OrangePro MCP is a rigorously designed local testing tool: it strictly separates deterministic analysis from mutation-based proof, treats AI as an auxiliary lane that never pollutes evidence tiers, and ships 18 well-documented MCP tools with clear privacy guarantees. Dynamic proof currently covers only TypeScript/JavaScript, Python, Go, and Java; hosted platform features are out of scope for this repo. A solid choice for teams wanting auditable gap analysis and grounded test generation.
Strongest · Security and permissions 18/20
Weakest · Reliability 12/20
Security and permissions
18/20
Why each score
- Reliability 12/20
- The MCP server provides a complete tool list and functionality descriptions with stdio transport. The code structure is clear with proper error handling mechanisms. However, without executing the actual code, we cannot verify the functionality of all tools, hence the score of 12.
- Security and permissions 18/20
- The server handles security well, with API keys passed via environment variables without storage in configuration. All sensitive operations have clear confirmation mechanisms. Data boundaries are clear and existing source code is not modified. No obvious security risks were found, justifying the score of 18.
- Maintenance 14/20
- The project is at version 0.2.40 with continuous update records. The MIT license is clear and contribution guidelines are mentioned. However, with only 15 stars on GitHub and 0 open issues, community activity is limited, resulting in a score of 14.
- Documentation 16/20
- Documentation is very detailed, including installation guides, usage methods, tool parameter descriptions, and workflows. Configuration examples are provided for multiple IDEs and clients with clear limitations and troubleshooting instructions. High documentation quality justifies the score of 16.
- Setup experience 15/20
- Installation is straightforward and supports direct execution via npx. Configuration guides are provided for multiple IDEs and clients. However, the need to install the target repository's dependencies first adds complexity to the setup process, resulting in a score of 15.
Static review · not runListed 2026-09-07
Read the FMRS scoring method →