- Reliability 8/20
- The manifest is well-formed and internally consistent: name, package spotifyscraper 3.9.2, stdio transport, and one optional env var SPOTIFY_SP_DC all align; the README describes a coherent sync/async library with an mcp extra, so the happy path is plausible. However, no server source, tool definitions, or test files were supplied, so tool-list/behavior conformance cannot be verified statically; the claimed CI, daily canary, and 85% coverage floor are README assertions only. The server also rides undocumented Spotify web endpoints that the README itself admits can break at any time. Deducted for missing executable evidence and inherent endpoint fragility.
- Security and permissions 14/20
- The design follows least privilege: read-only public data with no write/delete/pay/remote-command operations; the only secret, SPOTIFY_SP_DC, is optional, marked isSecret, and per docs is sent only to Spotify and never logged; the response cache deliberately excludes token-bearing responses; the cookie is stored in an owner-only file or optionally the OS keyring; no install example contains real credentials. No malware, covert exfiltration, or fabricated-identity red lines were found. Deducted because the actual implementation of log redaction and cookie handling cannot be confirmed from the supplied source, and there is no independent vulnerability-disclosure channel.
- Maintenance 14/20
- Sustained maintenance is evident: MIT license, clear author ownership, versioning at 3.9.2 with a per-version shipped roadmap, and a described daily canary that auto-opens/closes breakage issues. Deducted because no security-response channel (e.g., SECURITY.md) is provided, no changelog is included in the material, and the CI, coverage, and SHA-pinned Actions claims are README assertions without supporting workflow/test files; responsiveness to the 8 open issues cannot be assessed.
- Documentation 13/20
- The README is layered and thorough: install extras, sync/async quickstarts, CLI, batch helpers, caching, search, lyrics, podcast transcripts, localization, browser login, legal notice, and a link to full docs. Deducted because MCP-specific documentation is thin — no client configuration examples (e.g., Claude Desktop JSON), no MCP tool list or parameter reference, no MCP troubleshooting or explicit limits; SPOTIFY_SP_DC auth is described but failure modes are not; rate-limit/anti-ban specifics are mentioned only at a high level.
- Setup experience 12/20
- The install path is clear and short: pip install spotifyscraper[mcp] on Python 3.10+, with a container image and an optional env var as alternatives; the manifest package identifier and version match PyPI. Deducted because the README shows no client configuration example for wiring the stdio server into a mainstream LLM host, so the registry/connection step is left to the user; per static calibration, real CI workflows plus committed tests covering the server's key paths were not among the supplied files, so the score stays below the 15 cap. Manifest/package alignment is plausible but unverified.