- Reliability 3/20
- Evidence: README lists 20+ tools, npx launch, stdio/SSE modes, manifest points to npm package @mobilenext/mobile-mcp. However no source, CI workflows, or committed tests are provided, so init handshake and tool-list/behavior consistency cannot be verified. server.json has {{VERSION}} template placeholders and no error-handling/edge-case evidence exists. Missing evidence is treated as a deduction, so score is low.
- Security and permissions 5/20
- Evidence: README discloses PostHog anonymous telemetry on by default (disable via env var), SSE auth via MOBILEMCP_AUTH, and unsafe URL schemes blocked by default. No credential theft or real tokens in install examples, so no red line. However, device-control tools can install/uninstall apps, type, tap, record screen, open URLs, with no least-privilege, confirmation, or data-boundary description; telemetry sends data third-party by default and no source audit is possible. Deducted accordingly, score 5.
- Maintenance 8/20
- Evidence: repo is not archived, Apache-2.0 license, README includes contributing guide, code of conduct, roadmap, and wiki. No commit/release history, dependency update records, security-response channel, or maintainer responsiveness evidence is supplied. Stars are not scored. Moderate-low score 8.
- Documentation 12/20
- Evidence: README covers multi-client configs (Claude Code, Cursor, Copilot, etc.), env vars, tool list, prompt examples, SSE/auth, prerequisites, and Wiki links. But it lacks formal parameter schemas (inputs/outputs) per tool, error codes and troubleshooting detail, rate/cost/limits, and verifiable log examples. Score 12.
- Setup experience 11/20
- Evidence: Standard stdio npx config and snippets for many mainstream clients are provided, prerequisites are explicit, and SSE mode has run commands. But no CI/test execution evidence exists, so static calibration caps setup at 15; iOS real-device setup needs go-ios, WebDriverAgent, and tunnel (complex), and manifest version is a placeholder. Score 11.