- Reliability 8/20
- This static review is limited to the supplied manifest and repository-level README; it contains no source code, unit tests, or CI workflows for servers/mcp-neo4j-data-modeling. Per the static calibration, without verifiable execution evidence (real CI plus committed tests covering key paths) reliability cannot exceed 12. The manifest declares stdio transport and one optional environment variable (NEO4J_NAMESPACE), the package name matches the description, and no contradictions or hidden external dependencies (database, network) are visible, so a clean startup and handshake look plausible. However, no tool list, input/output schema, error handling, or dependency resolution evidence exists, so 'declared tools match real behavior' cannot be verified; edge cases and failure diagnosis are unproven. Scored at 8, the 'happy path plausible but tests/edge cases/error handling thin' anchor.
- Security and permissions 10/20
- No red lines triggered: no malware, credential theft, covert exfiltration, unconfirmed destructive delete/pay/deploy/remote-command defaults, fabricated maintainer identity, or real secrets in install examples. The only environment variable, NEO4J_NAMESPACE, is explicitly optional and non-secret, so the permission surface is small; a data-modeling server does not inherently need Neo4j credentials, which favors least privilege. Deductions are from missing evidence: the files do not show whether model import/export (e.g., Arrows.app) touches external networks, writes to disk or a remote Neo4j, whether dangerous operations require confirmation, or how data boundaries are disclosed. Scored at 10, the 'main risks visible but permissions/confirmation/scoping incomplete' anchor, lowered for uncertainty.
- Maintenance 13/20
- The repository belongs to the neo4j-contrib GitHub organization as a Neo4j Labs project, explicitly developed and maintained by the Neo4j Field GenAI team with community contributions welcomed, under an MIT license, not archived, with 980 stars and 25 open issues indicating ongoing attention. The manifest pins a concrete semver version 0.8.2 and a PyPI identifier, giving a clear release path. Deductions: Labs status explicitly disclaims any SLA and makes no guarantees about backward compatibility or deprecation, so governance/stability commitments are incomplete; there is no evidence of dependency-update policy, security-response channel, or an independent release cadence for this sub-server. Scored at 13, the 'active but governance/versioning gaps' anchor.
- Documentation 9/20
- The repository README offers a four-server overview, transport-mode explanations (STDIO/SSE/HTTP), and HTTP configuration examples and links a cloud deployment guide plus blog posts, giving some layered structure and honest disclosure of the no-SLA Labs limitation. Deductions are significant: the top-level README describes sibling servers, and its example commands (e.g., mcp-neo4j-cypher --transport http) cannot be attributed to the data-modeling sub-server. For this server there is only one line ('create, validate, and visualize Neo4j graph data models; import/export from Arrows.app'), with no tool parameters, return values, auth requirements, limits, cost, or troubleshooting content. Scored at 9, the 'usable but hidden assumptions and troubleshooting gaps' anchor.
- Setup experience 11/20
- The install path is fairly clear: PyPI package mcp-neo4j-data-modeling 0.8.2 over stdio, with a single optional environment variable that can be omitted for defaults, implying few steps and low complexity; the README also names mainstream clients such as Claude Desktop, VS Code, and Cursor. But the manifest contains no client configuration example (e.g., a claude_desktop_config snippet), and the README's HTTP/environment-variable examples target other servers, so nothing copy-pasteable for this server is provided; platform compatibility, Python version, and containerization are also undocumented. Per static calibration, setup cannot exceed 15 without verifiable execution evidence; evidence here is thin and partially misleading toward sibling servers, so 11 is awarded.