Flint Chart

CI uses explicit read-only contents permission, and CodeQL permissions are scoped by job, but the evidence does not define least-privilege boundaries for the MCP server at runtime, so least_privilege is only thinly supported. The README says data may be embedded or read from local JSON, CSV, and TSV files and distinguishes hosted from local MCP use, but it gives no hosted-service retention, transport, telemetry, sensitive-data, or action-confirmation policy. No rollback or recovery workflow is documented. External effects are partly identified as opening an interactive view and producing PNG, SVG, native specifications, or Excel output, but their full side-effect boundary is not described. Scheduled CodeQL, constrained CI permissions, and dependency overrides are useful dependency-security measures; no scan results, lockfile, or vulnerability-response evidence was supplied, preventing full marks. The official Microsoft organization, Microsoft Research and IDEAS Lab attribution, copyright notice, and MIT file provide clear, consistent provenance, justifying full source_attribution marks.

The README, package scripts, CI, and tests broadly agree about the principal components and build workflow, while the supplied tests exercise concrete sparse-data, axis-selection, and dodge-planning cases. However, the README says version 0.5.1 extends themes to Plotly and later says ThemeSpec currently affects only Vega-Lite, so self_consistency is not complete. Node 18+, npm commands, workspace scripts, and CI on two Node versions adequately support ordinary dependency availability, but subpackage manifests, a lockfile, and platform or offline constraints were not supplied. There is no evidence of user-facing error messages, diagnostic structure, or recovery guidance, so failure_messages scores zero.

Library use, hosted and local MCP, chat and coding environments, large datasets, custom themes, multiple rendering backends, and Excel give thorough audience-and-scenario coverage. Backend scope, the source-only Python preview, accepted local file types, and theme applicability provide some boundaries, but the theme statements conflict and unsupported chart types, scale limits, and MCP restrictions are not systematically documented. The MCP is said to expose tools for template choice, validation, and rendering, but no tool schemas, invocation rules, or refusal conditions are included, leaving trigger_precision thin. Node requirements, compatible client examples, a hosted endpoint, local operation, and development commands provide adequate environment fit; complete client configuration is deferred to an external page, so this is not full coverage.

The README clearly structures features, installation, library use, themes, MCP, repository layout, development, and contribution paths, earning full information_architecture marks. Installation is concise and includes Node 18+ plus a local-MCP recommendation for large datasets, but full MCP client configuration is deferred elsewhere. Package, component, and assemble API names are consistent in the supplied files, although no compatibility or deprecation policy establishes stronger naming stability. There are several concrete code, agent-prompt, and test examples, but no FAQ or troubleshooting examples. The Python preview and a theme limitation are disclosed, yet limitations are not comprehensive and the theme statements conflict. The complete MIT text matches the README metadata, justifying full license marks. Dated updates, semantic releases, release references, and a changelog path justify full versioning_changelog marks. The official organization, named research groups, contribution guidance, security-reporting path, and CI update path clearly establish maintenance responsibility.

Outputs are designed for direct use with Vega-Lite, ECharts, Chart.js, Plotly, Excel, PNG, SVG, and interactive views; editable input specifications and inheritable themes further support usability. A compact semantic input that derives layout and produces several backend-native representations offers clear marginal value over requiring agents to hardcode each backend. MIT licensing, npm/npx installation, and a shared input shape reduce adoption cost, but hosted-service data costs, network dependence, rendering-resource usage, package size, and operational burden are not disclosed, so cost_benefit is not complete.

Major claims can be traced to named APIs, repository paths, scripts, CI, and tests for specific algorithmic behavior, but core implementations, MCP tool definitions, and output snapshots were not supplied, preventing full claim_traceability. README component claims are corroborated by package.json, CI, and test files, while important claims about all backends, the hosted MCP service, and visual quality lack independent support in the provided evidence. Facts, plans, and recommendations are usually labeled, such as the unreleased Python package and forthcoming paper; however, the arXiv badge versus the statement that a paper is coming soon, along with conflicting Plotly-theme scope statements, weakens complete fact-inference separation.