- Reliability 4/20
- Only the README and repository metadata were supplied; no source code, server manifest, CI, or tests are available. The 41 tools and 3 prompts in the README cannot be cross-checked against real behavior, and the MCP init and tool-list handshake cannot be verified. There is no obvious contradiction in the README, so the score is not zero, but the complete absence of executable evidence forces a low score.
- Security and permissions 7/20
- No red-line issues such as malware, embedded secrets, or unconditional destructive defaults are apparent. The token is passed via an environment variable, and READ_ONLY_MODE is documented to disable write operations. However, enforcement cannot be verified from source, no least-privilege token scopes are documented, and destructive tools (delete task/status/tag/section) show no confirmation flow. Main risks are visible, but least privilege and confirmation mechanisms are incomplete.
- Maintenance 5/20
- The repository is not archived and has an MIT license, so it is not abandoned. However, there is no evidence of commit history, release timelines, issue-response behavior, or dependency updates. Maintenance activity and governance cannot be verified, so the score is conservatively mid-low.
- Documentation 12/20
- The README covers environment variables, parameters for 41 tools, 3 prompts, 2 resource types, setup examples for three clients, and basic troubleshooting. It also discloses some limits (pagination 1-100, max 25 tasks, premium-only search). But cost/rate-limit information, real response examples, and deeper limitation disclosures are missing. The README is untrusted evidence without source-backed verification, so documentation is usable but incomplete.
- Setup experience 13/20
- The README clearly describes creating an Asana account, obtaining a token, and pasting config examples for Claude Desktop, Claude Code, or Codex CLI, all in few steps. However, no source, CI, or committed tests prove the npx package actually runs, and no pinned version or Node.js requirement is given. The static calibration caps setup at 15 without execution evidence, and manual configuration is still required, so 13 is awarded.