Skip to content
anlyon.dev

The MCP Census

com.mcpcensus/censusmcpcensus.comstreamable-httpv1.4.0Scanned

Vet any MCP server before you depend on it. Stamp: PASS, REVIEW, or BLOCK.

15 tools: 10 change things and 5 only read.

Tools: 0 delete, 0 irreversible, 10 write, 5 read.
  • Reads private data · 0
  • Reads text others write · 2
  • Can send data out · 1
  • 1 finding, 1 high

Tools listed without sign-in. Remote posture

Anlyon alternative

10 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

15 tools

Changes things 10Claude Code: ask
  • census_audit_configAudit a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, Codex config.toml text).Reads text others write1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • High

      The description refers to ".mcp.json", "claude_desktop_config.json", ".cursor/mcp.json" and ".vscode/mcp.json".

      Matched text

      description: "...a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mc..."

      What this check looks for
    Description, as the server wrote it
    Audit a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, Codex config.toml text). Resolves every entry without guessing (url → remote_url, npx → npm package, uvx → PyPI package) and returns one PASS / REVIEW / BLOCK / UNKNOWN verdict per entry under a built-in policy, plus CENSUS-AUDIT/1 text, valid_until_epoch and exit_code (1 on any BLOCK). UNKNOWN is never upgraded to PASS. Cost 1 credit per config per UTC day; keyless callers get one config of ≤25 entries per IP per day. Not a malware scan; PASS is not a sandbox. Strip env/headers before sending.

    Annotations the server declares

    • title: Audit an MCP client config
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • census_changesThe Census change feed (CENSUS-CHANGES/1): observed transitions across every server — server_new, remote_down, remote_up, tools_changed, health_change, verified_change, security, e…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The Census change feed (CENSUS-CHANGES/1): observed transitions across every server — server_new, remote_down, remote_up, tools_changed, health_change, verified_change, security, endpoint_moved, registry_status, spec_era_change. Cursor-paginated: pass next_cursor back as since. Filter by events, server_names or namespace_domain. Only real transitions, never 'still fine'. Unmetered in v1; poll hourly. Not a malware scan.

    Annotations the server declares

    • title: Census change feed
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • census_coveragePublic transparency report (same payload as GET /v1/coverage).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Public transparency report (same payload as GET /v1/coverage). Unmetered. Live D1 census/identity/remote/protocol/adoption/pipeline counts plus method notes — never invents completeness percentages or a brand_audit punch list.
  • census_lookalikesContested identity for one exact server_name: official_for, name_collision_count, and up to 10 other census server_name values sharing the same namespace brand or tail.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Contested identity for one exact server_name: official_for, name_collision_count, and up to 10 other census server_name values sharing the same namespace brand or tail. Never invents lookalikes. Cost 1.
  • census_preflightEvaluate one exact MCP server under a documented built-in install policy.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "evaluate": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Evaluate one exact MCP server under a documented built-in install policy. Returns PASS, REVIEW, or BLOCK with evidence reasons, freshness, digests, and explicit limits. This is a first gate, not a security audit. refresh=if_stale requires x-api-key.

    Annotations the server declares

    • title: Run MCP server preflight
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • census_recentNewest MCP servers by real first_seen_at (same payload as GET /v1/recent).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Newest MCP servers by real first_seen_at (same payload as GET /v1/recent). Unmetered. Only rows with a known first-seen date — never invents or guesses discovery times. Optional limit 1–50 (default 20).
  • census_stampCensus stamp for one exact MCP server under a built-in policy.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Census stamp for one exact MCP server under a built-in policy. Same input as census_preflight. Returns the preflight body plus compact CENSUS-STAMP/1 text and stamp_json. Cost matches preflight. Never connect without a stamp. PASS is not a malware scan or permission review.
  • census_statsEcosystem headline numbers from the live census (same payload as GET /v1/stats).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Ecosystem headline numbers from the live census (same payload as GET /v1/stats). Unmetered. Returns total servers, healthy/issues counts, popular (gh_stars>=1000), remote-capable count, github-linked count, and captured_at. No invented metrics.
  • census_watch_subscribeSubscribe this agent (or a human email) to alerts for ONE specific MCP server.Can send data outNo findings

    Why it is in this group

    • The name "census_watch_subscribe" says "subscribe": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.webhook_url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Subscribe this agent (or a human email) to alerts for ONE specific MCP server. Fires only on real observed changes: remote_down, remote_up, health_change, verified_change, security. Requires x-api-key. Prefer webhook_url (https) so your agent can receive POST callbacks; email optional. Returns a watch id + HMAC secret (X-Census-Signature: sha256=…). Free tier: 5 watches; pro: 50.
  • census_watch_unsubscribeDeactivate a watch by id.No findings

    Why it is in this group

    • The name "census_watch_unsubscribe" says "unsubscribe": a word for a change.
    Description, as the server wrote it
    Deactivate a watch by id. Requires x-api-key that owns the watch.
Only reads 5Show 5 read-only tools
  • census_creditsShow remaining Census credits for this API key (wallet after the UTC-month grant).No findings

    Why it is in this group

    • The description's first verb is "show": a word for reading.
    Description, as the server wrote it
    Show remaining Census credits for this API key (wallet after the UTC-month grant). Unmetered. Without a key, returns anonymous unique-per-day remaining — not a wallet.
  • census_lookupGet the live health verdict for one MCP server by its exact registry name (e.g.No findings

    Why it is in this group

    • The name "census_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Get the live health verdict for one MCP server by its exact registry name (e.g. 'io.github.owner/name'). Returns stars, last-push recency, gone/archived/deprecated flags, name-collision count, and a fact-based health verdict (healthy | issues | unknown).
  • census_policy_listList the exact immutable Preflight v1 built-in policy objects, canonical ruleset, and policy digests.No findings

    Why it is in this group

    • The name "census_policy_list" says "list": a word for reading.
    Description, as the server wrote it
    List the exact immutable Preflight v1 built-in policy objects, canonical ruleset, and policy digests. Unmetered.

    Annotations the server declares

    • title: List MCP Census policies
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • census_watch_listList active per-server watches for this API key.No findings

    Why it is in this group

    • The name "census_watch_list" says "list": a word for reading.
    Description, as the server wrote it
    List active per-server watches for this API key. Requires x-api-key.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:36 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
10
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 10 tools that change things (10 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://api.mcpcensus.com/mcp: tools/list returned 15 tools to an anonymous client, including census_stats (write), census_recent (write), census_coverage (write), census_watch_subscribe (write), census_watch_unsubscribe (write) and 5 more

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

1 high
  • Highcensus_audit_config

    The description refers to ".mcp.json", "claude_desktop_config.json", ".cursor/mcp.json" and ".vscode/mcp.json".

    Matched text

    description: "...a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mc..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.4.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http census https://api.mcpcensus.com/mcp
claude mcp add --transport http census https://api.mcpcensus.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__census__census_lookup",
      "mcp__census__census_search",
      "mcp__census__census_watch_list",
      "mcp__census__census_policy_list",
      "mcp__census__census_credits"
    ],
    "ask": [
      "mcp__census__census_stats",
      "mcp__census__census_recent",
      "mcp__census__census_coverage",
      "mcp__census__census_watch_subscribe",
      "mcp__census__census_watch_unsubscribe",
      "mcp__census__census_preflight",
      "mcp__census__census_stamp",
      "mcp__census__census_lookalikes",
      "mcp__census__census_audit_config",
      "mcp__census__census_changes"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as census. Review it before you use it.

Capability tags behind 3 rules
  • mcp__census__census_watch_subscribe outbound
  • mcp__census__census_preflight untrusted-input
  • mcp__census__census_audit_config untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.mcpcensus/census/verify?hash=400b700aa8126939e2a851ee1ca2fec52c27ece9e4f6c794b6d692d926183e95" | jq -e '.changed == false'

Pinned hash 400b700aa812, from Oct 21, 2026, 18:52 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.mcpcensus/census/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.mcpcensus/census
[![anlyon.dev](https://anlyon.dev/badge/com.mcpcensus/census.svg)](https://anlyon.dev/servers/com.mcpcensus/census)

Source: MCP Registry. Synced Oct 21, 2026, 17:59 UTC.