- Reliability 8/20
- The README shows a launch command (npx -y @piotr-agier/google-drive-mcp) and a first-call example (authGetStatus), and the manifest declares a single stdio-transport npm package claiming 116 tools, but no CI workflow files or committed test suites are included in the provided material to verify that declared tool behavior matches real behavior. The README references 'build commands, tests' in docs/development.md, but that document's contents are not part of the evidence, so test coverage and error-handling cannot be confirmed. Per the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence (real CI plus committed tests covering key paths); the score reflects that gap plus the lack of disclosed error/dependency control.
- Security and permissions 13/20
- The manifest explicitly marks GOOGLE_DRIVE_OAUTH_CREDENTIALS as required and secret, and the README's Security section instructs against committing credentials/tokens, recommends narrow OAuth scopes, keeps the default HTTP bind on 127.0.0.1, and flags team-store.json as containing refresh tokens that must be treated as secret — all positive signals with no direct evidence of malware, hardcoded secrets, or unconfirmed irreversible defaults, so no red line applies. However, one of the showcased example workflows ('move files older than one year into an Archive folder') involves a destructive/side-effecting operation, and nowhere in the provided text is a confirmation step or dangerous-operation safeguard described for delete/move/permission-change actions. Team mode and externally managed tokens also expand the attack surface without accompanying detail in this material. The absence of disclosed least-privilege enforcement or confirmation flow for destructive actions caps the score below full marks despite no red-line violation.
- Maintenance 13/20
- The project uses the MIT license, the manifest lists version 2.6.0, the README references a CHANGELOG.md indicating a release history, the repo is not archived, and GitHub Issues is named as the defect-reporting channel — reasonable governance signals. However, no commit history, release dates, or issue-response-time evidence is included in the provided material. 'Open issues: 0' is ambiguous — it could indicate good triage or low engagement — and cannot be treated as a positive signal on its own. Lacking verifiable evidence of ongoing activity (recent commits, dependency updates) prevents a higher score.
- Documentation 15/20
- The README has been deliberately restructured into a documentation index pointing to eight dedicated guides (setup, clients, authentication, configuration, deployment, tools, troubleshooting, development) and includes four concrete usage examples (organizing Drive, building a report, editing a document, preparing a meeting), which is a strong structural signal of layered documentation. Since this review only has access to the README and manifest, the actual contents of the linked guides are outside the evidence scope, so specifics like tool parameters, limits, cost, and troubleshooting depth cannot be individually verified — warranting a good but not perfect score based on structure and completeness of linking rather than confirmed content quality.
- Setup experience 12/20
- The README provides a concrete four-step path: create Google Cloud OAuth credentials, save the JSON to a specified path, run npx ... auth to complete the consent flow, then edit the mcpServers config and restart the client, including a working JSON config example — a documented and traceable setup path. However, the process fundamentally depends on multiple manual steps in the Google Cloud Console (enabling several APIs, configuring the OAuth consent screen, creating a Desktop app credential), which is inherently fragile and error-prone, as evidenced by the README itself pointing to a separate troubleshooting guide. Per the static calibration rule, setup cannot exceed 15 without verifiable execution evidence, and the multi-step, cross-console manual complexity keeps the score below that ceiling.