- Reliability 9/20
- This is a feature-rich MCP server claiming to support parsing HWP, HWPX, PDF, etc., and converting to Markdown. However, static review cannot verify the MCP handshake or whether declared tools match actual behavior, as no explicit MCP server tests or CI run evidence is visible in the repository. The README details 15 tools and common issues, but lacks reproducible test cases or CI configuration to prove key paths. Reliability score is capped at 12; given the lack of executable verification evidence, 9 is awarded.
- Security and permissions 11/20
- No red-flag signs of malware, credential theft, or covert exfiltration. The README mentions several security protections such as ZIP bomb protection, path traversal blocking, and SSRF prevention, but their implementation cannot be statically confirmed. Potential attack surface exists due to parsing PDF, ZIP, etc. Additionally, PDF OCR downloads external models, but KORDOC_OFFLINE and KORDOC_ROOT environment variables are supported to limit network and file access, showing some security consideration. Since permission and confirmation mechanisms are unclear and data boundaries mainly rely on optional environment variables, a score of 11 is given.
- Maintenance 13/20
- Repository is active with recent v4.7.2 releases and not archived. High star count (1672) indicates community interest, but per rules stars do not count. MIT license present, CHANGELOG is detailed, but no clear dependency update policy or security response channel. Maintenance is active but governance has gaps, such as lack of explicit contributing guide or security advisory, hence 13.
- Documentation 14/20
- Documentation is very thorough, covering installation, CLI, API, MCP config, usage examples, and changelog. But missing a dedicated troubleshooting guide for the MCP server itself, and full parameter descriptions for tools. Some hidden assumptions exist, like dependency on Node.js 18+, and OS-specific compatibility details not fully specified. Documentation is high quality but has minor omissions, so 14.
- Setup experience 12/20
- An interactive install wizard via `npx kordoc setup` supports various AI clients, and manual configuration examples are provided. Installation steps are clear, but depend on npx and Node.js, without mentioning version compatibility issues. Since actual installation cannot be verified and no CI evidence, setup is capped at 15 per guidelines, giving 12.