- Reliability 5/20
- Only the README and manifest were supplied; no actual repository source files, CI workflows, or committed tests were available for review. The described tool set (scrape, extract, search, crawl_start/crawl_get_status, schema, credits, history, monitors) is internally consistent, but real behavior cannot be verified, and error/edge-case handling is claimed rather than demonstrated. The manifest also marks SGAI_API_KEY optional while the README implies it is required, and this ambiguity is unverified. Deducted heavily for the absence of executable evidence; score kept below 10.
- Security and permissions 9/20
- No red-line indicators were found: no malware, no real secrets in examples, and no destructive default operations. Credential handling is conventional (SGAI_API_KEY via environment or MCP config, marked secret in the manifest). However, without source code, least-privilege boundaries, data-flow disclosure, and confirmation for long-running crawl/monitor operations cannot be verified; the manifest lists the API key as optional while the README treats it as required, and cost/quota guardrails are not specified. Deducted for missing source-level security evidence.
- Maintenance 12/20
- The repository is not archived, has an MIT license, a concrete version (3.0.0), and the README documents a v2-to-v3 migration with a tool renaming table, which suggests active stewardship. But no commit history, release dates, issue-response data, or dependency-update evidence was supplied, so sustained maintenance cannot be confirmed. Stars and issue counts are discovery signals only and were not used to add points; scored conservatively at 12.
- Documentation 14/20
- The README provides layered guidance: quick start, authentication, tool tables with output formats and parameter limits (e.g., num_results clamped 3–20), local/remote/Smithery/ADK configuration examples, troubleshooting, and common error handling. Deductions: examples are not source-verified, no explicit cost/plan disclosure, inconsistent spelling (ScapeGraph vs ScrapeGraph), and the remote endpoint is presented as a migration warning rather than stable documentation.
- Setup experience 12/20
- Multiple short install paths are documented: Smithery via npx, pip/uv local install, remote HTTP, plus Claude Desktop and Cursor configuration examples with Windows-specific notes. However, static calibration caps setup at 15 without real CI artifacts and committed tests proving that these commands produce a working connection; no such evidence was supplied, and the npx/Smithery path adds external-service fragility. Deducted to 12.