- Reliability 5/20
- Only the README and repo metadata were supplied; the server manifest is not cached and no source code, tests, or CI artifacts were provided, so the MCP init handshake and actual tool behavior cannot be verified. The README is internally inconsistent: tool count is stated as 14 in one place and 18 in another; '10 major markets' are claimed but only 8 categories are listed (A-shares, US stocks, HK stocks, FX, futures, funds, bonds, options); API integration counts conflict (43+ vs 100+). Therefore the happy path is plausible but not reproducible; per the static calibration reliability cannot exceed 12, and further deductions apply for missing verifiable evidence and contradictory documentation.
- Security and permissions 9/20
- Credential passing is clearly disclosed in the docs (env, X-Tushare-Token, Authorization: Bearer, X-Api-Key), and all config examples use placeholders rather than real tokens, so no red line is triggered. However, there is no source-level evidence of secure storage, least privilege, or scoping; the legacy free shared endpoint uses plain HTTP (http://106.14.205.176:3101/sse); finance_news is a web-scraping behavior with no confirmation step; and users' own Tushare tokens are sent to a third-party public cloud service whose data boundary is not fully explained. These uncovered gaps justify the deduction.
- Maintenance 10/20
- The repository is not archived and has a clear MIT license, and the README's 4.3.0→4.7.2 changelog suggests ongoing iteration; however, no commit history, releases/tags, issue-response records, dependency-update evidence, or security-response channel were provided. Version claims come entirely from the README (untrusted evidence); only the non-archived status and license metadata are verifiable. The score therefore reflects 'active but with governance/versioning gaps' (the 10-point anchor), with no upward adjustment due to missing evidence.
- Documentation 13/20
- The README is layered and fairly complete: install (npm global/local, npx, Smithery, manual build), auth (Tushare token acquisition and student credit benefits), Claude Desktop config JSON for stdio/Streamable HTTP/SSE, troubleshooting, per-domain example queries for stocks/funds/HK/US/crypto, rate-limit and points disclosures, and deployment-mode/logging-guide links. Deductions: all content is README self-report and cannot be independently verified; the docs contradict themselves internally (14 vs 18 tools, '10 markets' vs 8 listed, 43+ vs 100+ interfaces); some tools lack full parameter schemas; and cost/troubleshooting details are missing for several tools, so the 20-point tier is not reached.
- Setup experience 13/20
- Install paths are clear and varied: global npm install, npx, Smithery, or manual clone + npm install + build; Claude Desktop (Windows/macOS) config examples for stdio/Streamable HTTP/SSE, the Windows npx.cmd caveat, and troubleshooting steps are provided. However, the supplied material contains no verifiable execution evidence (real CI workflows or committed tests covering key paths), so per the static calibration the setup score cannot exceed 15; additionally, HTTP/SSE modes require a manual build step (npm run build), adding fragility, hence 13.