- Reliability 6/20
- Unable to verify that the server starts cleanly or completes the MCP init and tool-list handshake, as no server manifest was provided. The README declares a broad MCP API but does not provide a concrete tool list or test evidence. There are hints of CI workflows and tests, but no specifics. Deductions for lack of verifiable execution evidence and clear MCP tool surface.
- Security and permissions 7/20
- The codebase appears to include standard auth mechanisms (NextAuth, Argon2, JWT, bearer tokens), mentions of AES-256-GCM encryption, and path sanitization. However, no critical vulnerabilities were identified, but as a reviewer I cannot inspect the code, so permission and confirmation mechanisms are not fully transparent. Score of 7 due to invisibility of security boundaries and confirmation of dangerous operations.
- Maintenance 8/20
- Project is active with 275 stars, 0 open issues, conventional commits, and a clear governance model. License is FSL-1.1-Apache-2.0, which restricts competing hosted services but allows forking and modification. Update mechanisms and backup scripts exist. Deductions for lack of SECURITY.md and visibility into dependency management.
- Documentation 12/20
- README provides a comprehensive overview, installation instructions, architecture details, feature matrix, and configuration reference. However, it lacks specific MCP tool definitions, parameters, limits, and troubleshooting guides. The documentation does not clearly list all MCP tools and their parameters, limiting actionability. Deductions for insufficient MCP-specific coverage.
- Setup experience 12/20
- Installation steps are clear, with one-click Docker install, manual setup, and manual installation instructions, configuration examples, and deployment constraints explained. However, since the installer scripts cannot be verified, and the requirement of PostgreSQL and long-running process adds assumptions, the setup is plausible but potentially fragile in real environments. Clear steps but based on static review.