- Reliability 8/20
- The README describes Node≥20, MCP over stdio, ten tools, doctor, and degradation behavior, but no server manifest, source, or verifiable test/CI files were supplied. The claimed 7,600-test suite and CI badge are not static evidence. A normal path is plausible, but MCP initialization, tool-list consistency, dependency failures, and key-path coverage cannot be verified, so substantial points are deducted.
- Security and permissions 11/20
- The evidence indicates local-by-default operation, storage under ~/.wigolo/, opt-in LLM and aggregator backends, bearer-token protection for non-loopback HTTP binding, and stated robots.txt/rate-limit behavior. Points are deducted because the service actively accesses the public web and supports authenticated sessions, page actions, proxies, and remote REST/MCP; no manifest, source, or permission model verifies credential isolation, confirmation of dangerous actions, request scoping, log redaction, or network boundaries. No stated red-line risk is established, but the evidence does not support a high score.
- Maintenance 10/20
- The README labels the project public beta and provides GitHub issue and contribution paths, an AGPL-3.0-only license, and a SECURITY.md channel, indicating an ownership and response path. Points are deducted because no commit history, release record, dependency-update evidence, actual issue response, or security-handling evidence was supplied; the input metadata also says NOASSERTION, conflicting with the README license claim.
- Documentation 15/20
- The README offers layered quickstart guidance, client coverage, tool summaries, configuration variables, REST/SDK/Docker/framework examples, troubleshooting, privacy/security documentation links, and disclosed limitations. Points are deducted because the referenced documentation, tool parameters, limits, implementation evidence, and contracts were not supplied; several capability, benchmark, and compatibility claims cannot be independently reviewed, and the README appears internally inconsistent about the tool count.
- Setup experience 13/20
- The README provides npx initialization commands, a Node≥20 prerequisite, mainstream client options, cross-platform support, doctor, and uninstall commands, making the path broadly clear. Points are deducted because installation downloads a browser and local models, requires about 1.5GB of disk, and may involve native builds, Linux libraries, and first-run downloads; no actual client configuration file, CI execution evidence, or successful connection log was supplied, so the static calibration prevents a higher score.