- Reliability 5/20
- This review only had the README and repository metadata; no source files, tests, or CI workflow files were available. Therefore we cannot verify that the server starts cleanly or completes the MCP init/tool-list handshake, nor that the declared tools match real behavior. The CI badge in the README is untrusted evidence. The 28 open issues add further uncertainty. Under the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence; a conservative score of 5 is given.
- Security and permissions 8/20
- The only credential is PINECONE_API_KEY passed via environment variable, and the examples use placeholders rather than real tokens. No malware, credential theft, or covert exfiltration patterns are visible. The tools include side-effecting operations like create-index and upsert, but no destructive defaults (delete/pay/deploy/remote-command) without confirmation. However, there is no evidence of least-privilege scoping or explicit confirmation mechanisms server-side, and data-flow disclosure is incomplete. No red-line violation is present, so the score is 8.
- Maintenance 9/20
- The repository is not archived and uses the Apache-2.0 license, indicating basic ownership and a clear licensing path. However, the provided material contains no commit history, release cadence, dependency-update evidence, or security-response channel. 28 open issues suggest possible maintenance backlog. The CI claim in the README is untrusted, so a higher score is not justified; the score is 9.
- Documentation 12/20
- The README contains installation and configuration examples for Cursor, Claude desktop, and Gemini CLI, API key setup, a tool list, a clear limitation (only integrated-inference indexes are supported), and troubleshooting guidance. Missing are per-tool parameter details, cost information, and deeper usage examples. Some assumptions (e.g., network access to api.pinecone.io) are only implied in troubleshooting. Documentation is usable but has gaps, so the score is 12.
- Setup experience 12/20
- The README describes a clear, few-step setup: Node.js 18+ and npx are required, and JSON config examples are provided for Cursor, Claude desktop, and Gemini CLI. This is straightforward and covers multiple mainstream clients. However, the static calibration rule caps setup at 15 without verifiable execution evidence (real CI plus committed tests); we cannot confirm the npm package works or that the environment assumptions hold. A score of 12 reflects the clear instructions without execution proof.