- Reliability 8/20
- The only trustworthy evidence is the internal consistency of the manifest and README: npm package memorix 1.4.1, stdio 'serve' argument, Node >=22.18.0, Git-root project binding, a micro profile with 7 tools, and keyword fallback when embeddings are unavailable. A clean init plus tool-list handshake is plausible, but the supplied material contains no source code, no committed tests, and no CI workflow files; the CI badge and 'npm test' line are unverified README claims, and server.json declares no tools/capabilities to cross-check against real behavior. Missing verifiable execution evidence and thin error-path detail place this at the 'plausible happy path, thin tests' anchor; per the static cap and uncertainty rule, conservatively scored 8.
- Security and permissions 15/20
- No red-line issues are visible: the provided config examples contain no real tokens, there is no covert-exfiltration pattern, and destructive or billed operations require explicit action (uninstall requires --yes, media generation is an explicit CLI operation, MCP media generation requires MEMORIX_MCP_MEDIA_GENERATION=1). Data boundaries are well articulated: local-first SQLite/Orama, imported media hashed and kept outside the Git worktree, project-scoped search by default, cross-project portability restricted to user + portable long-term items, and API keys read from environment/config without the media library storing them. Deductions: hooks that capture prompts and tool events are installed by default for several agents (opt-out via --noHooks rather than opt-in), setup writes to many agent/editor config locations, and the sample config enables LLM formation ('active') by default, meaning memory text may be sent to model providers unless reconfigured. Score: 15.
- Maintenance 14/20
- Evidence shows an active, versioned project: Apache-2.0 license, a consistent 1.4.1 release across manifest and npm metadata, a changelog and docs map, a CI badge (unverified), and the repository is not archived. Stars and download badges are excluded per the scoring rules. Deductions: the supplied material contains no commit history, release dates, issue-response evidence, dependency-update cadence, or security-response channel, so sustained maintenance cadence and governance cannot be confirmed from the evidence itself. Score: 14.
- Documentation 16/20
- Documentation is layered and unusually thorough for this category: install commands, per-agent integration tables explaining what each setup writes, a memory-model layer table, runtime-mode matrix, TOML config examples, Docker and SDK snippets, docs map, llms.txt, changelog, and candid limitation disclosures (keyword-only fallback, 20 MiB vision cap, billed MCP media generation disabled by default, honest Lite index limits). Deductions: the actual MCP tool/parameter reference is only linked (docs/API_REFERENCE.md) rather than present, the manifest declares no tool list to verify schemas, cost guidance is partial (MiniMax and embedding lanes only), and troubleshooting content is pointed to rather than included. Score: 16.
- Setup experience 13/20
- The main path is short and concrete for mainstream clients: install Node >=22.18.0, npm install -g memorix, then memorix setup --agent <agent> --global per agent; a manual 5-line stdio JSON example, an HTTP path (background start with a 3211/mcp endpoint), and a Docker path are all documented, including Windows-specific paths and per-agent differences. Deductions and conservative handling: the supplied files contain no verifiable execution evidence (static cap of 15); Node 22.18.0+ is a nontrivial prerequisite; some targets require extra manual approval (e.g., Codex plugin hook review in /hooks); global hook installation is default-on for several agents; and the breadth of per-agent surfaces makes a uniform 'few-step' claim hard to generalize. Score: 13.