- Reliability 3/20
- The static material describes a TypeScript library for generating deep links and URL schemes, not an MCP server. There is no server manifest, launch command, MCP initialization/tool-list implementation, or committed test evidence. Handshake behavior, tool correctness, error handling, and dependency control therefore cannot be verified, warranting a substantial deduction.
- Security and permissions 8/20
- There is no evidence of credential theft, covert exfiltration, or malware; the API key shown is a placeholder. However, generated links can launch applications, install MCP servers, or import provider configuration, and the material shows no confirmation mechanism, permission boundary, data-flow disclosure, or sensitive-data safeguards. A high score is therefore not justified.
- Maintenance 8/20
- The project states an MIT license and is not archived, and the README displays release and build-related badges. The supplied material does not verify sustained commits, dependency updates, issue response, a security-response channel, or a clear maintenance process, so the score remains moderate-low.
- Documentation 10/20
- The README provides installation commands for several package managers, subpath imports, API examples, and integration categories. It does not document MCP server configuration, authentication, tool parameters, limits, cost, troubleshooting, or verifiable runtime evidence; full documentation is only linked externally. These gaps justify a substantial deduction.
- Setup experience 4/20
- Installation as an npm library is clear, but for the stated MCP-server use case there is no server startup method, client configuration, runtime requirement, or working MCP connection flow. The path from runtime preparation to a mainstream-client connection is therefore unclear.