- Reliability 8/20
- Evidence is limited to the server manifest and README. The manifest is internally consistent (0.4.0, PyPI, uvx, stdio), but no tool list, server source, CI, or tests were supplied, so the init/tool-list handshake and whether declared behavior matches reality cannot be verified. Under static calibration the happy path is only plausible, and testing/error-handling evidence is missing; score 8.
- Security and permissions 10/20
- NOVA3D_TOKEN is declared optional and secret, with browser sign-in preferred; no red-line issues such as malware, credential theft, or covert exfiltration are evidenced. However, data-flow disclosure for prompts/images sent to the hosted backend, a security policy, and confirmation flows for sensitive operations are absent, and least-privilege evidence is thin; score 10.
- Maintenance 11/20
- MIT license is explicit, the repo is not archived, only 1 open issue, and manifest version 0.4.0 shows versioning practice. But no commit history, release cadence, dependency updates, or security-response channel appears in the evidence, leaving governance and update path incomplete; score 11.
- Documentation 8/20
- The main README richly covers product vision, comparisons, and media, but install, auth, tool parameters, limits, cost, and troubleshooting for the MCP server live in the referenced mcp/README.md, which was not supplied. Only the manifest's env-var descriptions are available, so layered, verifiable docs are lacking; score 8.
- Setup experience 9/20
- PyPI + uvx + stdio gives a short install path and the token is optional thanks to login-based onboarding. But no mainstream-client config examples, platform compatibility notes, or CI/test execution evidence were provided, and the static cap prevents a higher score; score 9.