- Reliability 8/20
- Static review sees only the README and server.json; nothing was executed, and no CI workflow or committed test covering MCP initialization or the tool-list handshake is present in the supplied material, so the calibration cap of 12 applies. The described iwec behavior (serving the current notes directory, watching file changes, mandatory expect write guards, schema validation) is internally consistent with the manifest's npm package @iwe-org/mcp over stdio, but both versions are 0.0.0 placeholders, so release-to-source correspondence and the match between declared and actual tools cannot be verified. Error handling and dependency controllability are unverifiable — deducted.
- Security and permissions 11/20
- No malware, credential theft, or covert exfiltration appears: the manifest declares no network endpoints or secret env vars, and the README states local-first with no cloud or database, running inside the user's notes directory. Open concerns remain: the MCP surface includes mutating operations (create/update/rename/delete); the README claims expect guards are mandatory over MCP, yet there is no verifiable permission model, filesystem boundary (whether reads/writes can escape cwd), or explicit confirmation flow for dangerous operations, and npx -y pulls a remote package without disclosed integrity or signature checks. No red line is triggered, but confidence in least privilege and confirmation is insufficient, so the score is deliberately conservative.
- Maintenance 13/20
- The repository is not archived, has zero open issues, and shows active signals: a documentation site, Discussions plus Twitter/Reddit channels, editor plugins and skills ecosystem repos, and a clear Apache-2.0 license. However, static evidence contains no commit history, release cadence, dependency update record, or security response channel (e.g. SECURITY.md), and the manifest sits at 0.0.0, indicating a versioning/governance gap. Sustained maintenance cannot be confirmed, so points are deducted.
- Documentation 13/20
- Documentation layers are reasonably complete: the README covers installation (brew/npm/cargo/conda), MCP client configuration examples including cwd, a core CLI command table, editor integrations, and OKF support, with links to iwe.md pages for the CLI Reference, MCP Server, and Working with AI. Deductions: MCP tool parameters, response shapes, error formats, directory permission boundaries, and troubleshooting are not given as reviewable text in this repository but delegated to external links that cannot be verified here; rate limits, cost, and data-boundary disclosures are absent.
- Setup experience 11/20
- The install path is clear and multiplatform, with Homebrew, npm global install, Cargo, and conda commands, and MCP client config given as two JSON examples (direct iwec and npx -y @iwe-org/mcp) with cwd set — few steps. But per the static calibration, setup cannot exceed 15 without verifiable execution evidence (CI plus tests), and points are also deducted for the split naming between the npm package (@iwe-org/mcp) and the CLI (@iwe-org/iwe), the manual requirement to point the working directory at the notes folder, and 0.0.0 versions that make the usable release unconfirmable.