- Reliability 5/20
- The provided evidence is only the README; there is no package manifest, source, tests, or CI. This repository is an n8n client node rather than a standalone MCP server, so the 'init + tool-list handshake' cannot be observed in the review corpus. README claims STDIO, SSE, and HTTP Streamable transports and six operations, which makes a happy path plausible, but nothing verifies startup, error handling, or dependency control. Deductions for missing manifest, tests, and execution evidence; score kept low per static rules.
- Security and permissions 6/20
- No malware or token leakage is visible from the README; credentials are described as stored by n8n and can be passed via environment variables or headers. However, no source code verifies encryption, least-privilege scoping, output sanitization, or confirmation for executing remote tools that may have side effects. Data boundaries are unclear because the node deliberately sends data to external MCP servers. Deduction for unverifiable permission/confirmation handling; no red-line trigger.
- Maintenance 7/20
- License is MIT and the repository is not archived, with a public issue tracker, which are positive maintenance signals. However, the provided material contains no release history, commit cadence, dependency update health, contributor governance, or security-response channel. No explicit security policy file was supplied. Score reflects visible license and activity but missing governance and update evidence.
- Documentation 11/20
- The README is genuinely helpful: installation link, three transport credential formats, env var usage, operations list, AI-agent tool setup, Docker examples, and compatibility notes. Deductions: no troubleshooting section, no limits/cost disclosure, tool parameters are dynamic and only generically described, and the compatibility section omits HTTP Streamable while the top of the README deprecates SSE. There are also minor claims (e.g., MseeP badges) that cannot be verified from the supplied corpus.
- Setup experience 11/20
- Setup is well explained for a single platform: install as an n8n community node, create one of the three credential types, and configure operations; the Docker env var and mandatory N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE are documented. Still, it depends on the n8n runtime, requires manual environment configuration, and there is no one-command or verified client example in the source. Static calibration prevents awarding above 15 because no committed tests/CI are available to prove the setup path.