- Reliability 6/20
- Only the README was supplied; no manifest cache, no CI workflows, and no committed tests are visible, so the static calibration cap applies (reliability <= 12). The README explicitly states the server is 'not actively maintained and is kept here for reference,' which lowers dependability expectations further. The tool list is broadly coherent (list/get/create/update/delete families), but there are visible defects: a stray parenthesis in the `create_source_connector` description, and `cancel_job` described as 'Delete a specific job by id,' contradicting the tool name's cancel semantics. Parameter behavior, pagination, and filtering are unspecified. The 'Known issues' section admits `update_workflow` is not a patch applier and fully replaces workflow config, a sharp edge in a core path. Error handling, dependency controllability, timeouts, and rate-limit behavior have no supporting evidence and are deducted as missing evidence.
- Security and permissions 7/20
- Credential handling is centralized via a .env file with per-connector variables, and no real tokens or secrets appear in the examples, with no sign of covert exfiltration, so no red line is triggered. However, the surface is dangerous: tools include create/update/delete of sources, destinations, and workflows, plus `run_workflow` and `cancel_job`, all with remote, potentially destructive side effects. Confirmation exists only as a client-side env var (`CONFIRM_TOOL_USE`) in the sample minimal client, and the docs suggest disabling it with merely a caution note; the server itself shows no enforced confirmation or least-privilege scoping. `DEBUG_API_REQUESTS` writes request parameters to local logs with no disclosure of whether credentials or sensitive payloads may be included. Firecrawl external crawling and an optional desktop-commander terminal/filesystem integration further expand privileges, acknowledged only as 'the client now has access to private files.' Score 7.
- Maintenance 3/20
- Evidence is thin: no LICENSE is present (license listed as unknown), which is itself a deduction, and the README opens by declaring the server unmaintained and kept for reference only, effectively a self-declared freeze. Stars (42) and open issues (4) are discovery signals only and cannot add points under the evidence rules. There are no release artifacts, no dependency-update evidence, no security-response channel, and no ownership or governance information; only a CHANGELOG.md convention and a 0.x.x-dev pre-release preference are mentioned. Score 3.
- Documentation 11/20
- The documentation is comparatively layered and substantial: a tools table, a per-connector credential table, install/config via uvx, pip, and source, Claude Desktop plus SSE/stdio transport examples, debugging guidance (MCP Inspector), a note on loading tool subsets, known issues, and troubleshooting for ENOENT. Deductions: the tools table contains errors (cancel_job described as delete, stray punctuation); tool parameters, pagination, rate limits, cost, and quotas are undisclosed; the credential table mixes `ANTHROPIC_API_KEY` with server-side connector secrets, which can mislead; the doc mildly contradicts its own capability by declaring the server unmaintained and steering users elsewhere while still giving full setup steps; and there is no upstream API compatibility matrix or usable changelog content. Score 11.
- Setup experience 9/20
- Static calibration limits this dimension: with no CI and no committed tests, setup cannot exceed 15. The install path is reasonably clear, offering uvx one-liners, direct pip install, and source-based `uv sync`, with concrete Claude Desktop JSON config for both uvx and python, plus SSE/stdio run instructions and make targets, along with troubleshooting entries. Gaps remain: several code blocks are malformed (a four-backtick .env fence, doubled backticks around 'uns-mcp'), the editable-install step pairs `uvx` with `pip install -e .` in a questionable way, the stdio config requires an ABSOLUTE/PATH with no guidance on locating it, external dependencies are numerous (Firecrawl, desktop-commander, Node/npx), and there is no platform-compatibility note or minimal verification step. Score 9.