- Reliability 9/20
- The static material contains only server.json, the README, and a project-structure listing; there is no verifiable execution evidence (no committed tests, no actual CI workflow content). The five declared tools (search_unity_api, get_method_signature, get_namespace, get_class_reference, get_deprecation_warnings) are consistent between manifest and README with no visible contradiction. On first run the server downloads a 20-30MB SQLite database from GitHub, an external dependency whose failure path is only vaguely covered by a troubleshooting table ("check your internet connection"), so error handling cannot be verified. The README claims weekly Monday rebuilds and startup freshness checks, but no workflow file corroborates this. Under static calibration, reliability must not exceed 12; absent tests and CI evidence, it is reduced to 9.
- Security and permissions 11/20
- No malware, credential theft, or covert exfiltration was found, so the 0-4 red-line band is not triggered. Static evidence is nonetheless limited: by default the tools download a database from GitHub into ~/.unity-api-mcp/ and write to the local filesystem, an unconfirmed write side effect, and the manifest declares no verification mechanism (hash or signature) for the network download, leaving supply-chain risk though no exploitation is evidenced. The UNITY_VERSION and UNITY_PROJECT_PATH variables are correctly marked non-secret, and UNITY_PROJECT_PATH only reads ProjectSettings/ProjectVersion.txt, a restrained scope. Main risks are visible while confirmation and integrity checking are incomplete, hence 11.
- Maintenance 12/20
- The MIT license is explicit, version 2.0.2 matches server.json, and the README shows a PyPI release badge, a weekly automatic Unity-release detection build, a db-v1 release page, and a sibling project (unreal-api-mcp), indicating sustained maintenance and clear ownership. However, this is a static review: actual commit history, issue response times, dependency-update policy, and security-response channel are not visible, and the 7 open issues cannot be assessed for responsiveness. Governance and versioning information has gaps, hence 12.
- Documentation 14/20
- Documentation is well layered: quick start, a version-detection priority table, the five tools with purposes and call examples, coverage plus explicit non-coverage (DOTween, VContainer, Newtonsoft.Json), a troubleshooting table, environment-variable table, multi-platform local database build commands, and benchmark methodology with a re-runnable script. A notable strength is disclosure of limits and cost (20-30MB first download, per-version databases). Deductions: benchmark charts are external image references that cannot be verified and the "Measured, not promised" claim is self-reported evidence; tool parameters lack full schema (input/output formats, error returns); and the README contains instruction-directed content aimed at AI agents, which under the evidence rules is not treated as trustworthy. Overall 14.
- Setup experience 13/20
- The installation path is clear and short: a one-line uvx command plus MCP config JSON, with client config snippets for mainstream clients (Claude Code, Cursor, Windsurf), plus alternative pip install and UNITY_PROJECT_PATH auto-detection, and an AI-assisted setup prompt. Windows and macOS are mentioned. Deductions: the first run requires an internet download of the database, and offline use needs a self-built database with extra ingest dependencies, a relatively fragile step; the Python 3.10+ prerequisite appears only in troubleshooting rather than before quick start; and actual client handshake connectivity is unverified. Under the static cap of 15, this scores 13.