- Reliability 10/20
- The manifest declares both a streamable-HTTP remote endpoint and a PyPI stdio package, while the README describes the main metrics and source-fallback behavior, making the happy path plausible. Points are deducted because the supplied material contains no CI, committed tests, or evidence for MCP initialization/tool-list handshakes, and it does not establish that manifest version 2.1.4 and package version 2.1.2 behave consistently. Error handling, edge cases, and dependency control are not verifiable.
- Security and permissions 10/20
- The API key is declared as required and secret, and the hosted connection uses OAuth. The documented functionality is primarily financial-data retrieval and calculation, with no evidence of deletion, payment, deployment, or remote-command actions. Points are deducted because data is sent to Financial Modeling Prep and may fall back to Yahoo Finance, while caching writes pickle files; data boundaries, hosted-service permissions, privacy handling, cache protection, and confirmation controls are insufficiently documented. No red-line credential theft or malicious behavior is evidenced.
- Maintenance 13/20
- The project states an MIT license, is not archived, provides version identifiers, a GitHub repository, contribution guidance, and maintainer contact details, establishing basic ownership and an update path. Points are deducted because the supplied material provides no commit history, release cadence, dependency-update evidence, vulnerability-response process, or security-advisory channel; stars and open-issue counts are not maintenance proof.
- Documentation 14/20
- The README covers hosted and local installation, several mainstream clients, OAuth/API-key handling, major modules, examples, free-tier limits, source fallback, caching, benchmarking, and troubleshooting, so documentation is comparatively strong. Points are deducted because there is no reviewable MCP tool inventory, per-tool parameter/return documentation, protocol error behavior, hosted-service pricing/quotas, or complete platform-compatibility detail. The manifest and README/PyPI versions also differ.
- Setup experience 13/20
- The hosted endpoint offers a direct connection path with instructions for multiple clients. The local path includes a uvx command, manual JSON configuration, and an MCPB bundle, making setup reasonably actionable. Points are deducted because an FMP API key and external-service flow are required; the setup wizard writes client configuration, platform compatibility and recovery from failures are not fully documented, and there is no file-level test or execution evidence.