- Reliability 10/20
- The README lists 28 tools, a resource, and a prompt, and describes unified errors, configuration validation, and test commands. However, the supplied material contains no actual source files, CI workflows, or test-coverage evidence, so initialization, tool-list handshaking, runtime dependencies, and key edge behavior cannot be verified. The manifest also declares a Bun runtime and uses “bun run,” while the README primarily presents direct npx/Node execution, creating startup reproducibility uncertainty. The score therefore remains below the static ceiling of 12.
- Security and permissions 13/20
- The material describes path validation, optional GIT_BASE_DIR scoping, non-shell argument spawning, JWT/OAuth support, audit logging, and explicit confirmation for git clean and git reset --hard. However, HTTP authentication defaults to none, GIT_BASE_DIR is optional, clone/fetch/pull/push and other Git operations can cause network or repository side effects, and signing failures silently fall back to unsigned operations. Permission boundaries, detailed authentication configuration, and data-flow evidence are missing, so substantial points are deducted; no red-line risk is shown by the supplied material.
- Maintenance 11/20
- Version 2.15.1, an Apache-2.0 license, non-archived status, a public GitHub repository, a stable-status claim, nine open issues, and a roadmap suggest ongoing maintenance. The material does not show commit cadence, release history, dependency-update practice, a security-response channel, or maintainer governance, so only a moderate score is justified.
- Documentation 14/20
- The README covers runtimes, installation, STDIO/HTTP configuration, environment variables, tool categories, security claims, response formats, development, and testing commands, with a client configuration example. It lacks per-tool parameters and limits, authenticated-deployment procedures, troubleshooting, cost or network-impact disclosure, and independently reviewable implementation evidence. Some README configuration variables are absent from the manifest, adding uncertainty.
- Setup experience 13/20
- The README provides npx and bunx installation paths, minimum runtime versions, a STDIO client configuration example, HTTP port settings, and basic development commands, making mainstream-client setup reasonably clear. However, the manifest requires Bun and passes “run start:*,” while the README presents direct npx/bunx execution without explaining the difference. HTTP authentication and remote deployment still require manual configuration, and platform-compatibility evidence is limited.