- Reliability 11/20
- Static review sees only README claims: an stdio, read-only MCP server declaring six tools (bundle_summary, search_concepts, read_concept, get_neighbors, list_types, list_tags), with a CI badge (ci.yml) mentioned. The server manifest is not cached, so declared tools cannot be cross-checked against the real implementation, and no committed tests covering the server's key paths were inspected; the static calibration therefore caps reliability at 12. Diagnosability is described reasonably (doctor checks JSON-RPC-clean stdout and MCP tool visibility, validate distinguishes errors from warnings, refresh modes off/stale-while-refresh/blocking), but a lack of verifiable execution evidence and unstated assumptions keep this at 11.
- Security and permissions 13/20
- No red line is crossed: no credential theft, no covert exfiltration, no default destructive action. The README states crawls respect robots.txt, stay same-origin by default, cap page count/depth/response size/concurrency, reject private-network URL literals and redirects, treat HTML/Markdown as text without executing scripts, expose read-only MCP tools, and require explicit dangerous override for unsafe --force outputs. That is a sensible least-privilege and data-boundary posture. Deductions: all of this is self-reported and unverified at code level; the README itself admits fetch-time DNS is not IP-pinned (a residual rebinding window after preflight); --auto-refresh makes the server fetch the network as a side effect; and setup requires users to paste config manually with no built-in confirmation flow. Hence 13.
- Maintenance 11/20
- Evidence shows a CI workflow badge, MIT license, an npm package okfy-ai 0.3.5, 71 stars from the scanner, 1 open issue, and not archived, indicating active maintenance. However there is no visible release cadence, changelog, commit history, dependency-update policy, or stated security-response channel, so governance and versioning are under-documented. Without execution evidence the static calibration adds nothing, giving 11.
- Documentation 15/20
- README coverage is solid: quickstart, multi-client connection examples (Codex TOML, Claude Code command, generic JSON), a table of the six tools, bundle format sample, command list, security defaults, and an explicit Current Limits section (no heading-based splitting, deterministic lexical rather than vector search, stdio-first, etc.), plus disclosure of no account/hosted index/LLM key. Obsidian import warning codes and diagnostics are also documented. Deductions: tool parameter details are unverified absent a cached manifest (e.g., search_concepts source/limit appears only in one JSON snippet), cost and rate-limit behavior are not quantified, troubleshooting is limited to doctor plus a few notes, and several referenced files inside the repo could not be inspected during this static review. Hence 15.
- Setup experience 13/20
- The install path is clear and user-friendly: no global install needed, one command (npx -y okfy-ai init <name> <url> --client codex) crawls the source and prints MCP configuration, after which users paste Codex TOML, a Claude Code command, or generic JSON; Node.js 20+ is stated explicitly and doctor validates setup. Deductions are meaningful: register -> print config -> manually edit client files remains multi-step and manual, and the README notes init does not edit agent config; multi-source workspaces, direct bundle paths, and refresh modes add concepts to absorb; and with no cached manifest or real start-up verification, the static calibration caps setup at 15. Hence 13.