- Reliability 7/20
- The static material shows a plausible Streamable HTTP remote endpoint, client configuration examples, and fairly detailed tool parameters, but provides no committed CI, tests, or reproducible evidence for initialization and tools/list. The manifest URL differs from the README's recommended URL, the README claims 42 tools while only 29 are detailed, and error handling, dependencies, and edge behavior are not evidenced, so points are deducted.
- Security and permissions 7/20
- The README claims explicit confirmation for writes and paused defaults for new ads, and says remote authentication is handled in the cloud; however, these controls are not supported by source-code or test evidence. Tools broadly accept optional access tokens, and the README recommends placing an API token in a URL query parameter, creating leakage risk through logs, browser history, or proxies. Permission scope, data flow, retention, and least privilege are insufficiently documented. No malware, credential theft, or other explicit red-line behavior is shown, so this is not scored in the 0-4 range.
- Maintenance 7/20
- The repository is not archived, the manifest gives a defined name and version 1.0.118, and the README provides Discord, email support, and Pipeboard ownership cues, so it is not visibly abandoned. However, there is no commit history, release cadence, dependency-update evidence, vulnerability-response process, or verifiable maintainer identity. The manifest says NOASSERTION while the README claims Business Source License 1.1, so the licensing evidence is contradictory and points are deducted.
- Documentation 9/20
- The README supplies remote and local paths, setup examples for several mainstream clients, authentication steps, inputs and outputs for 29 tools, an example, licensing information, and basic troubleshooting. Points are deducted because the manifest and README disagree on the remote URL, the tool counts do not match, the local setup guide is referenced but not provided, and there is no clear evidence for costs, rate limits, retention, permission scope, or systematic error diagnosis.
- Setup experience 11/20
- The hosted MCP path is short and covers Claude, Cursor, and other MCP clients, with stated Windows, macOS, and Linux support. Points are deducted for two different remote URLs, dependence on an external Pipeboard account and Meta account connection, the security and fragility of query-parameter token configuration, and missing runtime details for the local installation path.