- Reliability 6/20
- The repository does not contain the actual running MCP server code — the README explicitly states that mcp.hiveintelligence.xyz is a 'managed, proprietary service,' with only the client SDK and skills being open source. This means the claimed capabilities (369 tools, 10 categories, etc.) cannot be verified against this repo's contents, and whether declared tools match real behavior is entirely unverifiable statically. No CI workflows or committed tests covering the stdio/streamable-http paths declared in server.json are present. Per the static calibration rule, without verifiable execution evidence reliability cannot exceed 12; given the core server code is absent and behavior is wholly unverifiable, 6 is awarded.
- Security and permissions 12/20
- Credential handling shows positive signals: all API key environment variables (COINGECKO_PRO_API_KEY, ALCHEMY_API_KEY, etc.) are marked isSecret:true and isRequired:false in the manifest, the remote endpoint's Authorization/X-API-Key headers are likewise optional secret fields, and README examples use placeholders rather than real tokens, so no red line is triggered. The declared tools (e.g. detect_rugpull, get_token_security, transaction simulation) are read-only/pre-signing checks, with no evidence of irreversible actions (transfers, deploys, signing) executed by default. However, because the actual hosted server is closed-source and proprietary, claims like 'never silently mixes provider data' or how keys are actually processed cannot be verified in code — they rest solely on the README (untrusted evidence). The stdio npm package (hive-intelligence) source is also not included in the review material, so its outbound network behavior likewise cannot be confirmed. Given visible primary risks but unverifiable permission/data-boundary claims, 12 is awarded.
- Maintenance 10/20
- The repo carries an MIT license, is not archived, and the manifest shows a tracked version (1.5.3), indicating some versioning discipline. But the provided evidence lacks commit history, release cadence, issue-response times, or a dedicated security-response channel (e.g. no SECURITY.md); the project is small (18 stars, 3 open issues). Support channels are general (email/Telegram/Twitter) rather than security-specific. This reads as 'active but with governance/versioning evidence gaps,' warranting 10.
- Documentation 16/20
- The README is thorough, covering connection configs for multiple clients (Claude Code, Cursor, VS Code, Claude Desktop, Windsurf, Gemini CLI), authentication guidance, an environment-variable table, a pricing table, CLI command reference, a tool-category overview, a security & trust section, and an FAQ — and it transparently discloses that the core server is proprietary rather than overstating openness, which is a credibility plus. Deductions apply because detailed tool parameters/schemas are not embedded in the repo docs (requiring live endpoint discovery), and rate-limit/cost specifics rely mostly on external links rather than in-repo evidence. 16 is awarded.
- Setup experience 13/20
- The installation path is clear: hosted mode needs only a Bearer/X-API-Key header to connect via several mainstream clients, with per-client config snippets provided; local stdio mode runs via npx against a published npm package. Steps are few and well-specified. Per the static calibration rule, however, without CI workflows and committed tests covering key paths, setup cannot exceed 15; additionally, since neither the hosted server nor the stdio npm package's source is in this repo, 'a clean start plus successful init/tool-list handshake' cannot be verified, and full verification would still require external account/API-key registration. 13 is awarded.