- Reliability 9/20
- The README shows a runnable 15-line server example and a 10-line client example, with tool schemas auto-derived from type hints, and the described behavior matches the snippets. However, this review is based solely on the README text; no server manifest was provided, and no CI workflow or committed test files were available as verifiable execution evidence. Reproducibility of the MCP init/tool-list handshake across environments and error/dependency handling are undocumented. Per the static calibration rule, reliability cannot exceed 12 without such evidence, so it is scored 9.
- Security and permissions 12/20
- As an official protocol SDK rather than a specific business-logic server, the README shows no hardcoded secrets, no dangerous operations executed by default, and no red-line indicators (no malware, no covert exfiltration). However, the material provides no discussion of least-privilege scoping, data boundaries for tool calls, external network access limits, or confirmation flows for dangerous operations. This missing evidence prevents a high score under the conservative deduction rule.
- Maintenance 18/20
- Strong evidence: MIT license, 23,895 stars, a clearly documented dual-line maintenance strategy (v2 current, v1.x still receiving critical fixes and security patches), a migration guide, a contributing guide link, and a dedicated Discord dev channel plus issue templates — all indicating active, organized maintenance with clear ownership. 511 open issues is unremarkable for a project of this scale and activity.
- Documentation 16/20
- Documentation is well-layered: getting-started guide, What's New, API reference, and migration guide are all linked, and the README itself contains copy-runnable minimal examples for both server and client, plus guidance on install variants (including the cli extra). However, version-pinning caveats (recommending `mcp<2`) are a hidden assumption, and details like tool parameter limits, rate limits, and troubleshooting require following external links not reproduced here, so it falls short of full marks.
- Setup experience 13/20
- Install steps are simple (`uv add`/`pip install`), with a minimal working example and MCP Inspector for debugging, and cross-platform compatibility can be reasonably inferred from standard Python packaging. Per the static calibration rule, setup cannot exceed 15 without CI/test evidence in the reviewed material; additionally no concrete client configuration example (e.g., for Claude Desktop) is included, so full marks are not warranted.