- Reliability 7/20
- The README states HyperChat 1.0 was hand-written and is migrating to 2.0, an inconsistent version narrative, and no server manifest is available (SERVER MANIFEST: [not cached]), so declared tools cannot be checked against real behavior or against a reproducible MCP init + tool-list handshake. No source files, no committed tests, and the build.yml badge is illustrative rather than verifiable test evidence; under static calibration reliability must not exceed 12. Runnable entry points are merely inferred from the npm package name and CLI examples, so a happy path is plausible, but error handling, dependency control and edge cases are unsupported; deducted to 7.
- Security and permissions 6/20
- The README explicitly grants Agents filesystem, terminal, browser, git and database MCP tools, and sample agent configs set isConfirmCallTool: false, i.e. tool calls execute without confirmation against the local filesystem and shell, so least privilege and confirmation of dangerous operations are unclear. API keys and the web password are injected via env vars and .env, and examples use placeholders such as sk-1234567890, so no real token leak, malware, credential theft or covert exfiltration is evident. However, no reviewed code shows permission checks, path scoping, network-egress disclosure or data-flow boundaries, so it cannot score high; rated 6, and no 0-4 red line is triggered.
- Maintenance 9/20
- The repo is not archived, has 707 stars and 30 open issues, and the README declares active 2.0 work with community 'Vibe Coding', while the npm package and CI badge indicate a release/build pipeline, showing some activity. But the license reports as NOASSERTION and the README only says the project uses an open-source license with details in the LICENSE file, which is not verifiable here; there is no clear ownership, versioning policy, security-response channel or dependency-update evidence, and issue responsiveness is unproven. Governance and licensing gaps cap this at 9.
- Documentation 9/20
- Documentation is fairly layered: a dual-architecture comparison table, a five-level environment variable priority scheme, agent.yaml and Markdown custom-command templates, multi-@ file reference examples, and Web/CLI usage scenarios are all presented with readable snippets, making install and configuration largely usable. Yet there is no MCP server manifest or tool-parameter-level documentation, no disclosure of permission boundaries, cost/quota or troubleshooting guidance, and the README contradicts itself on 1.0/2.0 capabilities (license, vision), matching the 'usable but hidden assumptions and troubleshooting gaps' anchor near 10; rated 9.
- Setup experience 8/20
- Setup offers npm install -g @dadigua/hyperchat or npx, and env vars can be set five ways (export, global/workspace .env, CLI flags) with clear examples, a short and plausible path. However, no configuration example for any mainstream MCP client (e.g. Claude Desktop, Cline) is provided, nor a platform compatibility matrix or required Node runtime version, and no package config is available in the reviewed root to confirm the CLI entry point actually exists. Per static calibration setup cannot exceed 15 absent real CI workflows plus committed tests covering key paths; evidence here is weaker still, so 8.