- Reliability 9/20
- Only the README and server.json manifest are available; no actual source code, test files, or CI workflow content was provided (only badges linking to pre-commit.ci and a publish-mcp.yml workflow, without visible test coverage). Tools are described as auto-generated per documented API endpoint following a naming convention (edubase_<method>_<endpoint>), claimed to mirror developer docs, but there is no way to statically verify that declared tools match real behavior, nor evidence of error handling or dependency control. The 1.2.16 version number suggests some iteration, but per the static calibration rule, without verifiable test/CI evidence reliability is capped below 12.
- Security and permissions 12/20
- Secrets are passed via environment variables (EDUBASE_API_SECRET/EDUBASE_API_KEY marked isSecret), and README examples use placeholders rather than real credentials — no red-line violation found. The edubase_filebin tool documents default SSRF protections (blocking private/loopback/link-local addresses) with an optional host allow-list, a positive signal, and OAuth 2.1 with PKCE is supported to avoid exposing raw credentials. However, neither the manifest nor docs describe per-tool least-privilege scoping or confirmation flows for irreversible actions (e.g., deleting content, publishing exams, modifying grades) common on an e-learning platform; authorization appears to rely on backend App-level scope rather than tool-level limits, placing this at a mid-tier 'main risks visible but permissions/confirmation incomplete' level.
- Maintenance 13/20
- The repo is MIT licensed, has a GitHub Actions workflow auto-publishing to the MCP Registry, and integrates pre-commit.ci; version 1.2.16 indicates ongoing iteration. Open issues are at 0 and the repo is not archived, with a contact email as a feedback channel. However there is no visible commit history, contributor base, or explicit security-response process, and the star count is low (27), making it hard to gauge long-term community activity and maintenance guarantees.
- Documentation 15/20
- The README is thorough, covering npx/Node/Docker/Smithery install methods, a full environment-variable configuration table, three auth modes (no-auth, Bearer token, OAuth 2.1), and remote vs. local deployment guidance. The tool naming scheme is explained with a link to external developer docs. However, the repository itself lacks a detailed per-tool parameter reference, rate limits, cost disclosure, or a dedicated troubleshooting section — these depend on an external link (developer.edubase.net), leaving a 'usable but thin on troubleshooting' gap.
- Setup experience 13/20
- Multiple installation paths are documented (npx, local build, Docker, remote server, one-line Smithery install) with concrete claude_desktop_config.json examples, giving clear steps. Per the static calibration rule, since there is no verifiable execution evidence (no committed tests or confirmed CI pass shown), setup ease is capped below 15, reflecting 'clear steps but manual credential configuration, unverified by actual execution.'