The MCP Census

by mcpcensus.com · remote · no sign-in to list tools · v1.4.0 · published by com.mcpcensus

Vet any MCP server before you depend on it. Stamp: PASS, REVIEW, or BLOCK.

Changes · 101 high finding

Compare Registry entry

15 tools: 10 change things and 5 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things10Claude Code: ask: see these tools
Only reads5Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http census https://api.mcpcensus.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 high

Highcensus_audit_config
The description refers to ".mcp.json", "claude_desktop_config.json", ".cursor/mcp.json" and ".vscode/mcp.json".
Matched text
description: "...a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mc..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

15 tools

Changes things 10Creates or changes something that can be changed back.Claude Code: ask

census_audit_configAudit a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, Codex config.toml text).Reads text others write1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- High
  The description refers to ".mcp.json", "claude_desktop_config.json", ".cursor/mcp.json" and ".vscode/mcp.json".
  Matched text
  description: "...a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mc..."
  What this check looks for
Description, as the server wrote it
Audit a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, Codex config.toml text). Resolves every entry without guessing (url → remote_url, npx → npm package, uvx → PyPI package) and returns one PASS / REVIEW / BLOCK / UNKNOWN verdict per entry under a built-in policy, plus CENSUS-AUDIT/1 text, valid_until_epoch and exit_code (1 on any BLOCK). UNKNOWN is never upgraded to PASS. Cost 1 credit per config per UTC day; keyless callers get one config of ≤25 entries per IP per day. Not a malware scan; PASS is not a sandbox. Strip env/headers before sending.
Annotations the server declares
- title: Audit an MCP client config
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
census_changesThe Census change feed (CENSUS-CHANGES/1): observed transitions across every server — server_new, remote_down, remote_up, tools_changed, health_change, verified_change, security, e…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
The Census change feed (CENSUS-CHANGES/1): observed transitions across every server — server_new, remote_down, remote_up, tools_changed, health_change, verified_change, security, endpoint_moved, registry_status, spec_era_change. Cursor-paginated: pass next_cursor back as since. Filter by events, server_names or namespace_domain. Only real transitions, never 'still fine'. Unmetered in v1; poll hourly. Not a malware scan.
Annotations the server declares
- title: Census change feed
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
census_coveragePublic transparency report (same payload as GET /v1/coverage).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Public transparency report (same payload as GET /v1/coverage). Unmetered. Live D1 census/identity/remote/protocol/adoption/pipeline counts plus method notes — never invents completeness percentages or a brand_audit punch list.
census_lookalikesContested identity for one exact server_name: official_for, name_collision_count, and up to 10 other census server_name values sharing the same namespace brand or tail.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Contested identity for one exact server_name: official_for, name_collision_count, and up to 10 other census server_name values sharing the same namespace brand or tail. Never invents lookalikes. Cost 1.
census_preflightEvaluate one exact MCP server under a documented built-in install policy.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "evaluate": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Evaluate one exact MCP server under a documented built-in install policy. Returns PASS, REVIEW, or BLOCK with evidence reasons, freshness, digests, and explicit limits. This is a first gate, not a security audit. refresh=if_stale requires x-api-key.
Annotations the server declares
- title: Run MCP server preflight
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
census_recentNewest MCP servers by real first_seen_at (same payload as GET /v1/recent).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Newest MCP servers by real first_seen_at (same payload as GET /v1/recent). Unmetered. Only rows with a known first-seen date — never invents or guesses discovery times. Optional limit 1–50 (default 20).
census_stampCensus stamp for one exact MCP server under a built-in policy.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Census stamp for one exact MCP server under a built-in policy. Same input as census_preflight. Returns the preflight body plus compact CENSUS-STAMP/1 text and stamp_json. Cost matches preflight. Never connect without a stamp. PASS is not a malware scan or permission review.
census_statsEcosystem headline numbers from the live census (same payload as GET /v1/stats).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Ecosystem headline numbers from the live census (same payload as GET /v1/stats). Unmetered. Returns total servers, healthy/issues counts, popular (gh_stars>=1000), remote-capable count, github-linked count, and captured_at. No invented metrics.
census_watch_subscribeSubscribe this agent (or a human email) to alerts for ONE specific MCP server.Can send data outNo findings
Why it is in this group
- The name "census_watch_subscribe" says "subscribe": a word for a change.
What it can reach
- outboundThe input takes a URL (input.webhook_url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Subscribe this agent (or a human email) to alerts for ONE specific MCP server. Fires only on real observed changes: remote_down, remote_up, health_change, verified_change, security. Requires x-api-key. Prefer webhook_url (https) so your agent can receive POST callbacks; email optional. Returns a watch id + HMAC secret (X-Census-Signature: sha256=…). Free tier: 5 watches; pro: 50.
census_watch_unsubscribeDeactivate a watch by id.No findings
Why it is in this group
- The name "census_watch_unsubscribe" says "unsubscribe": a word for a change.
Description, as the server wrote it
Deactivate a watch by id. Requires x-api-key that owns the watch.

Only reads 5Looks things up and changes nothing.Claude Code: allow

census_creditsShow remaining Census credits for this API key (wallet after the UTC-month grant).No findings
Why it is in this group
- The description's first verb is "show": a word for reading.
Description, as the server wrote it
Show remaining Census credits for this API key (wallet after the UTC-month grant). Unmetered. Without a key, returns anonymous unique-per-day remaining — not a wallet.
census_lookupGet the live health verdict for one MCP server by its exact registry name (e.g.No findings
Why it is in this group
- The name "census_lookup" says "lookup": a word for reading.
Description, as the server wrote it
Get the live health verdict for one MCP server by its exact registry name (e.g. 'io.github.owner/name'). Returns stars, last-push recency, gone/archived/deprecated flags, name-collision count, and a fact-based health verdict (healthy | issues | unknown).
census_policy_listList the exact immutable Preflight v1 built-in policy objects, canonical ruleset, and policy digests.No findings
Why it is in this group
- The name "census_policy_list" says "list": a word for reading.
Description, as the server wrote it
List the exact immutable Preflight v1 built-in policy objects, canonical ruleset, and policy digests. Unmetered.
Annotations the server declares
- title: List MCP Census policies
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
census_searchSearch MCP servers by keyword or partial name (e.g.No findings
Why it is in this group
- The name "census_search" says "search": a word for reading.
Description, as the server wrote it
Search MCP servers by keyword or partial name (e.g. 'github', 'postgres'). Returns ranked matches with health/trust. Also returns: resolved_query (auto typo fix), disambiguate (when unsure), known_brand (we recognize a strong product but it has no official MCP — e.g. CodeRabbit), research (watchlist/confirmed_absent), query_intent (brand_lookup|category|package|install_gate|junk — does not change ranking), intent_cta (preflight when they asked an install-gate question). Prefer official_match=true rows. Never invent servers.
census_watch_listList active per-server watches for this API key.No findings
Why it is in this group
- The name "census_watch_list" says "list": a word for reading.
Description, as the server wrote it
List active per-server watches for this API key. Requires x-api-key.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; census_audit_config
census_preflight
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; census_watch_subscribe

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:36 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 10
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: none
Authorization servers: none
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 10 tools that change things (10 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://api.mcpcensus.com/mcp: tools/list returned 15 tools to an anonymous client, including census_stats (write), census_recent (write), census_coverage (write), census_watch_subscribe (write), census_watch_unsubscribe (write) and 5 more
What this check looks for

Install

Pinned to version 1.4.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http census https://api.mcpcensus.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__census__census_lookup",
      "mcp__census__census_search",
      "mcp__census__census_watch_list",
      "mcp__census__census_policy_list",
      "mcp__census__census_credits"
    ],
    "ask": [
      "mcp__census__census_stats",
      "mcp__census__census_recent",
      "mcp__census__census_coverage",
      "mcp__census__census_watch_subscribe",
      "mcp__census__census_watch_unsubscribe",
      "mcp__census__census_preflight",
      "mcp__census__census_stamp",
      "mcp__census__census_lookalikes",
      "mcp__census__census_audit_config",
      "mcp__census__census_changes"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as census. Review it before you use it.

Capability tags behind 3 rules

mcp__census__census_watch_subscribe outbound
mcp__census__census_preflight untrusted-input
mcp__census__census_audit_config untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.mcpcensus/census/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

10 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 17:59 UTC.

For agents: Markdown · JSON · report this listing