- Reliability 9/20
- Static review sees only packages/grok-mcp/server.json: it declares stdio transport, the npm package @ask-llm/[email protected], and seven environment variables (including required XAI_API_KEY). Its description and the ask-grok tool name are internally consistent, and a stdio manifest of this shape normally completes the MCP init and tool-list handshake. However, the manifest declares no tools or input schemas, so declared tools cannot be checked against real behavior; no tests, CI workflows, or error-handling code for this server were supplied, and no verifiable evidence exists for timeout, retry, or failure paths. Static calibration caps reliability at 12 without committed tests and real CI, and missing evidence is a deduction, so 9.
- Security and permissions 11/20
- Positives: XAI_API_KEY is marked isSecret=true with a description scoping it to requests to api.x.ai, indicating a single-endpoint, minimal-scope credential; ASK_GROK_MAX_OUTPUT_TOKENS and ASK_GROK_TIMEOUT_MS bound accidental spend by default; and the manifest explicitly states there is no automatic harness/model failover, so the data boundary is comparatively clear. Deductions: this is a paid third-party API key injected as a plaintext environment variable into MCP client config, with no evidence of key rotation, least-privilege key scoping, or log redaction; whether prompts and code snippets sent to xAI are disclosed or user-confirmed is unverifiable; and no tool-level confirmation or permission scoping is visible in the manifest. No red line is triggered (no malware, no covert exfiltration, no real secrets in examples), so this does not fall into the 0-4 band; 11.
- Maintenance 10/20
- An MIT license is present and the repository is not archived; it has 18 stars and 11 open issues, indicating some ongoing activity plus unprocessed backlog. The manifest version is 0.1.0, an early release, and release cadence/governance cannot be verified from the supplied material; there is no evidence of a security-response channel (SECURITY.md or private reporting), and the dependency-update policy is invisible. As one of seven MCP servers in the same repository, this subpackage's own commit activity cannot be separated from whole-repo signals. Scored as active-but-with-governance-and-versioning-gaps: 10.
- Documentation 12/20
- Strengths: the README is layered, with a quick start, per-client config examples, a Provider setup table, a package table, and a migration note; the Grok-specific text clearly states the model-selection semantics (exact harness catalog ID, no fallback, set XAI_API_KEY, or pin grok-cli explicitly); and every environment variable in the manifest carries a description and default, including cost and output ceilings. Deductions: documentation is written at the level of the unified monorepo and gives no tool list, parameter schemas, response shape, or failure examples for ask-grok; rate limits, billing semantics, and troubleshooting steps for this server are unstated; and plugin-level capabilities such as the grok review skill blur the boundary with this server. Usable but with hidden assumptions and troubleshooting gaps: 12.
- Setup experience 13/20
- The install path is short: npx -y @ask-llm/grok-mcp launches over stdio, with README config samples for Claude Code, Cursor, Codex CLI, and Claude Desktop, plus an explicit claude mcp add ... -e XAI_API_KEY=... registration; prerequisites are only Node 20+ and an xAI API key, with no local CLI or account login needed, which is visibly simpler than siblings such as Antigravity (requiring Google AI Pro/Ultra). Deductions: platform support is stated as Linux/macOS with no Windows guidance; the executable entry and package bin field are not visible, so the identifier-to-command mapping cannot be verified; and no validation step (e.g., the relevant doctor check) is shown for misconfigured keys or auth failures. With static calibration capping setup at 15, this is 13.