- Reliability 7/20
- Evidence: The repo includes complete source code, package.json, pnpm workspace, CI workflows, and test directories, but static review does not verify actual runtime. Core features like server management, routing, and WebSocket/SSE endpoints have implementations, but error handling and edge-case test coverage are not clearly evidenced, and no reproducible handshake logs are provided. Deductions: No execution, missing clear test coverage for key paths and diagnostic details, so reliability below 12.
- Security and permissions 8/20
- Evidence: Code uses JWT, bcrypt, OAuth libraries, supports bearer token authentication, and docs explicitly state authentication is required by default. However, static review finds that credential storage and management details (e.g., session keys, database credentials) are not fully disclosed, and the granularity of API key permissions (e.g., all/read-only) and confirmation mechanisms for dangerous operations are not fully verified. No signs of malware or credential theft. Deductions: Incomplete evidence on least-privilege model and explicit confirmation for dangerous operations, so not full marks.
- Maintenance 10/20
- Evidence: Repo is active with recent commits and version tags, issues are responded to (34 open issues), license is Apache-2.0, and there is some evidence of dependency updates via GitHub Actions. Deductions: No clear security response channel and detailed release policy documentation, so not full marks.
- Documentation 9/20
- Evidence: README is detailed, covering quick start, Docker deployment, configuration guide, and CLI usage, with external docs link. It covers main features and authentication. Deductions: Full API reference (error codes, rate limiting), troubleshooting, and cost information are missing; some advanced configurations are not detailed.
- Setup experience 8/20
- Evidence: Docker images and quick start commands provided, configuration via mcp_settings.json is clear, client connection URL examples given. Local development commands provided. Deductions: No automated configuration script or full client configuration examples for mainstream clients (e.g., Claude Desktop), steps are many, dependencies on Docker and Node/TypeScript, and no verification of execution.