Symbol Delta Ledger

The evidence shows local operation by default, policy-gated raw-source windows, configurable executable, working-directory, environment, concurrency, and timeout controls, plus explicitly scoped contents:read and issues:write workflow permissions. Memories are described as opt-in, and the README identifies indexing, stdio, HTTP, and workflow issue-writing effects. Deductions apply because the actual policy, memory protocol, runtime implementation, and confirmation paths are not included, so consent cannot be established for every effectful action. Version and delta concepts exist, but no operational rollback procedure is shown. Dependency hygiene includes pins, overrides, audit steps, update tracking, and documented security fixes; however, installation invokes several postinstall/native components and the update workflow permits npm audit to fail before continuing. Sensitive-data guidance is thin, and a fixture interpolates paymentToken into an audit string. Attribution names the repository, licensor, and contact address, but package author is blank and publisher identity remains unknown.

The repository declares extensive unit, integration, property, native, stress, mutation, parity, and output-contract test commands. Its troubleshooting record preserves exact errors, root causes, fixes, and reproduction commands, while optional dependencies and fallback behavior address some availability failures. The main deduction is internal inconsistency: package metadata and README require Node 24, while the workflow notes say CI uses Node 20. Several fixes remain explicitly pending hosted validation, and the record documents native crashes, an embedding race, duplicate primary keys, and fragile fixed temporary paths. Core implementation and executed results are absent, so ordinary-run consistency cannot be fully established. Failure diagnostics are comparatively strong, but the evidence cannot show that all user-facing failures are equally actionable.

The README thoroughly identifies debugging, review, implementation, repository exploration, PR-risk, live-indexing, and multi-client scenarios. Flat, gateway, legacy, and Code Mode surfaces provide meaningful interface choices, while policy gates, optional memories, provider-first fallback, and two transports describe useful capability boundaries. Deductions apply because request schemas, detailed trigger conditions, supported-language coverage, and configuration rules reside mainly in linked documents whose contents were not supplied. Stdio, HTTP, Windows/Linux evidence, and optional native components support environment fit, but the Node-version contradiction and recorded Windows/native fragility prevent a top score.

The README supplies a strong documentation map, task-oriented entry points, and a generated inventory identified as the tool-surface source of truth. Global installation, initialization, doctor, stdio startup, and non-interactive setup have concrete commands. Product, CLI, package, and tool namespace naming is stable. The full license clearly addresses internal business use, non-commercial distribution, commercial licensing, contributions, patents, termination, warranty, and liability, justifying full license credit despite external NOASSERTION metadata and the SEE LICENSE package field. Deductions apply because FAQ, troubleshooting, configuration examples, and detailed limitations are mostly linked rather than included; limitations are scattered through CI notes. A package version and dated maintenance history exist, but no formal changelog is shown. Issues, a named licensor, and email establish an update path, though package author is empty and publisher provenance is unverified.

Cards, symbol search, graph slicing, task-shaped context, and bounded source windows define outputs that coding agents could consume directly. Symbol-aware progressive disclosure presents plausible marginal value over full-file retrieval. Deductions apply because the supplied evidence contains no representative MCP response, measured quality result, or benchmark dataset—only names of tests and benchmark commands. Token savings, faster workflows, and improved output are therefore asserted rather than quantified, and their benefit is not compared with the costs of Node 24, indexing, database storage, native dependencies, or background preparation.

Claims are partly traceable to generated-inventory references, documentation links, test and benchmark scripts, and unusually concrete maintenance notes containing run IDs, job IDs, commits, error text, verification commands, and pending-validation labels. README, package metadata, and troubleshooting notes provide some cross-source support for the local MCP architecture, indexing model, dependency surface, and test practices. Deductions apply because most linked documents, core code, generated artifacts, and benchmark results are absent; badges and script names do not themselves prove passing tests or performance. The Node 20 versus Node 24 conflict further weakens corroboration. Fact/inference separation is thorough: the notes explicitly distinguish confirmed causes, hypotheses, high-confidence suspects, and hosted validation still pending.