and error handling and platform differences are thinly disclosed; the score is reduced to 14.
- Setup experience 13/20
- The install path is clear: a mainstream-client JSON config template (Docker-based, with mcpServers structure and env placeholders is provided), and the hosted remote instance allows instant connection without local deployment, with Docker/npm/MCP bundle options available. However, full setup requires Docker or a Node runtime and self-generated API keys, and copy-paste examples for multiple clients plus verification steps are lacking. Per static calibration the setup cap is 15 without execution evidence, so a conservative 13 is given.