- Reliability 9/20
- The README describes expected behavior for four tools (fetch_documentation, search_documentation, fetch_url_content, search_code), but no cached manifest, test suite, or CI evidence is available to confirm that declared tools match real behavior. As a remotely hosted service, the init/tool-list handshake cannot be verified from static material alone, and error handling/dependency control are not documented. Per the static calibration rule, scores above 12 require verifiable execution evidence (tests + CI), which is absent here — 9 reflects a plausible happy path with thin edge-case/error-handling evidence.
- Security and permissions 13/20
- The service requires no authentication, claims no PII collection or query persistence, and respects robots.txt when scraping GitHub Pages — positive signals, and no hardcoded secrets or unsafe destructive defaults were found, so it does not hit a red line. However, all traffic is routed through a third-party hosted intermediary (gitmcp.io), a non-trivial data-boundary concern, and fetch_url_content retrieves arbitrary external URLs referenced in documentation and feeds them to the LLM without any stated limits or confirmation step — a plausible content-injection/SSRF-adjacent risk surface. Overall the main risks are visible but scoping/confirmation is incomplete, keeping the score in the mid-range rather than higher.
- Maintenance 15/20
- The project has a large star count (8322), is not archived, carries an Apache-2.0 license, and provides a CONTRIBUTING guide plus local dev/test instructions, indicating ongoing community activity. However, the README gives no concrete evidence of release cadence, recent commit history, or a dedicated security-response channel, and the pace of handling 77 open issues cannot be assessed from static material, so it falls short of full marks.
- Documentation 16/20
- The README is thorough, covering concrete configuration examples for multiple clients (Cursor, Claude Desktop, Windsurf, VSCode, Cline, etc.), an explanation of how the system works, descriptions of all four tools, an FAQ, a privacy section, and local development/debugging steps (MCP Inspector) — layered and reasonably example-rich. Points are deducted because tool parameter schemas/limits (rate limits, timeouts, response size caps) are not disclosed, and troubleshooting guidance is thin, short of the top tier.
- Setup experience 14/20
- As a zero-install remote service, users only need to add a single URL to their client config, and the README supplies concrete JSON examples for mainstream clients plus self-hosting steps (clone, pnpm install, npm run dev), making the process clear and low-friction. Per the static review rule, however, no executable CI/test evidence exists to verify the configuration flow actually works end-to-end, which caps the score below 15.