- Reliability 6/20
- Only the README and server.json are supplied; no source, CI, or committed tests can verify behavior. The happy path described (npx start, OpenAI-compatible endpoint, eight tools) is plausible, but the init/tool-list handshake, streaming, and error handling cannot be confirmed from source. The README license badge (Apache-2.0) contradicts the repository's MIT license, and the manifest repository URL differs from the repository name, so no score above 10 is warranted.
- Security and permissions 9/20
- Credentials are passed via environment variables and marked secret in the manifest; examples use placeholders and no hardcoded tokens are present. The main risk is that code_task_files can read arbitrary absolute paths by default, with only an optional HOUTINI_LM_FILE_ROOTS allowlist and no explicit confirmation mechanism; data is sent to a user-configured local or cloud endpoint, which the docs disclose. No malware, credential theft, or dangerous default operations are evident, so no red line applies, but least-privilege and confirmation/scoping are incomplete.
- Maintenance 9/20
- Version evolution is visible (v2.8.0/v2.9.0/v3.2.3), the npm package is at 3.2.3, and the repository is not archived with 10 open issues. However, there is no evidence of commit cadence, dependency updates, issue responsiveness, or a security-response channel. The license is inconsistent (Apache-2.0 in README vs MIT in the repository). Stars are discovery signals only and add no points.
- Documentation 15/20
- The README is broad and well-structured: quick start, Claude Code/Claude Desktop configs, full tool parameter tables, environment variable table, compatible endpoints, streaming/timeout behavior, performance tracking, troubleshooting links, and a self-test section. Deductions: license label conflict, manifest repository URL mismatch with the repository name, and the referenced deep-dive docs (docs/manual) are not present in the supplied source material, so their content cannot be verified.
- Setup experience 13/20
- Install is clearly a few steps: a single npx command with complete Claude Code and Claude Desktop configuration examples, local/cloud endpoints via environment variables, and an explicit Node >=22.5 requirement. Static calibration caps setup at 15 without real CI and committed tests; additionally, the manifest does not expose a bin entry, so npx executability is inferred only from the README. Score 13.