- Reliability 6/20
- The manifest and README describe an npm stdio MCP server with tools and resources, so the happy path is plausible. However, no executable source, tests, or CI evidence is present in the reviewed material; the README says five tools while listing six, and repository/package naming is inconsistent. Error handling and diagnosable failure modes are not shown, so clean startup and handshake cannot be verified. Score: 6.
- Security and permissions 10/20
- No hardcoded secrets, malicious commands, or destructive defaults appear in the supplied material. However, ask_atlas sends user questions to a third-party /api/chat endpoint without a clear privacy/data-boundary disclosure, and the installer edits client config files with only a --force flag as an override. Least-privilege and confirmation behavior are incomplete. Score: 10.
- Maintenance 8/20
- MIT license, non-archived repository, version 0.2.0, and zero open issues indicate some maintenance. Yet there is no commit history, release evidence, dependency update trail, or security-response channel in the provided material; the README's weekly-release claim is untrusted, and maintainer identity appears inconsistent. Score: 8.
- Documentation 7/20
- Install instructions and per-client config examples are useful, and the tools/resources overview helps. Still, tool parameters, concrete call examples, limits/cost, and troubleshooting are missing, and the README contradicts itself with five tools vs. the six it lists. The documentation is usable but incomplete. Score: 7.
- Setup experience 12/20
- The one-command installer and client-specific JSON snippets give a clear few-step setup, with platform paths included. However, Node/npx runtime requirements are implicit, the clone path differs from the resulting working directory, and no CI or committed tests verify execution. Static calibration caps setup at 15; uncertainty lowers it to 12.