- Reliability 10/20
- Static evidence shows a coherent structure: the README describes 116 tools (100 atomic + 16 recipes), server.json declares the npm package @alisaitteke/photoshop-mcp at 1.7.15 over stdio, and the manifest version matches the package version with no visible contradictions. Docs reference structured errors and a troubleshooting guide, implying designed error paths. However, this review is source-reading only and nothing was executed, and the supplied material contains no CI workflow and no committed tests covering the MCP init handshake or the match between declared tools and real behavior (docs/development.md is cited but not provided). Runtime depends on Adobe Photoshop 2012+ and Node.js 18+, both external and uncontrollable, and behavior without Photoshop is undisclosed. Per the static calibration cap of 12, and with key paths not reproducible, the score is held at 10.
- Security and permissions 9/20
- No red line is crossed: no malware, no credential theft, no covert exfiltration. The README explicitly discloses default anonymous aggregate usage analytics that can be disabled at any time, with a dedicated doc, which counts as data-flow disclosure. The unofficial, community-maintained identity is stated plainly with no fabricated maintainer. Install examples contain no real tokens or secrets. Deductions: this server can drive local Photoshop to perform deletes, bulk rewrites and exports, yet the material never states whether side-effecting operations require per-action confirmation or scoping. The standalone UI path asks the user for an AI provider API key (or reuse of Claude Code / Gemini CLI accounts), but key storage location, encryption and permission boundaries are not described in the provided material. No least-privilege or sandboxing statement is present. Given that, 9 is the conservative score.
- Maintenance 13/20
- Evidence supports active maintenance: MIT license (consistent between repository metadata and README badge), version has reached 1.7.15, GitHub Releases badge present, multi-language READMEs (zh/es/de/ja/tr), an official website, CONTRIBUTING.md, and a clearly named maintainer (Ali Sait Teke) with contact links; the npm name, repository URL and MCP Registry name are mutually consistent, indicating clear ownership. Only 1 open issue suggests healthy responsiveness, but no commit history, release cadence, dependency-update policy or security-response channel (e.g. SECURITY.md) is provided, and issue response time cannot be verified, so that is only a weak signal. The missing security channel and dependency-update path are the main deductions, yielding 13.
- Documentation 14/20
- Documentation is layered: install (three paths: standalone UI, Cursor plugin, generic mcp.json config), a tool list (docs/available-tools.md covering all 116 tools with parameters), standalone UI with auth modes, prompt layer and recipes, architecture, development, troubleshooting and an analytics note, plus multilingual coverage and concrete copy-pasteable commands. Limitations are disclosed: Photoshop must be running, Node 18+, generative fill needs an Adobe account, and the project is not affiliated with Adobe. Deductions: only the README and server.json were supplied, so the referenced docs/ files could not be checked for parameter accuracy, and cost/quota guidance is absent; version-compatibility scope and cross-platform differences are asserted mostly at badge level, i.e. hidden assumptions remain. These gaps keep it at 14 rather than full marks.
- Setup experience 14/20
- The install path is clear and short: a single npx -p @alisaitteke/photoshop-mcp photoshop-mcp-ui launches the standalone UI, and client integration is offered via Cursor and VS Code deep-link buttons, a one-line Claude Code command, and a generic mcp.json snippet, all copy-pasteable with no placeholder secrets. Prerequisites are explicit (Photoshop 2012+, Node.js 18+, Windows/macOS), and the npm version matches the manifest version, reducing version-mismatch risk. Deductions: a heavyweight external dependency (local Photoshop install and running instance) is required and connectivity cannot be verified locally; the Cursor Marketplace listing is not yet live, so users must manually copy .cursor-plugin/, mcp.json and assets/ into a local directory and reload, which is manual and fragile; the supplied material offers no verifiable post-connection artifact such as a test script or health check. Under the static cap of 15, the score is 14.