- Reliability 10/20
- Static material shows a local stdio server declared in server.json as PyPI package kinocut 1.15.1 with uvx runtimeHint, and the README documents concrete diagnosability work: a `kino doctor` check that imports the same server tree used by `--mcp`, honest MCP startup failure reporting, a golden path script, and receipt-backed workflow provenance. That said, nothing in the supplied source is verifiable execution evidence — no CI workflow file, no committed test files, and no server-side tool list to compare against the claimed 196/201 MCP tools, so declared behavior cannot be confirmed against real behavior. The README also mixes 'published 1.15.1' and 'development tip' counts (196/201, 167/172) and self-describes several surfaces as gated or unreleased. Under the static calibration cap of 12 for absence of verifiable execution evidence, and with these residual contradictions, the score is reduced to 10.
- Security and permissions 11/20
- The server is described as local-first, Apache-2.0, with no account or API key for the core surface and no upload of media to a vendor cloud; high-risk edit paths are stated to run preflight guardrails and publication flows are fail-closed with human review. I found no malware, credential theft, covert exfiltration, irreversible default destructive actions, fabricated maintainer identity, or install examples containing real secrets, so no red line is triggered. Deductions: it shells out to an external FFmpeg process without a documented sandbox or argument allowlist; optional extras (Hyperframes/Node, Whisper, C2PA signing, object matte ONNX) expand the dependency and network surface without a least-privilege discussion; a community self-hosting example exposes the server via Tailscale Funnel, Caddy and Google OAuth without a security review; and all permission/confirmation claims are README assertions with no static code evidence. Scored 11 as a mid-upper posture without a red line.
- Maintenance 15/20
- The manifest and README indicate Apache-2.0 licensing, a current 1.15.1 release, semantic versioning with a changelog, links to CONTRIBUTING, CODE_OF_CONDUCT, GOVERNANCE, SECURITY and SUPPORT, named external contributors with specific PR/issue numbers, and a claimed CI workflow plus release process — suggesting sustained, owned maintenance. Deductions: none of those governance or CI files are present in the supplied source, so their existence and content cannot be verified; the README repeatedly conflates published and development-tip versions and counts, weakening version traceability; the security-response channel is only a link with no described SLA or process; and release dates in the far future are stated without corroborating artifacts. Scored 15 rather than higher.
- Documentation 16/20
- Documentation is layered and specific: install matrix, golden path, tutorial, comparison and recommendation docs, plus TOOLS, PYTHON_CLIENT, CLI_REFERENCE, WORKFLOWS, RESCUE, 360_ASSEMBLY, AI_VIDEO_*, MCPB and C2PA references. The README supplies copy-paste client configs for Claude Code, Claude Desktop and Cursor, optional-extra sizing, a doctor self-check, a workflow JSON example and a receipt schema, and it discloses real limitations (MCPB is not a sandbox, `.insv` rejected, generative backends off by default, rendered bytes may differ across FFmpeg builds). Deductions: the published-vs-tip tool and CLI counts appear repeatedly in conflicting pairs, which can mislead a reader about current capability; most referenced docs/ files are not included in the supplied material so their content cannot be cross-checked; and tool parameter and error-code details are deferred to external files. Scored 16 as usable with some hidden assumptions.
- Setup experience 14/20
- The install path is clear: install FFmpeg first (brew/apt commands given), then `pip install kinocut` or `uvx --from kinocut kino doctor`, with directly copyable MCP configs for Claude Code (one-line command), Claude Desktop and Cursor; optional extras are listed with approximate sizes; `kino doctor` self-verifies features; and startup failures now report their real cause. Cross-platform support (macOS, Linux, Windows) is declared with Node 22+ required for Hyperframes. Deductions: FFmpeg and ffprobe must already be on PATH; the changelog shows recurring Windows path-escaping and console-encoding issues, implying setup is not consistently one-shot; the MCPB path depends on an existing Node/Python/FFmpeg stack and is explicitly not a sandbox; and no CI or test files are present to statically confirm the steps work. Under the static setup cap of 15, scored 14.