- Reliability 8/20
- No server manifest is cached, and the README itself describes this repo as a spec + SDK + collection of example servers rather than a single runnable MCP server — the object definition ('server path: repository root') is itself ambiguous. The README only offers doc links, badges, and an example gallery; it provides no verifiable test files or evidence that declared tool behavior matches actual behavior, and the CI badge is just an image link with no visible workflow content or test coverage shown. Per the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence, so 8 is given, reflecting a plausible-looking happy path with unverified edge cases, error handling, and manifest-to-behavior consistency.
- Security and permissions 12/20
- The README states that UI renders in a 'sandboxed iframe' via the host, with tool data passed through notifications/a controlled channel between host and UI — a reasonable isolation design, and no red-line risk (no credential theft, no covert exfiltration, no unconfirmed destructive default actions) is evident. However, as a protocol/SDK repo, the actual permission model, least-privilege constraints, confirmation mechanisms for dangerous operations, and external network access boundaries are not detailed with checkable evidence in the README; example servers (system monitor, map, PDF, etc.) may involve local resource or network access with no disclosed scoping. Evidence is insufficient to confirm explicit least-privilege and data-flow disclosure, so 12 is given — main risks are visible but permission/confirmation/scoping is incomplete.
- Maintenance 12/20
- The repo is maintained by the official modelcontextprotocol org, with an actively published npm package (version/download badges), a CI badge, and a CONTRIBUTING.md; 2682 stars suggest active use. However, a key issue: GitHub reports the license as NOASSERTION (undetected/unclear license) while the README badge claims 'License: Apache 2.0' — a clear contradiction indicating a governance and license-clarity gap. Combined with a high open-issue count (191) and no visible security-response channel, this is active but with real governance/versioning gaps, warranting 12.
- Documentation 15/20
- The README is well-structured with a table of contents, quickstart links, API doc links, supported-client listings, an SDK package-purpose table, a rich example gallery (12+ example servers plus 5-framework starter templates), a spec version table, and a contributing guide — layered and reasonably example-rich. However, without a cached manifest, tool-level parameters, limits, cost, or troubleshooting detail cannot be verified from this evidence, so full marks are not warranted; 15 is given.
- Setup experience 13/20
- The README gives clear setup steps: an npm install command, a Quickstart guide link, a local-run flow (git clone + npm install + npm start) for examples, and JSON config examples for stdio-based clients (Claude Desktop, VS Code), plus guidance for pointing at local builds during development. Steps are concrete and configuration examples are provided, indicating a relatively low setup barrier. Per the static calibration rule, setup cannot exceed 15 without real CI workflow content and committed tests verifiably covering key paths; also, the repo's multi-package/multi-example structure adds real-world complexity (e.g., Python examples require uv run), so 13 is given.