- Reliability 6/20
- Based only on the README: it shows a minimal FastApiMCP(app) and mount() usage, claiming automatic MCP tool generation over ASGI transport. However, no source code, tests, or CI execution evidence was supplied, so the init handshake, tool list, and real behavior cannot be verified; edge cases and error handling are undocumented. Per static review rules, missing execution evidence lowers the score.
- Security and permissions 10/20
- No malware, credential theft, covert exfiltration, or destructive defaults are visible, so no red line is triggered. The README clearly states authentication uses existing FastAPI dependencies, which is positive. However, by default all endpoints are exposed as MCP tools; there is no mention of tool-level allow/deny least privilege, confirmation for dangerous operations, or data-flow disclosure, and credential storage/transport details are absent. Hence 10.
- Maintenance 10/20
- The repository has an MIT license, is not archived, and shows copyright by Tadata Inc.; the README includes CI/coverage badges, but badges are untrusted evidence. No commit frequency, release cadence, dependency updates, or security-response channel is provided; the 164 open issues are metadata and do not add points. Ownership and license are clear, so 10, but lack of governance/update-path evidence prevents a higher score.
- Documentation 10/20
- The README provides installation, basic usage, feature highlights, and links to a docs site and examples directory, suggesting layered documentation. However, it lacks authentication configuration details, tool parameter reference, limitations/cost, and troubleshooting; the external docs link is not verifiable in this review. It is usable but with hidden assumptions and troubleshooting gaps, so 10.
- Setup experience 12/20
- Installation is clear: `uv add fastapi-mcp` or `pip install`, then a three-line mount to /mcp. However, no connection configuration examples for mainstream clients (Claude/Cursor/Windsurf) are supplied, and platform compatibility is not documented; there is no real CI/test evidence in the README, so per static calibration the score stays below 15 and is set at 12.