- Reliability 10/20
- Static review only: no SERVER MANIFEST, no executed commands, and no committed test files or verifiable CI workflow port/introspection evidence in the supplied material; the CI status badge is unverifiable evidence. The README describes 70+ tools, a single report registry shared by CLI and MCP (claimed to prevent id/JSON Schema drift), deterministic JSON, JUnit output, and --fail-on for CI, which suggests the happy path is designed for reproducibility. But absent committed tests or any real tool-list handshake evidence, the static calibration caps this at 12; scoring 10 reflects a plausible happy path with thin verifiable edge-case/error-handling evidence.
- Security and permissions 13/20
- Credential handling is documented in detail: Google OAuth tokens prefer the system keychain with a 0600 private-file fallback; provider secrets (DataForSEO, Semrush, Ahrefs, Bing, IndexNow key) follow the same keychain-plus-file pattern with SEO_* env vars for CI. IndexNow validates the public key file before a live request, supports --dry-run, caps at 1,000 unique URLs, and requires the configured host. Data-flow boundaries are stated: selected Search Console query or derived seed text goes to a research provider only when explicitly enabled, and Google credentials, property IDs, Search Console metrics, and GA4 rows are never sent; local imports are not uploaded. However all of this is README self-assertion — implementation cannot be verified. Third-party provider packages installed via `seo providers install` execute arbitrary code on the user's machine; version/publisher/repo/integrity/code warnings are mentioned but no sandbox, permission isolation, or persistent confirmation is described. Service accounts and provider keys grant broad API scope. No malware, credential theft, covert exfiltration, or confirmation-less destructive default was found, so no red line; deducted 7 for unverifiable least-privilege and third-party-install confirmation gaps.
- Maintenance 12/20
- Repository is not archived, has 0 open issues, and 495 stars (discovery signal only, not scored). A clear Apache-2.0 license plus a TRADEMARKS policy is present, SECURITY.md gives a private vulnerability-reporting channel, AGENTS.md documents contributor architecture and report-quality rules, and the README lists a pnpm quality gate (build/typecheck/test/lint/pack) plus npm publication and two first-party provider package examples. This indicates clear ownership, licensing, and a security-response path. Deductions: static material cannot verify commit cadence, release rhythm, dependency-update policy, or issue-response latency, and there is no explicit version-compatibility/API-stability commitment beyond provider apiVersion: 1. Hence 12 rather than a high score.
- Documentation 16/20
- Documentation is layered: quick start, command overview (seo help), report discovery (seo reports list/describe), research-provider and local-export field-mapping details (CSV/TSV/JSON/JSONL/NDJSON, UTF-8/UTF-16 detection, SHA-256 hash, row/column counts and caps), a Google data guide, TypeScript library usage, CI examples, privacy and telemetry pages, and cost disclosure (provider API billing with estimated/actual cost, cache state, and request bounds recorded per report). Limitations are disclosed honestly and repeatedly: observed evidence is kept separate from derived findings and recommended actions, partial data is never reported as zero, heuristics are labeled, an accepted IndexNow request does not prove indexing, user agents can be spoofed, and provider metrics are estimates. Deductions: everything is repo self-description, the missing SERVER MANIFEST prevents cross-checking tool parameters against real exposure, exact provider JSON parameter formats live on an external site rather than in-repo, and there is no consolidated troubleshooting guide (only seo doctor / seo privacy for auth and keychain issues). Scored 16.
- Setup experience 13/20
- The install path is clear: Node 22+, npm i -g seo, seo start walks through Google sign-in and a local project profile, and seo mcp install supports --codex/--claude-code/--cursor/--claude-desktop with client auto-detection, while any local stdio client can use seo mcp serve manually. No Google API key is required and a purely local technical audit works with no sign-in at all (seo report --url). CI needs no browser, using a service-account JSON or SEO_* env vars. Deductions: no concrete client config-file JSON snippets are provided, setup relies on interactive prompts, research providers and the Clicky/SerpBase packages require extra installs and manual credential connection, cross-platform behavior (Windows keychain fallback, headless machines) is only briefly described, and under static calibration setup cannot exceed 15 without execution evidence. Scored 13.