- Reliability 4/20
- The manifest and README describe a plausible install path and a single `extract_brand_assets` tool, but no server source code, CI workflow, or committed tests are supplied, so the init/tool-list handshake and real behavior are unverified. The manifest points to `ethanjyx/openbrand` while the reviewed repo is `tight-studio/OpenBrand`, a metadata inconsistency. Deducted for missing execution evidence and this contradiction; score 4.
- Security and permissions 6/20
- The API key is passed via the `OPENBRAND_API_KEY` env var and marked secret, which is good; however the README's CLI example embeds the key in the command line (shell history/process-list risk), and the MCP section does not explicitly disclose whether requested URLs are sent to OpenBrand's remote service or processed locally, nor provide domain scoping or pre-send confirmation. No red-line issues (malware, real secrets, irreversible operations) were found; score 6.
- Maintenance 4/20
- The repo is not archived, an MIT license is present, and the manifest shows version 0.1.2; but the supplied material contains no commit history, release cadence, issue-response evidence, dependency-update trail, or security-response channel. The inconsistent repository URLs further weaken confidence in governance; score 4.
- Documentation 10/20
- The README covers API usage, the npm package, MCP setup, and self-hosting, and includes a Claude Code `settings.json` example; it lacks detailed tool parameters, error/troubleshooting guidance, rate limits, and cost/limitation disclosure. This fits 'usable but with hidden assumptions or troubleshooting gaps'; score 10.
- Setup experience 12/20
- Setup is concise: npx install plus one env var, with both CLI and `settings.json` client examples, so the instructions are clear. However, this static review has no CI or test evidence that the package actually starts, and the npm package's availability is unverified; the calibration cap is 15 and I assign 12.