- Reliability 8/20
- The README lists a substantial tool surface, validation workflow, and several deployment paths, but the server manifest is unavailable and no verifiable source, CI workflow, or committed test files are supplied. The “5418 passing” badge is not execution evidence under this review. The happy path is plausible, but initialization handshake behavior, declaration consistency, dependency control, and error handling cannot be confirmed, so the static calibration requires a deduction.
- Security and permissions 12/20
- The README identifies API-key and Cloudflare credential environment variables and states that Cloudflare credentials are confined to the N8N_API_URL origin. It also documents disabling write, delete, test, credential, and data-table tools, plus blocking destructive operations within bundled tools. These are meaningful permission and data-boundary controls. However, high-impact workflow, credential, data-table, execution, and deletion tools remain available, and there is no source-level evidence of default confirmation, complete data-flow controls, or authorization enforcement, so this is not near full marks.
- Maintenance 13/20
- The project states an MIT license, is not archived, and provides a changelog, contribution guide, sponsorship channel, and explicit n8n version information, giving reasonable ownership and maintenance signals. The supplied material does not provide verifiable release history, commit cadence, dependency-update practice, vulnerability-response channel, or issue-response evidence. Stars and open issues are discovery signals only and add no points.
- Documentation 14/20
- The README covers self-hosting, Docker, Railway, cloud deployment, n8n integration, Cloudflare authentication, security hardening, privacy telemetry, HTTP deployment, workflow diffs, and client integrations. It also describes the tools and their main modes, making the documentation structure strong. Points are deducted because the linked documentation contents are not supplied, the manifest is missing, and costs, limits, troubleshooting, and declared behavior cannot be independently reviewed; the README is also untrusted evidence.
- Setup experience 11/20
- The README offers a hosted dashboard, a stated free quota, self-hosting options, and setup-document links for several mainstream clients and platforms. The actual installation commands, client configuration examples, runtime prerequisites, and server manifest are not provided, so the complete path from environment preparation to a verified MCP connection cannot be established. This supports a usable but manual and incompletely evidenced setup score.