- Reliability 6/20
- Based only on README and repository metadata, with no source code, tests, or CI workflows available. The listed tools map plausibly to Tiingo endpoints, but MCP initialization handshake, tool registration, and error handling cannot be verified. The static calibration forbids a reliability score above 12 without executable evidence, so a conservative deduction was applied.
- Security and permissions 10/20
- The API key is passed via the TIINGO_API_TOKEN environment variable, the README examples contain no real secrets, and no malicious or dangerous operations are evident. However, token scope, least privilege, data boundaries, and confirmation workflows are undocumented, and the source code cannot be audited, leaving several risks unverified.
- Maintenance 4/20
- The repository is not archived, but the license is NOASSERTION, meaning there is no clear open-source license. There is also no evidence of commits, releases, dependency updates, or issue responsiveness. Since active maintenance cannot be confirmed, the score is low.
- Documentation 10/20
- The README covers installation, authentication, and a list of tools, but lacks complete parameter schemas, usage examples, rate-limit and cost information, troubleshooting, and more in-depth guidance. The extension section is also brief. Documentation is usable but has significant gaps.
- Setup experience 12/20
- The README gives clear installation steps (npm install, npm run build), an MCP client stdio configuration example, and TIINGO_API_TOKEN environment variable setup. The path is straightforward. However, it lacks cross-platform guidance, verification steps, and reproducible execution evidence, so it does not receive full marks.