- Reliability 8/20
- Static review only, based on the supplied README and server.json. Evidence shows a single binary for macOS/Linux/Windows, a unit-tests.yml build badge, and documented targets (make test, make test-e2e, make lint), implying CI and test presence; the core flow (serve → mcpServers config → client connect → retrieve_tools discovery → call_tool_* with intent) is described coherently, with diagnosable exit codes (0/10/11/12) and --log-level=debug. However, no actual workflow files, no committed test files, no schema/migration versioning, and an empty packages array in the manifest are provided, so tool-vs-behavior conformance and edge cases (OAuth expiry, upstream startup failure) cannot be verified. Per static calibration, missing evidence is a deduction, not a best-case assumption. Score 8.
- Security and permissions 12/20
- The documentation states strong security intent: default bind 127.0.0.1:8080, local-first design, HTTP default with optional HTTPS, automatic quarantine for new servers against tool poisoning, pluggable Docker scanners (Snyk/Semgrep/Trivy) normalized to SARIF, intent-declared calls validated against annotations (read/write/destructive), sensitive-data detection, keyring integration, agent tokens, and an Activity Log for audit. No real tokens or secrets appear in install examples, and no evidence of malware, credential theft, or covert exfiltration was found, so no red line is triggered. Deductions: plaintext HTTP is the documented default and explicitly recommended for most users; examples pull npx mcp-remote without version pinning; mcpproxy trust-cert installs a self-signed CA into the system keychain (side effect) with no documented removal path; running third-party Docker scanner images has an undeclared trust boundary; no least-privilege matrix or explicit confirmation detail for destructive operations. Score 12.
- Maintenance 13/20
- Evidence includes an MIT license, OpenSSF Scorecard badge, semantic versioning (server.json 0.33.1, suggesting frequent iteration), broad release channels (DMG, Windows installer, Homebrew cask/formula, apt/dnf repos with a published signing key fingerprint, AUR, go install), and contributor docs (make dev-setup, prek pre-commit/pre-push hooks with stated duties). Activity signals are favorable, but commit cadence, issue response time, dependency-update automation, security-response channel (SECURITY.md), and governance/ownership cannot be confirmed from the material; 24 open issues with no response evidence. Score 13.
- Documentation 16/20
- Documentation is layered: multi-platform/multi-method install, quick start, config example (mcp_config.json with stdio and http upstreams), client setup examples (Cursor one-click and manual, Claude Desktop HTTP and HTTPS with NODE_EXTRA_CA_CERTS), HTTPS certificate management and troubleshooting, CLI commands, REST/MCP protocol links, and feature pages (search/discovery, quarantine, scanner plugins, Docker isolation, keyring, OAuth, activity log, preflight, agent tokens, sensitive-data detection). Some limits are disclosed (TLS optional, prerelease instability, preflight exit semantics). Gaps: no parameter-level tool schemas, no rate/cost guidance, no uninstall or CA-removal steps, no consolidated known-limitations list, and heavy reliance on an external site rather than reviewable files. Score 16.
- Setup experience 13/20
- The path is clear: single-binary install (DMG/installer/brew/apt/dnf/AUR/go install), mcpproxy serve on :8080, edit ~/.mcpproxy/mcp_config.json to add upstreams, one-click and manual JSON for Cursor, and an npx mcp-remote config for Claude Desktop, with coverage of macOS/Linux/Windows on x64/ARM64. Deductions: many distribution variants (tray app + embedded web UI) create choice overhead; apt/dnf require manual repo and keyring setup; the signing key fingerprint must be compared by hand; no execution evidence validates the one-click installer; and the Go 1.26+ prerequisite is high. Capped at 15 by static calibration; score 13.