- Reliability 9/20
- The manifest and README consistently identify a PyPI package `repowise`, started via `repowise mcp` (manifest encodes positional `mcp`), stdio transport, and a required pre-index step (`repowise init`). The README names ten task-shaped tools with clear signatures. However, the manifest marks `repo_path` as required while README quickstart examples (`repowise mcp`, `.mcp.json` `args: ["mcp"]`) omit it; no CI workflows or committed tests were supplied to verify the init/tool-list handshake or error paths; failure behavior on missing or uninitialized repos is undocumented. The conservative static cap is 12, and uncertainty lowers the score.
- Security and permissions 13/20
- No red-line behavior (malware, token theft, covert exfiltration, destructive defaults, fabricated maintainer/tests, real secrets in examples) is evident. The README discloses privacy boundaries: self-hosted analysis stays local, telemetry is anonymous and opt-out (`repowise telemetry disable`, `DO_NOT_TRACK`), API keys are user-supplied env vars with claimed zero vendor retention, optional LLM generation is gated behind cost estimates and approval, and raw source is said to be transient. Yet no code was reviewed to confirm least privilege, the MCP server's own network access, or key storage; default telemetry is still an outbound call unless disabled; tool-level permission/confirmation matrix is not fully specified. Hence 13.
- Maintenance 15/20
- The repository is active and not archived, has a clear license (AGPL-3.0), a current PyPI version (0.17.1), a referenced CI workflow, contributing guide, docs site, Discord, and a security/compliance note. Deduction: no commit history, release cadence, issue-response latency, or dependency-update evidence was supplied; stars are treated as discovery only. 92 open issues also signal possible response backlog. Score 15.
- Documentation 16/20
- Documentation is unusually layered: quickstart, per-client config examples (Claude Code, Codex, VS Code), MCP tool reference with signatures, CLI reference, costs, health/refactoring guides, benchmark methodology with disclosed limitations, privacy/security docs, and a `doctor` troubleshooting command. Deductions: the README contradicts the manifest on the required `repo_path` argument; many referenced docs (BENCHMARKS.md, MCP_TOOLS.md, etc.) are links not supplied, so they cannot be verified; marketing benchmark claims cannot be checked statically. Score 16.
- Setup experience 13/20
- Installation is a single `pip install repowise`, followed by `repowise init` and client wiring; README contains copy-paste `.mcp.json`, Claude Code CLI, Codex config, and a VS Code extension path, plus a Windows pip note. Under the static cap (15), the setup path is mostly clear. Deductions: README examples omit the manifest-required absolute `repo_path`, so the exact examples may fail on first run; no CI run or committed test was provided to prove the install-connect path works; the extra indexing prerequisite and path/transport flags are only partially explained.