- Reliability 8/20
- The README shows a CI badge and an npm version badge, implying some automated build/publish pipeline exists, and lists 25 tools whose descriptions are internally consistent with typical kintone REST API operations (get/add/update/delete apps, records, spaces, etc.) with no visible contradictions. However, this review had no access to an actual server manifest (manifest not cached), no CI workflow file contents, and no test code, so the real behavior of MCP init/tool-list handshake, input/output schemas, and error handling cannot be verified — everything remains at the level of documentation claims. Per the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence (real CI workflow plus committed tests covering key paths); given the total absence of such evidence, the score is further reduced to 8.
- Security and permissions 3/20
- This server exposes several irreversible, high-impact operations: kintone-delete-records (bulk record deletion), kintone-delete-space (space deletion), kintone-delete-form-fields (field deletion), and kintone-deploy-app (pushes app configuration to the production/operational environment). Nowhere in the README (install, config, tool list, limitations, troubleshooting) is there any indication that the server itself requires a confirmation step, dry-run mode, or other safety gate before executing these destructive actions — the safety boundary relies entirely on the calling client/user's discretion. This matches the red-line criterion of 'irreversible delete/deploy defaults without confirmation.' Additionally, credentials (username/password, API token, client certificate password) are passed via CLI arguments or environment variables; the CLI-argument path carries the common risk of credentials appearing in process listings, and the docs do not mention any log redaction. Based on this red-line finding, security is scored 3, with the red-line issue explicitly flagged here.
- Maintenance 14/20
- This repository is the official kintone (Cybozu) local MCP server, giving it clear ownership. The README includes a CI badge, an npm package version badge, the Apache-2.0 license, a link to a CONTRIBUTING.md guide, and a channel for bug reports/feature requests via GitHub Issues; the 'Support Policy' section also clarifies governance by stating the project is outside kintone's official API support desk and directs users to Issues instead. These signals indicate an actively maintained, clearly owned project. However, the README does not show concrete release history, a changelog, release cadence, or a dependency-update policy, nor a dedicated security-response channel, leaving some governance and versioning gaps — hence 14 rather than a top score.
- Documentation 15/20
- Documentation is fairly comprehensive: three installation paths (MCPB extension, Docker image, npm global install) with concrete steps, an MCP client configuration file example, a configuration options table (mapping CLI flags to env vars, required/optional status, and precedence rules), a separate authentication guide link, a full list of 25 tools with brief descriptions, usage notes, several documented limitations (e.g., no attachment-field registration, no guest-space support), troubleshooting guidance for connection/auth/permission errors, and a privacy policy reference. The gap is that the tool list only gives a name and a one-line description per tool, without per-tool input parameter schemas, return structures, or worked call examples (e.g., JSON Schema or sample payloads), and there is no mention of API call cost or rate-limit implications. Overall usable but with detail gaps, scored 15.
- Setup experience 13/20
- Installation paths are clear and cover mainstream scenarios: Claude Desktop users can drag-and-drop the MCPB package for a one-click install with a GUI form for credentials; Docker and npm both provide copy-pasteable commands; and standard MCP client (e.g., Claude Code, Cursor) config file paths and JSON examples are given, along with HTTPS_PROXY setup guidance for proxied environments. The steps are concise and platform coverage (Docker/npm/MCPB) is broad. However, per the static calibration rule, setup cannot exceed 15 without verifiable execution evidence (e.g., actual run logs or passing integration tests), and no first-hand evidence of a successful run is present in the material — only procedural instructions — so the score is capped at 13.