- Reliability 8/20
- README describes a clear declarative-registry architecture with Zod validation, rate limiting, circuit breaker, retry, and only 2 dependencies; plausible on paper. However this is a static review with no CI workflows, committed tests, or runtime evidence supplied, and there are self-contradicting figures: headline says 169 methods, the manifest description says 185, and the claimed 'Bot API 9.6 (April 2026)' is a future date, undermining credibility. Deductions: no verifiable execution evidence, inconsistent capability claims.
- Security and permissions 11/20
- README claims token masking, path-traversal protection, configurable upload allowlist, no eval/dynamic imports, network only to api.telegram.org, no telemetry. No malware, exfiltration, or dangerous irreversible defaults are indicated — no red line triggered. But these are self-reported claims not verifiable from supplied source, and destructive operations (deleteMessage, banChatMember, payments) rely on tool annotations rather than enforced confirmation. Deductions: unverified claims, no enforced confirmation for dangerous ops.
- Maintenance 8/20
- Not archived, MIT license, npm package at 0.2.0, 2 open issues, author maintains multiple related projects. Yet it is a 0.x release with no evidence of release cadence, security-response channel, or dependency-update policy. Deductions: early version, missing governance and security-response evidence.
- Documentation 11/20
- README is well structured: quick start for Claude Code/Desktop and source, full env-var table, meta-mode guide, per-category method table, architecture tree, security section — above average. Deductions: no troubleshooting section, no disclosed limitations, and internal contradictions (169 vs 185 methods, future-dated API version) signal docs may not match actual capability.
- Setup experience 13/20
- One-line npx install plus concrete Claude Code and Claude Desktop config examples, clear env-var table, complete source-build path. Caveat: the 'claude mcp add ... -e VAR=...' example mixes flag styles and may not work as written, risking user confusion. Deductions: untested install path in static review, questionable CLI example syntax.