- Reliability 5/20
- Only the README was supplied; the server manifest is not cached and no source files, CI workflows, or committed tests were available. The README declares six MCP tools (remember, append, update, recall, list_recent, forget) plus REST /capture and /health endpoints, and the happy path is coherent, but none of it is verifiable from source. Under the static calibration, reliability cannot exceed 12 without real CI and tests in the files; with zero executable evidence, a heavy deduction applies.
- Security and permissions 10/20
- The README discloses a self-hosted data boundary (data stays in the user's own Cloudflare account), AUTH_TOKEN sent via Authorization: Bearer, OAuth 2.0 dynamic client registration backed by KV, and a privacy statement. Install examples contain no real secrets, and no malware, credential-theft, or exfiltration vector is visible, so no red line is triggered. However, code-level credential storage, least-privilege scoping of D1/KV/Vectorize, and confirmation for the irreversible forget tool cannot be verified from the supplied material, capping the score at a mid-range 10.
- Maintenance 14/20
- The repository is not archived, carries an MIT license, shows an active release track (v2, v2.1, v2.2), documents a code-signing policy with release binaries built via GitHub Actions, and has Discussions enabled. Deductions: the supplied material contains no commit history, release dates, issue-response evidence, or dependency-update cadence, so sustained maintenance is plausible but not fully evidenced.
- Documentation 15/20
- Documentation is layered and detailed: the README covers three install paths, AUTH_TOKEN and OAuth flows, wiki links, client-specific setup, and dedicated troubleshooting sections (OAuth issues, lazy tool loading, false phishing warnings). Deductions: per-tool parameter schemas and limits are not documented, cost/limits are only summarized as 'free tier at personal scale', and no reproducible tool-call response examples (beyond /capture) are included.
- Setup experience 13/20
- Three install paths are clearly described (desktop app, one-click Cloudflare deploy, manual npm deploy) with client configuration examples for Claude Code, Codex, ChatGPT, and Cursor, plus an OAuth explanation. Deductions: the manual and one-click paths require several Cloudflare resource values (dimensions, metric, AUTH_TOKEN, OAUTH_KV) and post-deploy client wiring; the Windows build currently triggers a SmartScreen warning; and no CI/test evidence exists in the supplied material, so the score is capped below 15.