- Reliability 8/20
- The manifest declares a stdio transport for the PyPI package mcp-neo4j-cypher 0.6.0, and the README describes schema retrieval plus read/write Cypher execution, consistent with the manifest description, so the happy path is plausible. However, this review saw only the manifest and repository-level README; no source files, committed tests, or CI workflows for the servers/mcp-neo4j-cypher subfolder were provided, so tool-list/behavior agreement and error controllability cannot be verified. Under the static calibration rule (no CI plus committed tests covering key paths means reliability must not exceed 12), the score is reduced to 8.
- Security and permissions 11/20
- The manifest correctly marks NEO4J_PASSWORD as isSecret, which is basic credential hygiene. But NEO4J_READ_ONLY is only an optional variable and the default is not disclosed as read-only, implying write Cypher (including potential deletions) is permitted by default, and neither manifest nor README documents any confirmation step for destructive operations. The connection also targets an external Neo4j URI, and data boundaries/egress are not described in the visible material. No red-line behavior was found (no malware, credential theft, covert exfiltration, real hard-coded tokens, or fabricated identity), so the 0-4 band does not apply; incomplete least-privilege and confirmation mechanics yield 11.
- Maintenance 13/20
- This is a Neo4j Labs project with a clear MIT license, a 0.6.0 version and ongoing releases evidenced in the manifest, 980 stars, 25 open issues, and not archived, indicating active development. However, the README explicitly states no SLA, no backward-compatibility guarantees, and no product-team support, and no security-response channel (e.g., SECURITY.md) is visible; per-subserver release cadence and dependency-update evidence are also absent. Score 13.
- Documentation 12/20
- The repository-level README covers purpose, an overview of the four servers, stdio/SSE/HTTP transport modes, HTTP launch flags with environment-variable examples, and links to a cloud deployment guide, so install and configuration information is usable. Yet server-specific tool parameters, response formats, limits for NEO4J_RESPONSE_TOKEN_LIMIT/READ_TIMEOUT/SCHEMA_SAMPLE_SIZE, cost, and troubleshooting require subfolder docs that were not visible here; the APOC dependency is mentioned but installation/troubleshooting steps are thin. Hidden assumptions remain, so 12.
- Setup experience 12/20
- The install path is clear: pip install mcp-neo4j-cypher and run over stdio, with README examples for HTTP mode commands and environment variables, plus the three required variables NEO4J_URI/USERNAME/PASSWORD and named support for mainstream clients (Claude Desktop, VS Code, Cursor, etc.). But directly copyable client config snippets are missing, and preparing a Neo4j instance and enabling the APOC plugin is not fully documented, requiring external docs; the process is usable but manual. Under static calibration (setup capped at 15) and with no execution evidence, score 12.