- Reliability 10/20
- The server declares itself a thin stdio connector whose four tools (nextjs_index, nextjs_call, nextjs_docs, browser_eval) are described consistently with their behavior, and the README supplies troubleshooting (ERR_MODULE_NOT_FOUND, 'No server info found') plus a 60-second upstream deadline and abort semantics, so the happy path is plausible. However, static review sees only the README and server.json: no committed tests, no CI workflow, so the handshake, tool-list response, and timeout/abort paths cannot be verified as reproducible. It hard-depends on a running Next.js 16+ dev server, and edge cases (port discovery failure, upstream protocol detection failure) have no reviewable evidence. Per the calibration rule, no execution evidence caps this at 12; thin test/error-handling evidence lowers it to 10.
- Security and permissions 12/20
- No red line is evident: no credential collection, an empty environmentVariables list, local stdio transport, no exposed network port. The docs disclose telemetry scope (tool names, anonymous errors, basic environment) and state that code, file paths, personal data, credentials, and tool arguments are not collected, with an opt-out (NEXT_TELEMETRY_DISABLED=1) and a local-data deletion command. Deductions: telemetry is enabled by default (opt-out rather than confirmation), which conflicts with least-privilege expectations; nextjs_call and browser_eval reach an upstream dev server and browser-automation CLI with undisclosed side effects and no confirmation prompt for potentially consequential operations; browser_eval recommends a global npm install and execution of a third-party CLI; and the manifest's 'License: unknown' contradicts the README's MIT claim, leaving permission/ownership boundaries unclear. Main risks are visible but scoping and confirmation are incomplete, so 12.
- Maintenance 12/20
- The repository is not archived and shows ~819 stars with 10 open issues; version 0.4.0 with a documented 0.3.x->0.4.0 migration (removal of init, upgrade_nextjs_16, and several resources) indicates active maintenance and some version discipline. Static evidence is thin: no visible commit cadence, release frequency, dependency-update record, issue-response latency, SECURITY.md, or governance statement. The manifest lists License as unknown while the README says MIT, an inconsistency in ownership/licensing evidence. Given 'active but governance/versioning gaps', 12.
- Documentation 14/20
- Documentation is solid: installation via add-mcp and manual JSON config, with per-client examples for Amp, Claude Code, Codex (including Windows 11 env vars and startup timeout), Cursor, Gemini, Antigravity, VS Code/Copilot, and Warp; each of the four tools has parameters and output described, with explicit notes that nextjs_docs and browser_eval are gateways that do not do the work themselves; prerequisites (Node v20.19+, Next.js 16+), the 60-second upstream deadline and cancellation behavior, telemetry scope and opt-out, local development, and troubleshooting are all disclosed. Deductions: no explicit LICENSE file/field substantiating MIT; limited tool output examples; the port-scan range and upstream protocol detection details are not specified; telemetry retention period and destination are unspecified. This is 'usable but with hidden assumptions', so 14.
- Setup experience 15/20
- Setup ease is high: one-command install via npx add-mcp next-devtools-mcp@latest plus a standard mcpServers JSON block, with concrete commands for eight mainstream clients, a clone + pnpm build development path, and a Codex local example. Dependencies are only Node LTS with no API keys or OAuth, and the server is usable immediately (nextjs_index/nextjs_call require a Next.js 16+ dev server, which is documented). Deductions: @latest floats the version, so reproducibility depends on client caching and the documented ERR_MODULE_NOT_FOUND npx-cache failure requires extra troubleshooting; Windows Codex needs manual env vars and timeout; no pinned-version recommendation is given; no fallback verification path when Next.js is absent. Per calibration, without CI/tests in the static files, setup is capped at 15, hence 15.