- Reliability 6/20
- No executable evidence like CI workflows or committed tests are visible in the repository listing. The commands (serve, site, proxy) appear plausible, but error handling and edge cases are not documented. We deduct because key paths may not be thoroughly tested or documented.
- Security and permissions 8/20
- Authentication is handled via OAuth or API key, with explicit logout commands. However, details on token storage, scopes, and external network interactions are sparse. There are no clear dangerous default actions, but lack of disclosure on data flow and least privilege prevents a higher score.
- Maintenance 8/20
- The repository is active with 951 stars and 10 open issues, not archived. Apache-2.0 license present. However, commit frequency, issue response time, or dependency update cadence are not provided, leading to a minor deduction.
- Documentation 13/20
- README includes detailed commands, environment variables, troubleshooting, and quick start examples. However, tool parameters are not fully documented (except for some like build_site). Limitations are explicitly stated, but cost information is missing. Overall, documentation is good but has gaps such as API limits and error codes.
- Setup experience 11/20
- There are clear installation steps via npx or global install. Client configuration examples provided for several popular clients. However, the complexity of gcloud authentication and the potential for OAuth to fail in headless environments adds friction. Setup may be manual and fragile, hence the deduction.