- Reliability 5/20
- The repository amounts to little more than a manifest (server.json) and README for a remotely-hosted service; there is no server source code, no declared tools/capabilities list, and no test or CI evidence to statically inspect. The manifest omits any tools/capabilities field, so the tools implied by the README (Notion, Monday, Slack, etc.) cannot be checked against declared behavior. Per the static calibration rule, without real CI plus committed tests covering key paths, reliability cannot exceed 12; given the near-total absence of tool declarations or error-handling documentation, a low score is warranted.
- Security and permissions 9/20
- Authentication for connecting third-party apps uses standard OAuth2, which is reasonable. However, the README describes 'preauthenticated individual endpoints' (e.g., https://waystation.ai/mcp/Iddq66dIdkfARDNb3K) that embed a unique user credential directly in the URL path — a known anti-pattern prone to leakage via browser history, proxy logs, or Referer headers. The service also integrates with PayPal, a provider capable of financial actions, yet no confirmation mechanism or scoping/least-privilege detail is documented for such sensitive operations. No red-line issue was found (no malware, no fabricated identity, no clearly documented unconfirmed irreversible default action), so this does not fall into the 0-4 range, but points are deducted for weak credential-handling design and incomplete permission/data-flow disclosure.
- Maintenance 9/20
- Version 0.3.1, status active, not archived, 60 stars, only 1 open issue, and a support contact email is provided. However, the license is unknown, and there is no visible evidence of commit cadence, release history, or a defined security response process, indicating governance gaps that warrant a deduction.
- Documentation 12/20
- The README is well organized, covering an overview, supported providers, concrete setup instructions for Claude, Cline, and Cursor, and an extensive list of use cases — reasonable layered documentation. It lacks tool/parameter-level specification, rate limits, cost information, and a troubleshooting section, and does not address the security implications of the preauthenticated URL tokens, leaving notable gaps.
- Setup experience 12/20
- Clear step-by-step instructions and JSON configuration examples are given for three mainstream clients (Claude, Cline, Cursor). However, the overall flow requires a manual multi-step dashboard OAuth process to obtain a unique URL, and there is no executable install script or test evidence backing the described flow. Per the static review calibration, without real CI/tests demonstrating the execution path, setup cannot exceed 15.