- Reliability 8/20
- Static review only; runtime behavior not verified. The source code mentions 127 tools across 15 modules, but no executable tests or CI configuration proving this were found. The MCP server is implemented via mcp-handler and requires credentials to verify. Therefore, reliability is capped at 12.
- Security and permissions 8/20
- Tokens are stored as SHA-256 hashes and API keys encrypted with AES-256-GCM, which is good practice. However, MCP tools include delete operations and sensitive actions like sending emails, but no explicit confirmation mechanism is evident. Although external connections are present by default, no malicious code is observed. Score 8 because credential handling and encryption are solid, but explicit confirmation for destructive operations is missing.
- Maintenance 7/20
- The repository is active with 673 stars, but stars do not add points. MIT license is clear, but no security response channel or explicit versioning is provided. Commits and issue responses are not evidenced in the source. Development is active, but governance and release management have gaps.
- Documentation 6/20
- The README is comprehensive, covering installation and Docker setup. However, MCP tool parameters, limitations, and troubleshooting are not well documented. There is no dedicated MCP documentation, only a mention of a SKILL.md. Setup instructions assume prior knowledge of external services. Documentation is usable but missing key details.
- Setup experience 6/20
- Setup steps are clear with Docker Compose and manual instructions. However, MCP server setup requires generating tokens and configuring the client, and dependencies need additional configuration. No CI or tests are present to verify the setup works. Score is limited because of lack of automated verification.