- Reliability 8/20
- The manifest lists 15 tools with a coherent schema, but the README claims a '23-tool MCP server', an unresolved contradiction. No CI or committed tests were supplied to verify the init handshake or real behavior, so the happy path is plausible but poorly evidenced; score kept below the 10 anchor.
- Security and permissions 4/20
- Red-line concern: delete_comment is described as 'hard-delete' with no confirmation parameter or explicit guard. No auth model, least-privilege scoping, data boundaries, or external network behavior is disclosed. Because an irreversible delete is exposed by default without confirmation, security must stay in 0-4 range.
- Maintenance 10/20
- The repo is not archived, has an AGPL-3.0 license and 58 open issues; the README shows CI and 'PRs welcome', indicating active maintenance. However, no commit history, release cadence, dependency-update or security-response evidence was provided, so a mid-range score is appropriate.
- Documentation 8/20
- The README clearly covers product installation, Docker and local development, but MCP-specific docs are limited to tool names and one-line descriptions in the manifest. Parameter schemas, auth, limitations and troubleshooting are absent, and the 23-vs-15 tool count contradiction weakens trust.
- Setup experience 9/20
- Self-hosting steps via Docker, Railway and local dev are present and require PostgreSQL/Redis plus .env. No mainstream-client MCP connection example is provided, and no execution evidence (CI/tests) was supplied, limiting the score below the static maximum.