- Reliability 8/20
- The README describes a plausible start path (bun install, gbrain init --pglite, gbrain serve, MCP handshake with 30+ tools) and even documents numerous bug fixes and workarounds, which suggests the project is real and runnable. However, this static review had access only to the README and repository metadata; no actual CI workflow files, committed tests, or executable examples were provided. Per the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence, and missing evidence is deducted. The many troubleshooting entries also imply edge cases that are not demonstrably covered by tests. Score: 8.
- Security and permissions 13/20
- No red-line issues are evident: no malware, credential theft, covert exfiltration, or destructive defaults without confirmation; the only token shown is the placeholder gbrain_xxx, not a real secret. The README describes a thoughtful security posture: OAuth 2.1 with PKCE for HTTP, scope-gated access (read/write/admin), rate limiting, DCR-style registration, a credential gateway, and a SECURITY.md threat model. However, these are claims in the README; the actual source code could not be inspected. Also, no explicit confirmation flow for dangerous write/admin operations is documented, and multi-user data-boundary claims (fuzz-tested zero leaks) are unverified. Score: 13.
- Maintenance 16/20
- The repository is not archived, has an MIT license, a CONTRIBUTING guide, a SECURITY.md, and a detailed CHANGELOG referencing many recent versions (e.g., v0.41.37.0). The README describes a PR-wave workflow and contributor attribution, indicating organized maintenance. 300 open issues is high but consistent with an active project; no release cadence or commit data is available in the supplied material. Score: 16.
- Documentation 16/20
- The README is unusually comprehensive: quick start, agent-based install, CLI and MCP setup for many clients (Claude Code, Codex, Cursor, ChatGPT, Perplexity, Cowork), architecture, integrations, cost hints, and a troubleshooting section with concrete fixes and version references. Limitations are disclosed (macOS 26 PGLite incompatibility, npm shadowing warning, PGLite single-writer). The main deduction is that linked docs (INSTALL.md, docs/mcp/*, SECURITY.md, etc.) were not supplied for verification, and some claims (e.g., benchmark numbers) are unverifiable from this material. Score: 16.
- Setup experience 13/20
- Setup is documented in clear steps: install via bun install -g github:garrytan/gbrain, initialize a local brain, run gbrain serve, then connect with one-command examples for mainstream clients. Platform caveats are given (macOS 26/Tahoe PGLite issue, Windows DNS workaround). However, setup requires bun, API keys for embeddings, and possibly a remote host; several manual choices (embedding provider, schema pack) add friction. Per static calibration, setup cannot exceed 15 without verifiable CI/tests in the supplied files, and none were provided. Score: 13.