- Reliability 5/20
- Evidence is limited to the README; no source files, tests, or CI workflows were supplied, and the server manifest was not cached, so the claimed 15 tools cannot be cross-checked against real declarations. The README describes a plausible happy path (npx start; list/get/create/execute tools), but there is zero verifiable execution evidence. Per static calibration, reliability cannot exceed 12, and in practice it scores 5. Deductions: no test suite or CI configuration in the supplied material, no way to confirm the MCP init and tool-list handshake, and internal inconsistencies (e.g., 'Zero Configuration' contradicts required N8N_HOST/N8N_API_KEY; two sections both labeled 'Method 2').
- Security and permissions 7/20
- Credentials are passed via N8N_API_KEY/N8N_HOST environment variables, all examples use placeholders, no real secrets were found, and no red line is triggered (no malware, no covert exfiltration, no real leaked tokens, no irreversible default without confirmation). The server is by design an API wrapper that sends a user-supplied key to a user-supplied host. However, the README recommends the Smithery hosted mode first, which means handing the n8n API key to a third party; destructive tools (delete_workflow, delete_execution, deactivate_workflow) show no confirmation mechanism; and n8n API-key scoping is only hand-waved as 'appropriate permissions' with no visible server-side least-privilege or scoping enforcement. With source code unavailable, these security claims are unverifiable, so 7 is the conservative score.
- Maintenance 8/20
- The repository is not archived, carries an MIT license, and metadata shows 534 stars and 5 open issues — but stars are only a discovery signal and never add points. No commit history, release cadence, dependency-update evidence, issue-response data, or security-response channel was supplied; the CI badge in the README is untrusted marketing. Because governance details (who maintains, how releases happen, how security issues are handled) cannot be verified from the source, 8 is a conservative estimate.
- Documentation 13/20
- The README is layered and above average: Smithery/NPX/manual installation, an environment-variable table, concrete Claude Desktop and Cline config JSON, parameter tables for all 15 claimed tools, per-tool-group usage examples, troubleshooting for common errors, an FAQ, and links to four auxiliary guides (GETTING_STARTED/USE_CASES/COMPARISON/TROUBLESHOOTING). Deductions: 'Zero Configuration' contradicts the required env vars; two sections are both numbered 'Method 2'; required API-key permissions and n8n API rate/cost/limits are undocumented; MCP resources and capabilities are not disclosed; troubleshooting is generic and unverified against code. Score: 13.
- Setup experience 11/20
- The documented setup path is short and clear: run via npx, set two environment variables, and paste one of the provided client configs, with concrete examples for Claude Desktop and Cline — a few-step, actionable path. However, static calibration caps setup at 15 without verifiable execution evidence (real CI plus committed tests), and none was supplied. The npm package's existence, actual npx behavior, Windows path details, and Node 18 checking are all unverified. The hosted Smithery option adds an alternative but also a third-party dependency. Hence 11.