- Reliability 8/20
- This review relies solely on the README. The project claims to use FastMCP and documents a stdio transport launch command, and a build-status badge implies CI exists. However, no manifest was cached, no tool list, and no test files were provided as direct evidence, so it is impossible to verify that declared tools match actual behavior or that the MCP init/tool-list handshake behaves as described. The README's mention of a 'legacy' compatibility mode and a multi-step migration path hints at version branching and potential edge cases, but error-handling details are not shown in the supplied material. Per the static calibration rule, without verifiable CI-plus-test evidence the score cannot exceed 12, so 8 is given.
- Security and permissions 11/20
- This server handles IMAP/SMTP credentials and has a real, external side effect (sending email). The README states passwords are stored via keyring, that legacy TOML files and keyring entries are left untouched during migration, and that the import flow is 'preview-first' with a required IMPORT confirmation — evidence of some deliberate confirmation design for destructive/replacing actions, which is a positive. However, the material gives no indication of whether the send-email action itself requires explicit confirmation or scoping, nor details on cross-account permission isolation or a full disclosure of network access boundaries (the actual Security doc is only linked externally, not included). No red-line issue was found (no malware, no evidence of covert credential exfiltration, no unconfirmed irreversible destructive default), so the red-line floor does not apply, but incomplete evidence on scoping/confirmation for the send action warrants a deduction to 11.
- Maintenance 15/20
- The repository is not archived, uses the BSD-3-Clause license, and displays release, GitHub Actions build-status, and Codecov badges, indicating an active CI/release pipeline. Only 2 open issues against 301 stars suggests reasonably responsive issue handling, though no direct issue history was reviewed. A separately maintained documentation site and mention of a notable version transition ('Local Email App V2') suggest ongoing active development. Lacking direct evidence of commit cadence, release dates, or issue response times prevents a perfect score, so 15 is given.
- Documentation 14/20
- The README is well structured, with a quick-start section, an MCP client config example, an optional migration path, and links to a categorized external documentation site (getting started, configuration, tools, transports, security, troubleshooting). A dedicated docs/security.md and troubleshooting links suggest layered documentation. However, specific tool parameter definitions, rate limits, and cost/limit disclosures are not present in the supplied material — only links to external docs whose content could not be verified — leaving uncertainty about documentation completeness, hence 14.
- Setup experience 12/20
- The README provides concrete steps from uv sync/uv run through to an MCP client JSON configuration, plus a uvx invocation for published releases, which is reasonably specific. However, the full setup flow depends on running a foreground UI process to configure accounts, and the added complexity of 'legacy' vs. 'managed' modes with a preview-then-confirm migration flow raises the practical step count and friction, so this does not qualify as a minimal-step setup. Additionally, per the static calibration rule, setup cannot exceed 15 without verifiable execution evidence (real CI plus committed tests covering key paths), which is absent here, so the score is further reduced to 12.