- Reliability 8/20
- The manifest provides a clear OCI container (ghcr.io/xberg-io/xberg-cli:5.0.0-rc.10) with stdio transport arguments, and README lists 9 tools, 3 prompts, and 4 resources, but static analysis found no CI workflows or committed tests as execution evidence. Thus reliability is capped at 12; based on static evidence (clear package definition and declared consistency) a score of 8 is given, deducting for lack of verified tool behavior.
- Security and permissions 12/20
- No red flags such as malware or credential theft were found, but the tools allow local file extraction, potentially handling sensitive data; no explicit confirmation mechanism for dangerous operations is observed, and least privilege is not clearly demonstrated. Therefore security is scored 12, deducting for insufficient disclosure of data flow and permission scope.
- Maintenance 16/20
- The repository is active with 8925 stars, 18 open issues, MIT license, and version 5.0.0-rc.10; README shows multiple packages and bindings. Maintenance scores 16, deducting for insufficient evidence of a security response channel and dependency update policy.
- Documentation 12/20
- README details CLI commands, MCP server usage, configuration examples (Claude Desktop), and links to external docs. However, it lacks per-tool parameter details, troubleshooting guides, and cost information, so documentation scores 12.
- Setup experience 10/20
- Installation steps are clear: via brew or Docker pull, with config examples directly provided. But no CI-verified installation process is given, and the MCP server requires a local CLI install; platform compatibility is not fully verified, so setup scores 10.