- Reliability 4/20
- No server manifest, MCP initialization evidence, tool-list evidence, or executable verification is provided. The README mainly describes hooks, CLI behavior, and client bridges rather than a verifiable MCP server interface. It claims CI, tests, and extensive error handling, but those claims are not substantiated by the supplied source material, so the score remains low.
- Security and permissions 8/20
- The README describes prompt-injection scanning, untrusted-content fencing, fail-soft hooks, and configurable behavior, but provides no implementation evidence for permissions, credential handling, network data boundaries, or confirmation of dangerous operations. Installation modifies user configuration and registers hooks, while tool rewriting and blocking can affect workflows. No explicit red-line risk is evidenced, but the missing controls prevent a higher score.
- Maintenance 8/20
- The repository is not archived; the supplied metadata shows 62 stars and no open issues, and the README provides a manual npm update path and a maintainer contact address. Deductions apply because the license is NOASSERTION, the PolyForm Noncommercial badge is not independently supported by the supplied source, and there is no verifiable release, commit, dependency-update, or security-response history.
- Documentation 13/20
- The README is unusually detailed, covering installation, the Node.js requirement, multiple clients, limitations, troubleshooting, uninstall behavior, cache recovery, and configuration switches, while disclosing that some bridges were not live-validated. Deductions apply because the manifest is missing, many performance and capability claims cannot be verified from the supplied material, and the provided README is truncated before all parameters and boundaries can be reviewed.
- Setup experience 10/20
- The README provides a clear npm global-install, install, and doctor workflow, specifies Node.js 22+, and documents Windows, Linux/WSL, and multiple client bridges. Deductions apply because installation modifies several user-level configurations, depends on hooks and optionally a background worker, some clients require separate bridges or restarts, and no verifiable MCP connection configuration or successful handshake example is supplied.