- Reliability 9/20
- The server manifest declares 5 tools, but the README mentions 11 MCP tools, which is inconsistent. The manifest includes a PyPI package identifier and clear transport, and the README provides uvx launch command, indicating a plausible clean start. However, static review cannot verify execution, and the mismatch between manifest and README creates uncertainty. Score capped at 9 due to static calibration and inconsistency.
- Security and permissions 8/20
- The server requires API keys for external providers, which is normal. Keys are passed via environment variables, no hardcoded secrets found. No red-line issues. However, data flow and permission boundaries are not fully documented; users must understand third-party data sharing. Score 8 for lack of detailed security disclosures.
- Maintenance 10/20
- MIT license present, CI workflow referenced, active development (version 0.3.0). But static review cannot confirm commit frequency or issue response. Deductions for no clear security contact or update policy.
- Documentation 11/20
- README is extensive with install, CLI, MCP config, environment variables, and examples. However, the number of MCP tools differs from the manifest, and there is no dedicated MCP tool parameter documentation or troubleshooting section. Deductions for inconsistency and gaps.
- Setup experience 11/20
- Clear install steps via pip and uvx, plus Docker and Colab. Requires manual API key setup. No actual execution verification, so capped at 15, but given CI and tests, I assign 11, deducting for external dependencies and manual configuration.