- Reliability 8/20
- The repo explicitly states it is 'the public listing and documentation repository'; the API server code is not in source, so static review cannot verify declared tool behavior, and no committed tests or CI exist. Core functionality depends on a remote cloud build pipeline (30–45 min queues) with error handling outside local control. Score 8: the discovery endpoint offers copyable curl verification, but key paths are not statically verifiable.
- Security and permissions 12/20
- Credentials support OAuth2/PKCE and API keys over HTTPS; isolated containers and encryption are claimed. No red lines found (no malware, no leaked tokens, dangerous operations gated by paid confirmation). Deductions: the server is closed-source, data flows to a third-party cloud processor, and the 'no data retention' claim is a trust assertion with no reviewable evidence; deletion and retention practices are promises only.
- Maintenance 8/20
- Version 1.0.7, 6 open issues, MIT license in manifest — though the README copyright section says 'All Rights Reserved', contradicting the MIT badge. Support email and security doc link exist. No visible release cadence, dependency update, or security-response process evidence; active but governance/versioning gaps, so 8.
- Documentation 12/20
- Well-layered docs: quickstart, per-client config examples (Claude/Cursor/Windsurf/Claude Code), tool catalog, tier/pricing pages, troubleshooting checklist, anonymous discovery examples. Deductions: tool parameter schemas are not in the repo (online-only), key claims like 'ephemeral, no persistence' lack reviewable evidence, and performance statements are vague ('Handles large datasets').
- Setup experience 13/20
- Setup path is very clear: one-line npx config, direct HTTP, and zero-config OAuth, each with complete JSON examples, plus an account-free way to browse tools. However, within the 15-point ceiling there is no in-repo CI+tests execution evidence and the npm package contents cannot be statically verified, so 13.