- Reliability 4/20
- Only the README and manifest were supplied; no source, tests, or CI evidence for mcp/packages/rerun/server.json was available to verify stdio startup, the MCP init/tool-list handshake, or the real behavior of the claimed 5 tools. The manifest is well-formed and the install command is present, but these are untrusted claims. Under static calibration, missing reproducible evidence must be deducted, so the score is 4.
- Security and permissions 5/20
- The server description involves streaming AR poses/planes/cloud anchors to a Rerun viewer, Python sidecars, and web viewer embeds, which creates clear external-network and data-boundary risk. No source was provided to confirm user confirmation, least-privilege scoping, or disclosure of data flow. No red-line issue such as malware, credential theft, covert exfiltration, or irreversible operations is evidenced, so the score stays above 4; missing permission/confirmation evidence caps it at 5.
- Maintenance 10/20
- The repository is not archived, carries an Apache-2.0 license, and shows CI and release activity, so it is broadly maintained. However, there is no server-specific commit history, release cadence, dependency-update evidence, or issue-response evidence for the rerun-3d server, and its version is still 1.0.0. Stars are discovery signals only and do not add points. This matches the “active but governance/versioning gaps” anchor at 10.
- Documentation 5/20
- The README provides the npx rerun-3d-mcp install command, a claim of 5 tools, and a high-level AR Debug/Rerun viewer workflow, pointing to llms.txt for architecture details. But no reviewable documentation of individual tool parameters, auth, limits, or troubleshooting is included, and the llms.txt content is not in the supplied material. This fits “usable but with hidden assumptions and troubleshooting gaps,” so the score is 5.
- Setup experience 8/20
- Setup is presented as a single npx rerun-3d-mcp command with stdio transport, so the path is short and clear. However, no client configuration JSON example for this specific server is provided, and there is no executable verification in the files. Static calibration caps setup at 15, and uncertainty lowers the score to 8.