- Reliability 6/20
- The review is limited to the README and repository metadata; no source code, server manifest, CI, or committed tests were supplied, so MCP initialization, tool-list handshake, and declared-vs-real tool behavior cannot be verified. The tool parameter tables appear coherent, making the happy path plausible, but error handling, edge cases, and reproducibility lack evidence, so the score is conservative.
- Security and permissions 6/20
- Without source code, credential flow, network calls, authorization scopes, and data boundaries cannot be audited. The README indicates that the OAuth client secret and access/refresh tokens are persisted in local spotify-config.json, with no mention of file permissions or least-privilege scopes. Destructive/modifying tools exist but require explicit user invocation. No malware, real secrets, or forced destructive defaults were found, so no red line is triggered; however, missing security evidence caps the score.
- Maintenance 2/20
- Metadata shows the repository is not archived, but there are 19 open issues, the license is unknown, and there is no evidence of commits, releases, dependency updates, or a security-response channel. Missing license and governance information are clear deductions, so the maintenance score is very low.
- Documentation 12/20
- The README provides tool descriptions, parameters, examples, installation steps, Spotify OAuth configuration, and client integration examples for Claude, Cursor, and Cline. It is fairly complete, but troubleshooting, known limitations, cost/permission boundaries, and license information are absent, and there is no source code to confirm that the documentation matches implementation.
- Setup experience 12/20
- The setup steps are clear, covering Node prerequisites, clone/build, Spotify Developer app creation, authentication, and mainstream client configuration examples. The documented path is complete. However, there is no CI or committed test evidence to prove it works end-to-end, and platform compatibility and manual OAuth fragility are not addressed; under the static calibration cap, setup cannot exceed 15, hence 12.