- Reliability 8/20
- Static review sees only the manifest and README; no runnable evidence is supplied - no committed CI workflow listing and no test sources covering the server's key paths. The README's '2,000+ automated tests' claim and the '37 MCP Tools' badge are self-reported and cannot be verified. The manifest uses an unresolved placeholder version (${VERSION}), which suggests the publish path relies on template substitution and may ship incomplete registration metadata; the description says 'deals' while the repository description says 'opportunity', an unresolved naming mismatch that makes declared-tool-to-behavior correspondence unverifiable. Only one remote (streamable-http) is declared, with no health check, timeout, rate-limit or error semantics, so failure diagnosability is unknown. Static calibration caps this at 12; deductions for absent execution evidence and the unresolved placeholder bring it to 8.
- Security and permissions 7/20
- Evidence is limited to README and manifest, both treated as untrusted. Positive signals: AGPL-3.0 open source, self-hosted emphasis with data staying on the user's server, README claims of 5-layer authorization, team isolation and per-field encryption, and an HTTPS remote at mcp.relaticle.com. However, no substantive security evidence is present: authentication method (OAuth/PAT/API key), token storage and rotation, per-tool permission granularity, and how multi-team boundaries are enforced are all undocumented; the manifest declares no required scopes or credentials and no confirmation flow for destructive actions such as bulk delete, export or outbound data flow. The placeholder version weakens provenance and supply-chain verifiability. Treating missing evidence as a deduction yields 7; no red line is evidenced, so it stays outside the 0-4 band.
- Maintenance 12/20
- Verifiable maintenance signals: a public GitHub repository, an explicit AGPL-3.0 license, 1628 stars, 30 open issues, not archived, plus README links to a public roadmap (GitHub Projects), Discussions, Discord and an issue tracker - indicating an actively operated project with feedback channels. Deductions: no release records, versioning policy or changelog evidence is provided, and the manifest still carries a ${VERSION} placeholder, indicating a publishing/versioning governance gap; no SECURITY.md or security-response policy is evidenced; the dependency-update cadence (Laravel 13, PHP 8.5, Filament 5) cannot be confirmed from static material. Read as 'active but with governance and versioning gaps', scored 12.
- Documentation 11/20
- Documentation has some layering: the README covers overview, requirements (PHP 8.5+, PostgreSQL 17+, Composer/Node, Redis), installation via composer app-install, development commands, a self-hosting pointer and an i18n override workflow, and links to the official docs and a dedicated MCP docs page; the manifest supplies title, description and the remote URL. Clear deductions: the 37-tool catalogue - purpose, parameters, return values, pagination and quotas - is absent from the supplied material; authentication and authorization flow, permission model details, rate limits, error codes, cost/pricing and troubleshooting are missing; a terminology mismatch (deals vs opportunity) invites misreading; install steps depend on external links not shown here. Usable but with hidden assumptions and troubleshooting gaps: 11.
- Setup experience 11/20
- Positives: a relatively short install path - clone then composer app-install - with runtime prerequisites listed, a single composer dev command to bring up server/queue/vite, and an external self-hosting guide pointer; client side needs only the streamable-http endpoint https://mcp.relaticle.com, though no auth configuration example is given. Deductions: no client config snippets for mainstream clients (Claude Desktop, Cursor, VS Code, etc.), no Docker or environment-variable steps, no PostgreSQL initialization, queue or Redis specifics, and all self-hosting detail is off-repo; the manifest's placeholder version also means self-builds need extra version injection. Assessed as 'works but manual and external-doc dependent'; with the static cap of 15 and these gaps, scored 11.