- Reliability 5/20
- This repository is fundamentally a Next.js full-stack agent host/client template that connects to externally configured MCP servers (stdio/HTTP) chosen by the end user in its UI — it does not itself expose an MCP tool manifest, so there is no initialize/tool-list handshake of its own to verify, and the server manifest is marked 'not cached'. The README describes a plausible happy path (docker compose, Prisma migrations, pnpm dev), but no CI workflow files or test scripts are evidenced (package.json scripts only list lint/format, no test command). Per the static calibration rule, without committed tests/CI the score cannot exceed 12, and the absence of any actual MCP surface to validate pushes it further down.
- Security and permissions 12/20
- Sensitive credentials (OpenAI/Google/Anthropic API keys, DATABASE_URL) are handled via .env.local rather than hardcoded, and no real secrets appear in examples. The project implements a human-in-the-loop tool-approval flow (allow/deny/modify) that gates dangerous tool execution, and documents OAuth 2.0 for HTTP MCP auth — both positive signals. However, an 'optional auto-approval mode for trusted environments' can bypass confirmation if misconfigured, and the client lets users freely configure arbitrary stdio commands (e.g., filesystem server paths) and HTTP endpoints, with scoping/least-privilege left entirely to the end user with no default sandboxing described. No red-line violation is evident, but confirmation and permission-scoping are incomplete.
- Maintenance 11/20
- The repo is not archived, carries an MIT license, and shows healthy signals (126 stars, only 1 open issue). However, the README shows no release history, changelog, contributor base, or security-response channel; the author repeatedly inserts personal consulting/LinkedIn promotion into the docs, suggesting likely single-maintainer ownership with unclear governance or versioning path.
- Documentation 14/20
- The README is fairly thorough — quick start, environment variable setup, an architecture diagram, MCP server configuration examples, and the tool-approval workflow — and links out to layered docs (ARCHITECTURE.md, API.md, OBSERVABILITY.md, OAUTH.md) plus a Zod-generated OpenAPI 3.1 explorer, indicating good documentation structure. But only the README body was available for this review; the linked deep-dive docs' actual content is unverified, and tool-level parameter details, rate limits, cost, and troubleshooting are not spelled out in the provided text, leaving hidden assumptions.
- Setup experience 9/20
- Setup is documented but multi-step: clone, pnpm install, copy/edit .env.local (requires one of three provider API keys), docker compose for PostgreSQL and MinIO, Prisma generate/migrate, then start the dev server — a typical manual-but-workable path rather than a few-step plug-and-play install. With no CI or test evidence confirming these steps work end-to-end, the static calibration cap applies; additionally, this project is not itself an MCP server a standard MCP client could connect to, and no MCP-client connection config example for this repo is provided.