- Reliability 6/20
- Only the README is available, and the server manifest is not cached; there is no source, real CI test evidence, or verifiable MCP initialization/tool-list handshake. The README describes MCP support and HTTP endpoints, but startup behavior, declared-versus-implemented tools, error handling, and dependency control cannot be statically verified, so only limited happy-path credit is warranted.
- Security and permissions 8/20
- The README mentions localhost-by-default binding, Electron sandbox/contextIsolation, MCP authorization, and BYOK, but none is supported by source-file evidence. The application can call many external AI/search services and handle API keys, files, audio, and local data; agent webhooks use short tokens without documented authentication, scoping, rate limits, or confirmation for risky actions. No explicit red-line behavior is evidenced, but permissions and data boundaries are insufficiently demonstrated, requiring substantial deductions.
- Maintenance 11/20
- The repository is not archived and identifies a maintainer, AGPL-3.0 licensing, 2016 stars, and 55 open issues; the README also shows a test-workflow badge. However, there is no evidence here of commit history, release cadence, dependency updates, security-response procedures, or issue responsiveness, so sustained maintenance and governance are only partially established.
- Documentation 12/20
- The README provides substantial coverage of installation, providers, API-key prerequisites, HTTP endpoints, CLI usage, agent webhooks, and examples. It lacks a reviewable MCP server manifest, complete tool parameters and limits, cost/privacy disclosures, troubleshooting guidance, and test evidence. It also inconsistently documents HTTP ports 8090 and 4321, preventing a near-perfect score.
- Setup experience 8/20
- Release binaries, Homebrew, and an npm ci/npm start path are provided, along with prerequisites for many providers and Ollama. However, this is a desktop application rather than a clearly documented standalone MCP server, and no mainstream MCP-client configuration, server launch parameters, or handshake verification steps are supplied. Multiple API keys and local dependencies add manual setup, while the port documentation is inconsistent.