- Reliability 8/20
- Static evidence confirms README, server.json, and the declared project layout: five tools (search_unreal_api, get_function_signature, get_include_path, get_class_reference, get_deprecation_warnings) match the described behavior, the runtime path (uvx/pip, stdio transport, first-run DB download into ~/.unreal-api-mcp/) is coherent, and latency/benchmark tables are provided. However there is no verifiable execution evidence in the supplied material: no committed tests, no readable CI workflow content (README only shows a detect-ue-release badge), and no error-handling code to inspect. Per static calibration this caps reliability at 8. An internal contradiction (description says default 5.8, README body says default 5.7) and the patch-to-major.minor fallback being documented only in prose further reduce confidence.
- Security and permissions 9/20
- No red-line behavior found: read-only query tools, no credential collection, no silent exfiltration, no dangerous default operations; network access is limited to downloading a SQLite database from GitHub and an update check, and all environment variables are non-secret strings. Deductions: the mandatory first-run network download writes into the user home directory, yet the README does not disclose integrity verification (hash/signature) for the database, the update-check frequency, or failure handling, and offers no explicit offline/network-disable switch; ingest can read a local install path but its write scope is undisclosed. Least privilege is largely respected but data-flow disclosure is incomplete, so 9 — no red line triggered.
- Maintenance 10/20
- The repository is not archived, ships an MIT license, and the README describes an automated weekly UE-release detection and database build pipeline, a db-v1 release page, a re-runnable benchmark harness, PyPI badges, and a contact email. Deductions: the existence and actual behavior of the CI workflow cannot be verified from static material (badges are not evidence); version is only 0.1.1 and governance artifacts (CHANGELOG, security-response channel, dependency update policy, issue-response history) are absent; the popularity signal (95 stars, 1 open issue) is discovery-only and adds nothing. Note a potential conflict between the MIT badge and the README's 'Commercial use requires permission' clause, which weakens licensing clarity. Scored 10.
- Documentation 13/20
- Documentation is layered and usable: quick start, version-detection priority table, a five-tool table with examples, coverage plus explicit non-coverage (third-party plugins and marketplace assets), record counts, latency benchmarks, benchmark methodology with a re-run command, a CLAUDE.md snippet, a troubleshooting table, and alternative install methods. Deductions: the default version is stated inconsistently (5.7 vs 5.8); per-tool parameter signatures and return shapes are not fully specified; benchmark results are author-run with images served from raw links and cannot be statically verified; database verification/update behavior, privacy, and network data flow are not disclosed; and the licensing/cost boundary (commercial-use restriction versus 'free to use') is left unresolved. Scored 13.
- Setup experience 12/20
- Setup examples are complete for two install paths (uvx and pip, stdio transport, env injection via UNREAL_VERSION or UNREAL_PROJECT_PATH), with .uproject auto-detection and a local ingest fallback, and mainstream clients (Claude Code, Cursor, Windsurf) are named along with the Python 3.10+ requirement. However, no committed tests or CI evidence demonstrate an end-to-end working connection, and first run requires an internet download plus writes to the home directory with no documented offline path, making setup moderately manual and fragile. Against the static cap of 15, scored 12.