- Reliability 10/20
- Evidence is limited to the repository-level README, the server manifest, and a general overview; no source code, tool implementations, tests, or CI artifacts specific to mcp-neo4j-memory are provided. The manifest declares a stdio transport and PyPI package [email protected] with a complete environment variable set, so a happy path is superficially plausible, but declared tools cannot be verified against real behavior, and connection-failure or database-unreachable handling is undocumented. Static calibration forbids scoring above 12 without verifiable execution evidence (real CI plus committed tests covering key paths), and none is present. Score 10: plausible happy path, thin/absent evidence for tests and edge cases.
- Security and permissions 12/20
- The manifest marks NEO4J_PASSWORD as isSecret=true and credentials are passed via environment variables rather than hardcoded; the README contains no real tokens or secrets and shows no covert exfiltration, malware, or unconfirmed destructive defaults, so no red line is triggered. However, as a memory server it persists entities and relationships into the configured Neo4j instance. The docs do not disclose data flow, retention, tenant/namespace isolation boundaries, or deletion semantics and whether they require confirmation. The URI may point to a remote host, yet least-privilege guidance (e.g., read-only credentials, database-scoped grants) is absent. Main risks are visible but permission scoping and confirmation are incomplete; score 12.
- Maintenance 14/20
- The repository is maintained under the neo4j-contrib organization and labeled a Neo4j Labs project, explicitly stating it is developed by the Field GenAI team, not supported by the product team, and offered without SLAs or backward-compatibility guarantees. Licensing is clear (MIT), version 0.4.5 indicates multiple releases, the repo has 980 stars, 25 open issues, and is not archived. Yet the scored sub-server has no dedicated release notes, changelog, or documented security-response channel, leaving governance and versioning gaps. Score 14.
- Documentation 11/20
- The README provides a repository-level overview, descriptions of four servers, transport modes with HTTP configuration examples, a cloud deployment guide link, and license text. For mcp-neo4j-memory it offers only a few lines (store and retrieve entities and relationships in a local or remote Neo4j, accessible across sessions and clients), with no tool-level parameter documentation, tool inventory, return formats, error cases, required database initialization (constraints/indexes), namespace semantics, cost, or troubleshooting. Auth and install are limited to environment variable names, with no credential-acquisition or local Neo4j preparation steps. Usable but with hidden assumptions and troubleshooting gaps; score 11.
- Setup experience 12/20
- The deployment path is relatively direct: install the PyPI package mcp-neo4j-memory, use stdio transport, and set NEO4J_URI/NEO4J_USERNAME/NEO4J_PASSWORD. However, there is no client-config example specific to this server (e.g., a claude_desktop_config.json snippet), no steps to prepare a local Neo4j or Aura instance, no explanation of optional variables (NEO4J_DATABASE, NEO4J_NAMESPACE) beyond one-line descriptions, and no platform compatibility notes. This is workable but manual and fragile, and under static calibration setup cannot exceed 15 without execution evidence; score 12.