- Reliability 11/20
- Evidence shows a comprehensive test suite (200+ integration tests, 4 e2e tests) and CI workflows, suggesting core paths are likely reproducible. However, the review is static, server not executed, and no manifest file is available, so tool declarations vs real behavior cannot be fully verified. Score capped at 12 per static calibration, resulting in 11. Deductions for lack of execution, untracked dependencies (e.g., fitparse), and some endpoints intentionally skipped which may affect reliability.
- Security and permissions 14/20
- The server handles sensitive Garmin credentials, supports file-based secrets and environment variables, and encourages pre-authentication to store tokens in ~/.garminconnect, limiting exposure. It does not log credentials, and offers options to disable destructive tools (e.g., delete_activity). HTTP transport has no authentication, but documentation clearly instructs to put it behind a reverse proxy. No evidence of malware, credential theft, or critical vulnerabilities, so a score of 14 is given. Deductions for lack of explicit token permission hardening, no explicit confirmation for destructive operations, and example configurations with passwords.
- Maintenance 16/20
- Repository is active with many commits and releases, maintainer appears responsive to issues (24 open issues relatively low). Has MIT license. No deductions evident from the evidence, but maintenance score is capped by lack of validated release history and dependency update records. Score 16 reflects active maintenance but not fully validated governance.
- Documentation 17/20
- README is extremely thorough, covering installation, configuration, troubleshooting, examples, and limitation disclosures. Includes config examples for multiple clients. Documentation appears consistent and discloses skipped endpoints. Score 17 because while extensive, some aspects like exact tool parameters and token permissions are not fully detailed.
- Setup experience 14/20
- Setup steps are clear, with multiple methods: uvx, Docker, Claude Desktop config, and instructions for Codex and opencode. Pre-authentication tool garmin-mcp-auth is provided to simplify authentication. However, static review prevents verification of installation reliability and compatibility across platforms, so score capped at 15. Given the documentation's apparent ease, score 14.