- Reliability 11/20
- Static review only: nothing was executed and no source files beyond README and server.json were supplied. The manifest declares a stdio PyPI package (tradememory-protocol 0.5.5) and the README enumerates 20 tools across five memory layers, but no per-tool input/output schema, error taxonomy, or return contract is given, so declared tool behavior cannot be matched against real behavior. The README claims a CI badge and '1,400+ tests passing', yet no workflow file or test inventory is included, making that an unverifiable self-assertion that must not raise the score under the static calibration rule (<=12 without verifiable execution evidence). Positives: the architecture is internally coherent (recall -> record -> reflect -> audit maps cleanly onto the tool categories), transport and version in the manifest are consistent, and the project openly discloses unfinished capabilities (TSA timestamping, external anchoring, zkML, vector fusion), which reduces overclaiming risk. Deductions: absent parameter/return evidence, no documented failure modes, no dependency pinning or runtime constraint stated, and no reproducible end-to-end path. Hence slightly above mid-range but below the 12 ceiling.
- Security and permissions 14/20
- No red lines triggered: no credential theft, no covert exfiltration, no default irreversible delete/pay/deploy/remote-command behavior, and no real tokens or secrets in the install examples. The security posture is described clearly: it explicitly does not execute trades, touch API keys, or access wallets; it is local-first; the single outbound call is RFC 3161 trusted timestamping of daily audit roots (a 32-byte hash, no trade data) and is on by default with TRADEMEMORY_TSA=off to disable. Tamper detection is offered at record, slice, and day level. Deductions: an on-by-default third-party outbound call is still a data-flow decision users must know about, and the manifest's environmentVariables is an empty array while the README references TRADEMEMORY_TSA, a minor manifest/doc inconsistency. The project advertises 35+ REST endpoints but supplies no authentication, bind-address, access-control, or exposure guidance, so a locally listening service could be reachable beyond the intended process. Chain integrity is detective rather than preventive while external anchoring is still roadmap. Mid-upper score, not full marks.
- Maintenance 13/20
- There is a clear MIT license, a published PyPI package at a consistent semantic version (0.5.5 matching the manifest), a CI badge, and links to contributing and security policies, so release and update paths exist. However, the README states the project is feature-complete and in maintenance mode with no new features or hosted service planned, which is a direct negative for a long-term maintenance score. No commit cadence, issue-response latency, dependency-update policy, or independently verifiable maintainer identity is present in the supplied material; the 1416 stars are a discovery signal only and add nothing. The research-status section concedes empirical validation at n=40 against a target of n>=100 and an evolution engine still in research with an under-performing statistical gate. Net: governance and licensing are in place but forward activity is explicitly limited and evidence of sustained maintenance is thin.
- Documentation 16/20
- Documentation is layered and unusually forthcoming: quick start, Getting Started, Use Cases, API reference, OWM framework, architecture, tutorial, MT5 setup, research log, an AI-trading failure taxonomy, and a Traditional Chinese README, plus a standalone LIMITATIONS.md naming what is not yet in v0.5.x (TSA timestamping, external anchoring, zkML proof of inference). The README provides concrete call examples with expected response fragments (verify_audit_hash, verify_audit_chain, get_daily_root, an audit export URL) and clearly frames the project as educational/research, not financial advice, with no trade execution. Deductions: no per-tool parameter or return schemas for the 20 tools are included in the supplied material (they are delegated to an external API.md), there is no troubleshooting or common-error section, the n=40 versus n>=100 gap is honest but still an undisclosed maturity cost for users, and claims such as '1,400+ tests' arrive without supporting evidence. Usable, well-structured docs with reachable but externalized gaps.
- Setup experience 15/20
- The install path is short and clear: pip install tradememory-protocol, then a Claude Desktop json block invoking uvx tradememory-protocol, with one-line Claude Code, from-source, and docker compose alternatives. No mandatory environment variables or credentials, and the only prerequisites are a Python runtime plus uvx/uv, so the usual auth and network-exposure setup burden of remote servers is absent; platform compatibility is reasonable wherever Python runs. Deductions: no minimum supported Python version is stated, the uvx args do not pin the package version so installs can drift from the reviewed 0.5.5, Docker and source options are given as bare commands without preconditions or port notes, and no verifiable evidence of a successful install or MCP handshake is included, so under the static calibration the score is held at or below 15. Clear, few-step, but detail-incomplete setup.