- Reliability 10/20
- The README states the MCP server is started via `lat mcp`, with `lat check` validating graph consistency, so the intended behavior is coherent. However, no server manifest is cached and only the README was supplied: there is no visible evidence of the MCP init handshake, declared tool list, error handling, or committed tests. Under the static calibration, reliability cannot exceed 12 without verifiable execution evidence (real CI workflows plus committed tests covering key paths), and since neither is present the score is lowered. 10.
- Security and permissions 12/20
- The boundary is reasonably clear: semantic search runs offline by default using a bundled local all-MiniLM-L6-v2 model compiled to WASM (no native binaries, no network); remote embeddings via OpenAI or Vercel AI Gateway only when the user supplies a key. Key resolution is explicit (env var, key file, helper command with a 10s timeout, config file). Deductions: the docs do not state whether keys are persisted to disk or where requests are sent, and the side effects/permission scope of `lat init` hooks, pre-commit hooks, and GitHub bots are not disclosed or confirmation-gated. No red-line issues (no malware, credential theft, or unconfirmed irreversible defaults) were found. 12.
- Maintenance 14/20
- MIT license is explicit, and the repository is active rather than archived (1913 stars and 33 open issues indicate usage; popularity is treated only as a discovery signal and adds no points). An npm package and version badge suggest a real release channel. Deductions: the repository is not cached, so commit cadence, issue response time, dependency updates, and a security-response channel cannot be verified, leaving governance and versioning evidence gaps. 14.
- Documentation 15/20
- Reasonably layered: problem motivation, the concept set (`[[wiki links]]`, source backlink comments via `// @lat:`, `lat check` enforcement), a directory layout example, the full CLI surface (init/check/locate/section/refs/search/expand/mcp), key resolution order, backend switching via `lat reindex`, and development requirements (Node 22, pnpm, rustup). Deductions: MCP client configuration examples, tool parameter details, cost disclosure, and troubleshooting are missing, and the README is untrusted evidence that cannot be cross-verified against source here. 15.
- Setup experience 11/20
- The install path is short: `npm install -g lat.md` followed by `lat init` in the target repo, with offline semantic search working without an API key. Deductions: there are no examples for wiring the MCP server into a mainstream client/editor, no platform compatibility notes, and development builds require a Rust/WASM toolchain. With no server manifest or executable evidence the setup ceiling is 15; missing client integration examples bring the score to 11.