- Reliability 10/20
- Static evidence: the manifest declares 10 tools (5 documentation + 5 execution), a PyPI package itasca-mcp 0.8.2 over stdio, and the README states Python 3.10+ plus a CI badge. However, only server.json and README are supplied; there are no committed CI workflow or test source files to verify that MCP init and the tool-list handshake actually run, or that the declared tools match real behavior. Execution tools depend on the user manually starting a bridge inside a locally installed ITASCA engine (addon.py / itasca_mcp_bridge.start()), and nothing evidences error handling, timeouts, or engine-version mismatch behavior (PFC 6.0/7.0/9.0, etc.). Under the static calibration cap (no verifiable real CI plus committed tests covering key paths), reliability is capped at 12; scored 10 — the happy path is plausible but tests and edge-case coverage are thin.
- Security and permissions 9/20
- No red lines observed: no malware, no credential theft, no covert exfiltration, no default irreversible delete/pay/deploy, and no real tokens or secrets in the install examples. Execution tools (itasca_execute_code, task submit/interrupt) inherently let an agent run arbitrary code inside the user's local ITASCA engine and write project files — a high-side-effect capability — yet the README discloses no confirmation step, sandbox, scoping, or least-privilege posture. On the network side, the bridge checks PyPI and self-upgrades on start ('self-upgrades before starting'), an unconfirmed automatic-update surface carrying supply-chain and controllability risk; downloading and pasting addon.py into the engine console has no stated integrity verification. Main risks are visible but permissions, confirmation, and data-flow disclosure are incomplete; scored 9, above the 0-4 red-line band.
- Maintenance 12/20
- MIT license is explicit, versioning is at 0.8.x with a published PyPI release, the README carries a CI badge and a CONTRIBUTING guide, the project is not archived, and 191 stars indicate some adoption. But the supplied material shows no actual commit history, release cadence, issue-response behavior, dependency-update policy, or security-response channel; the self-upgrade mechanism and true maintenance frequency cannot be verified from these files. This matches 'active but with governance/versioning evidence gaps'; scored 12.
- Documentation 13/20
- Docs are reasonably layered: English and Chinese READMEs, prerequisites, registration commands and JSON config for Claude Code / Codex / Gemini CLI, first-time and daily startup flows, a categorized description of the 10 tools, example prompts, a developer guide, and a CONTRIBUTING link. Deductions: tool parameters (e.g., required `software`, valid `version` values), return shapes, limits/quotas, and failure modes are not documented in the README; troubleshooting is delegated to an external bootstrap guide rather than given inline; and the security implications of the bridge auto-upgrade and addon.py are not disclosed. This is 'usable but with hidden assumptions and troubleshooting gaps'; scored 13.
- Setup experience 11/20
- The install path is clear: one-line uvx itasca-mcp registration with commands for three mainstream clients plus a generic mcpServers JSON; documentation tools need no bridge, while execution tools require running addon.py or itasca_mcp_bridge.start() inside the engine. However, prerequisites are heavy and hard to automate — a locally installed commercial ITASCA engine (PFC/FLAC/3DEC/MPoint/MassFlow), a hard dependency on uvx, and a manual copy-paste of a script into the engine's IPython console, which is fragile. There is no CI/test evidence that the install is reproducible. Under the static calibration cap (setup capped at 15 without verifiable CI and tests), scored 11.