- Reliability 9/20
- The static review sees only the README and server.json; no actual source files, CI workflow contents, or committed tests were supplied. Therefore there is no way to verify that MCP initialization and tool-list handshake succeed, or that the declared tools (semantic_search, view_signatures, graphrag, structural_search, LSP tools) match real behavior. The README claims 17-language tree-sitter parsing, optional LSP via --with-lsp, and self-published benchmarks, but these are untrusted self-reports and the benchmark does not exercise the protocol layer. Error handling, index failures, and degradation paths when an embedding provider is unavailable have no evidence. Per the static-calibration ceiling of 12 absent verifiable execution evidence, scored 9.
- Security and permissions 12/20
- The README states local-first operation, locally stored API keys, .gitignore respect, and a local-only MCP server with no external network for search, which is directionally sound. However, from README alone one cannot confirm: that embedded chunks sent to cloud providers (Voyage/OpenAI/JINA/Google) are bounded in scope, since the data-flow disclosure is generic; that LSP and MCP layers expose only intended portions of the codebase to clients; nor that credential storage, scope restriction, or confirmation for dangerous operations are implemented. No red-line indicators (malware, credential theft, covert exfiltration, real tokens in install examples) were found, so the 0-4 red-line band is not triggered; but least-privilege, confirmation flow, and data-flow specifics lack evidence, hence 12.
- Maintenance 13/20
- GitHub metadata shows 475 stars, only 5 open issues, not archived, Apache-2.0 license; the README carries CI and coverage badges, a Crates.io release, and version 0.26.1, indicating an ongoing release cadence. Yet the supplied material contains no commit history, issue-response latency, dependency-update record, or security-response channel (e.g., SECURITY.md) as direct evidence; governance and versioning rest on self-reported badges. Activity is visible but the governance and security-response path is under-evidenced, hence 13.
- Documentation 15/20
- Documentation is reasonably layered: the README covers installation (multi-platform, Homebrew, crates.io, binaries), API key setup and multiple embedding providers, index and search commands, MCP client config examples (Claude Desktop/Cursor/Windsurf/Claude Code), a 17-language support table, privacy/security notes, benchmark methodology with full metrics, and links to multiple doc/ guides. Limitations are also disclosed (local stack as a floor, generic reranker regressing results). Deductions: full MCP tool parameter specs, error codes, cost details, and troubleshooting mostly point to external files not included in the material, so their accuracy cannot be reviewed, and the benchmark numbers are unverifiable self-reports. Usable and layered, but with external-verification gaps, hence 15.
- Setup experience 13/20
- The install path is clear: a curl one-liner, Homebrew, cargo install, and GitHub Releases, followed by three steps (optional API key, octocode index, octocode search), plus JSON config snippets for Claude/Cursor/Windsurf and a Claude Code CLI command, giving fairly complete mainstream-client examples. However, default embeddings require downloading the fastembed model over the network, LSP tools need a separate --with-lsp flag plus an external language server (additional manual steps), and platform compatibility (especially Windows and macOS Gatekeeper) is only mentioned, not verified. Under the static-calibration ceiling of 15 and with no file-level execution evidence, scored 13.