- Reliability 5/20
- The core issue: this repository is fundamentally an Electron desktop application (built on the OpenClaw runtime). The README explicitly frames it as an MCP *client* — users configure external MCP servers inside it and LobsterAI syncs them into OpenClaw — not as a repository that itself exposes a set of MCP tools. No server manifest was provided (marked not cached), so there is no evidence of any tool declarations, an MCP init handshake, or a tool-list response to verify that declared tools match real behavior. The README references 'npm test' as 'the official Vitest entry used by CI' and lint scripts, but no actual CI workflow file or test coverage over key paths is shown, so it does not meet the static-calibration bar requiring real CI workflows plus committed tests. Per the rule, reliability is capped at 12 when this evidence is absent; combined with the object-type mismatch and total absence of MCP-specific evidence, a low score is warranted.
- Security and permissions 10/20
- The README (untrusted evidence, considered only as a claim) states renderer windows use context isolation, disabled Node integration, and sandboxing, that sensitive tool actions (file ops, terminal commands, network access) are permission-gated and logged, and that app data is stored locally in SQLite. None of these claims can be independently verified without source or manifest access. The product's attack surface is notably broad: it allows remote control of a real desktop (terminal commands, file operations) via numerous IM channels (WeChat, Feishu, DingTalk, Telegram, Discord, QQ, WeCom, etc.), and inadequate confirmation on such remote-trigger paths would be high-impact. No explicit red-line evidence was found (no malware, credential theft, fabricated identity/test results), but because the permission model, confirmation flow, and data boundaries cannot be independently verified from static material alone, a high score is not justified.
- Maintenance 13/20
- The repository has 5775 stars, 757 open issues, a clear MIT license, and is not archived — signs of real activity and an active user base; the README's contribution guidance (issue/PR templates) also indicates some baseline governance. However, there is no direct evidence of recent commit cadence, release/versioning history, or a security-response channel (e.g., SECURITY.md), and the relatively high open-issue count may suggest triage strain. Overall this sits in the upper-middle range: active, but with governance/versioning evidence gaps.
- Documentation 14/20
- The README is well-structured, covering installation (source build and downloadable installers), development commands, a project map, packaging instructions, and a dedicated 'Security And Data' section, plus real-world usage prompts — solid layered documentation. However, since this object is not exposed as an MCP server with tools, there is no documentation at all of tool parameters, invocation examples, error handling, rate limits, or cost, and no troubleshooting content from that angle — a documentation gap directly relevant to FMRS scoring criteria.
- Setup experience 8/20
- This is not a server that can be connected to a mainstream MCP client in a few steps via npx/uvx; it is a full Electron desktop application requiring a pinned Node.js version (>=24.15.0 <25), npm install, building the OpenClaw runtime (with multiple environment-variable branches for force-rebuild, custom source paths, etc.), and separate packaging pipelines per platform (macOS/Windows/Linux). The process involves many steps and a substantial desktop build toolchain, and no mcpServers configuration JSON example is given showing how to register it as an MCP endpoint in a client like Claude Desktop. Per static calibration, setup cannot exceed 15 without verifiable execution evidence, and the process complexity further lowers the score.