- Reliability 8/20
- The static review can only read the README and the doc index; the server manifest is not cached, and the repository as supplied contains no verifiable CI workflow or committed tests covering the MCP init and tool-list handshake. The pipeline depends on external downloaders, FFmpeg, Whisper models, and third-party platforms (Bilibili/Douyin/YouTube), where any single failure breaks the end-to-end flow. Positively, the README declares health_check for FFmpeg/DB/whisper readiness and cleanup(task_id, dry_run=True) as inspect-before-delete, which is reasonable diagnosability, but these are prose claims only, with no execution evidence; error handling, rate limits, and anti-bot edge cases are undocumented. Per the static calibration (reliability capped at 12 absent verifiable execution evidence) and applying deductions for unproven paths, 8.
- Security and permissions 9/20
- No real tokens or secrets appear in the README, and there is no sign of malware, covert exfiltration, or fabricated maintainer identity, so no red-line drop to 0-4 is triggered. However, the security boundary is under-disclosed: platform QR-code login (Bilibili, Douyin) implies use of user account credentials without stated storage location, scope, or revocation; the optional fallback LLM key's storage and destination are unexplained; downloading videos and scraping danmaku/comments is outbound network activity. cleanup defaults to a global factory-reset path; dry_run exists but no consistent confirmation gate for destructive operations is stated. Installation pulls uvx videonote@latest from PyPI, an uncontrolled-version supply-chain risk. Missing disclosure is a deduction, hence 9.
- Maintenance 11/20
- MIT license, a CHANGELOG, CONTRIBUTING, and a dev->main branch flow with PR review are documented, and the README claims a required green CI smoke on dev, yet no actual CI config, release tags, or issue-response history is visible in the supplied material. With 61 stars and 0 open issues and listing on Glama, some visibility exists, but the data is a single snapshot; commit cadence and a security-response channel (no SECURITY.md or vuln-report path seen) cannot be judged. Maintenance intent is visible while governance and versioning evidence is thin, so 11.
- Documentation 14/20
- Documentation is well layered: the README is an overview, with a doc index, an architecture doc, a user manual (four install methods, setup wizard plus CLI, environment variables, updates, security), and a CHANGELOG, plus two end-to-end real-world cases with full process records, artifact screenshots, and output directory structures; a tool table covers list_tasks/cleanup/health_check and the task layout. Gaps: full parameter signatures, return shapes, failure semantics, and rate/quota limits for the MCP tools are not enumerated in the visible material; platform login, backend model download size/time, cost, and privacy boundaries are unspecified; the actual security and update section contents are unreachable (only linked headings are visible). Usable docs with hidden assumptions and troubleshooting gaps: 14.
- Setup experience 11/20
- The README gives a three-step main path: claude plugin marketplace add plus plugin install, then /videonote-setup, with uvx videonote@latest requiring no backend service and a default path that needs no LLM key because the in-conversation agent writes the note. Deductions: prerequisites (Python 3.11+, FFmpeg, Whisper model download) are not consolidated into a preflight checklist in the README; uvx latest introduces version drift; platform QR login and the optional LLM key are extra manual steps; no client configuration example (e.g. an mcpServers JSON snippet) is shown. Because the static material contains no verifiable execution evidence (no CI, no committed tests), setup is capped at 15; net score 11.