- Reliability 4/20
- Evidence: server.json declares a remote streamable-http endpoint and 120 MCP routes through 2 tools; README claims 119 JSON/text routes and 128 REST operations. Deductions: only manifest and README supplied; no source code, CI workflow, or test files prove the handshake or behavior; tool list vs implementation cannot be verified; dependencies/error handling uncontrollable. Under static calibration cannot exceed 12, so 4.
- Security and permissions 8/20
- Evidence: README documents OAuth 2.1, XQUIK_API_KEY, no X passwords/2FA/cookies, scoped access, confirmation-gated writes, HMAC webhooks, and boundary handling of untrusted X content. No red-line issues found (no malware, no real-token install examples, no default destructive operations). Deductions: these are claims without reviewable implementation; credential storage, least-privilege enforcement, and confirmation flow cannot be confirmed; API-key fallback varies by client and the Codex OAuth issuer issue shows compatibility risk.
- Maintenance 11/20
- Evidence: repo not archived, 3 open issues, MIT license, README links to org support/security/contribution policies, version 2.6.1, and unverified CI/CodeQL/OpenSSF badges. Deductions: no commit history, release cadence, issue response times, or dependency update records supplied; badges are README claims; stars are only a discovery signal.
- Documentation 15/20
- Evidence: README includes install commands, manual installation steps, agent target directories, API route tables, rate limits, safety rules, SDK list, references/FAQs, client compatibility and troubleshooting links—layered and detailed. Deductions: tool parameters, concrete client config examples, and cost specifics live in external docs not supplied; exact alignment with implemented endpoints cannot be checked.
- Setup experience 13/20
- Evidence: remote MCP setup reduces to adding https://xquik.com/mcp in a client, with OAuth 2.1 or API key; skill install provides npx and manual copy steps with target directories for many agents. Deductions: no ready-to-paste client config examples in the supplied material; auth fallback and Codex-specific handling rely on external guides; static cap 15 and no execution verification.