- Reliability 8/20
- The server.json manifest is well-formed (stdio transport, npm package, version 0.1.1) and the README enumerates 62 tools with per-category descriptions, which reads as internally consistent. However, none of the supplied material includes test files or CI workflow evidence, so there is no way to confirm the declared tool list matches actual runtime behavior or that the MCP init/tool-list handshake completes cleanly. Per the static calibration rule, reliability is capped at 12 absent verifiable execution evidence, and the score sits conservatively below that cap given the total absence of test/CI artifacts.
- Security and permissions 11/20
- Credential handling is reasonable: TASKADE_API_KEY is passed via env var, flagged isSecret/isRequired in the manifest, and the README explicitly warns against committing it. However, the server exposes many destructive/high-impact tools (taskDelete, deleteAgent, mediaDelete, projectComplete, agentPublicAccessEnable) with no described confirmation or safeguard mechanism, and the permission model is a single API key granting broad account-wide access with no least-privilege scoping described. Additionally, the HTTP/SSE mode passes the access token as a URL query parameter (`/sse?access_token=...`), a recognized leakage vector via logs, proxies, or referrers. The claim that the server 'talks only' to Taskade's own API is self-reported in the README and not independently verifiable from code. No red-line violation is present (no malware, covert exfiltration, or fabricated identity), but incomplete confirmation/scoping keeps this at a mid-tier score.
- Maintenance 13/20
- The project is MIT-licensed, not archived, includes a SECURITY.md vulnerability-reporting channel, and the README's Roadmap section shows a recent release cadence (v0.1.0 to v0.1.1) plus forward-looking plans, suggesting active development. That said, the version remains early-stage (0.1.x), and the supplied material offers no direct evidence of commit frequency, release regularity, or multi-maintainer governance, nor visibility into how the 9 open issues are being triaged, which limits the score.
- Documentation 16/20
- Documentation is comprehensive: concrete config snippets are provided for Claude Desktop, Cursor, Windsurf, Cline, and VS Code, plus an HTTP/SSE remote-mode section; all 62 tools are cataloged across 8 categories with short descriptions; and the README adds use-case examples, detailed Agent Recipes, and a dedicated Privacy & Security section. Gaps include the absence of per-tool parameter/input schemas (only name plus one-line description), no dedicated troubleshooting section, and no quantified rate-limit or cost disclosure (only a general note that some endpoints are gated on free plans).
- Setup experience 14/20
- The setup path is clear and low-friction: a single `npx -y @taskade/mcp-server` command, ready-to-paste config blocks for six mainstream clients, and documented HTTP/SSE mode with default port. The only manual step is retrieving a Personal Access Token from Taskade settings. Since the static-review rule caps setup at 15 absent real execution evidence, the score is set near that ceiling to reflect the otherwise strong documented setup flow.