- Reliability 10/20
- The repo includes type definitions, build scripts, and tests (Node Test Runner), and a GitHub Actions workflow, but the test content has not been reviewed to confirm coverage of key paths. As a static review, execution was not possible, so the score is capped at 12. Core functionality (stdio↔SSE/WS/streamable HTTP) is well documented in the README, but error handling and edge cases are not explicitly evidenced in the source, making the score conservative.
- Security and permissions 10/20
- The code supports passing authentication headers via --header and --oauth2Bearer, but documentation warns these may be real tokens, and no hardcoded secrets were found. No malicious behavior is evident. However, allowing arbitrary origins with --cors (no value) could increase CSWSH risk, and dependency/SCA review is incomplete, leading to a deduction.
- Maintenance 14/20
- The repository is active with many contributors, an MIT license, and ongoing releases (npx package, Docker images), but no clear evidence of response channels for security issues or detailed governance is present. Score 14, deducting for incomplete evidence of maintenance processes.
- Documentation 15/20
- README is comprehensive and covers installation, configuration, examples (Docker, Claude Desktop, Cursor), advanced usage, and testing, but lacks troubleshooting documentation and explicit limitations (e.g., session timeout, concurrency limits). Also, some claims are not verifiable from source, so score 15.
- Setup experience 14/20
- Installation is straightforward via npx, and Docker images and client config examples are provided. However, the need for Node 24+ locally (though official image avoids that) and the variety of paths may increase complexity. Without execution, the score is capped at 15.