- Reliability 9/20
- The materials describe stdio, native HTTP, and WebSocket paths, with 23 tools plus timeout and rate-limit settings. However, they provide no CI workflow, committed test evidence, or verifiable execution evidence for MCP initialization, tool listing, or key failure paths. Native HTTP is also absent from the supplied server.json package definition, and operation depends on an Unreal plugin and project configuration. The happy path is plausible, but edge behavior and failure handling are not established.
- Security and permissions 10/20
- The default loopback binding, explicit non-loopback opt-in, TLS option, capability-token support, message limits, and dangerous-console-command filtering are meaningful controls. Deductions apply because authentication is optional, while Python execution, UBT, project settings, console commands, and asset deletion expose high-impact capabilities. The materials do not establish per-operation confirmation, fine-grained permissions, path isolation, or complete command-filter coverage; LAN safety depends on correct user configuration. No evidence of malware or credential theft reaches the red-line threshold.
- Maintenance 9/20
- The project identifies an author, MIT license, GitHub repository, and issue tracker; it also reports version 0.5.30 and documents development and test commands. Deductions apply because the supplied material contains no release history, commit cadence, issue-response evidence, dependency-update policy, CI results, or dedicated security-response channel. Stars and open-issue counts are discovery signals only and do not add points.
- Documentation 13/20
- The README covers installation, plugin compilation and prebuilt binaries, multiple transports, environment variables, client configuration, security warnings, tool categories, Docker, troubleshooting, and development commands. Deductions apply because it lacks per-tool parameter and return-value documentation, detailed permission boundaries, verifiable test evidence, and cost or resource-impact guidance. The manifest and README also present transport capabilities inconsistently.
- Setup experience 12/20
- NPX, source-build, Docker, and native HTTP paths are documented, with Claude Code and Cursor configuration examples and Windows/macOS/Linux guidance. Deductions apply because working use requires installing and configuring an Unreal plugin, a code target or version-specific prebuilt binary, multiple UE plugins, and project settings. Version compatibility and compilation requirements add substantial complexity, and no execution verification is supplied.