- Reliability 10/20
- The README describes stdio, HTTP, Docker, and multiple tools, and states that unit, stdio, and HTTP tests exist. However, no source files, manifest, or CI configuration were provided, so MCP initialization, tool-list consistency, error handling, and actual execution paths cannot be statically verified. Tests require a real API key, reducing controllability; therefore the score is kept below 12.
- Security and permissions 12/20
- Credentials can be supplied through an environment variable, .env, or an HTTP header, and the documented tools primarily perform geospatial search, routing, traffic, and map queries without shown delete, payment, deployment, or remote-command side effects. Points are deducted because the documentation recommends selecting all available APIs rather than demonstrating least privilege, and does not sufficiently establish external-network disclosure, location-data boundaries, credential protection in logs, rate limits, cost controls, or request confirmation. No stated security red line is evidenced.
- Maintenance 12/20
- The project states an Apache-2.0 license, identifies TomTom Navigation B.V., and provides contribution, DCO, code-of-conduct, and vulnerability-reporting channels; the repository is not archived. Points are deducted because no commit cadence, release history, dependency-update evidence, CI status, or security-response timing is supplied. A 2025 copyright notice and non-archived status do not establish sustained maintenance.
- Documentation 15/20
- The README covers remote and local installation, Node.js and pnpm prerequisites, authentication, stdio/HTTP/Docker usage, client configuration, tool inventory, backend differences, debug UI, testing, and some troubleshooting. Points are deducted because reviewable parameter schemas, input limits, API quotas, cost, privacy, and retention information are absent; the manifest is unavailable, and tests consume real quota, so completeness cannot be independently verified from the supplied material.
- Setup experience 14/20
- The project provides remote HTTP, npm/npx, Docker, Docker Compose, and configuration examples for Claude Desktop, VS Code, Cursor, Windsurf, and Smolagents, making the main paths relatively clear. Points are deducted because a TomTom API key is required, the remote service is in public preview, some clients must support HTTP with custom headers, and local use requires Node.js 22 or pnpm. No source files or CI evidence were supplied to verify reproducible installation.