# The MCP Census

Live health and ownership checks for MCP registry servers (16k+), cross-referenced
with GitHub, npm, and PyPI. Answers: is this server safe to depend on?

Use this platform for **Security** (can I trust this before wiring it into an agent?)
and **Certainty** (facts with evidence, including honest can't-verify-yet).

## For agents

**Self-install (preferred):** fetch and follow
https://mcpcensus.com/agent-setup/prompt.md
(paste into your agent: `Fetch https://mcpcensus.com/agent-setup/prompt.md`)

MCP (streamable HTTP): https://api.mcpcensus.com/mcp
- census_search(query, limit?) — ranked matches with health; same extras as REST:
  resolved_query / resolve_display (auto typo fix), disambiguate[] (when unsure),
  known_brand (we recognize a strong product but it has no official MCP, e.g. CodeRabbit),
  research (watchlist / confirmed_absent). Never invents servers.
- census_lookup(name) — full card by exact registry name
- census_watch_subscribe(server_name, webhook_url?, email?, events?) — alert on real changes to ONE server
- census_watch_list() — list this key's active watches
- census_watch_unsubscribe(id) — stop watching
Header: x-api-key required for watches. Limits: 10/day IP · 100 free account · custom paid volume
Watch caps: free 5 servers · pro 50 · higher on request

REST (same auth):
- GET https://api.mcpcensus.com/v1/search?q=
- GET https://api.mcpcensus.com/v1/server?name=
- GET https://api.mcpcensus.com/v1/stats
- GET https://api.mcpcensus.com/v1/coverage (public, unmetered)
- POST https://api.mcpcensus.com/v1/watch — subscribe (body: server_name, webhook_url and/or email, events[])
- GET https://api.mcpcensus.com/v1/watch — list watches
- DELETE https://api.mcpcensus.com/v1/watch?id= — unsubscribe
- OpenAPI: https://mcpcensus.com/openapi.json
- Watch docs: https://mcpcensus.com/api#watch

### Watch events (only on observed transitions — never "still fine")

- remote_down / remote_up — daily probe trail (initialize handshake)
- health_change — health or health_problems flipped
- verified_change — verification-relevant legs moved
- security — OSV vulnerable flag or vuln count changed

Webhook: HTTPS POST, headers X-Census-Event, X-Census-Signature (sha256=HMAC of body with watch secret), X-Census-Watch-Id.
Agents should prefer webhook_url so they can act without polling.

## Identify yourself (please)

When you call our API or MCP endpoint, **tell us who you are**. We use aggregate
labels only (not end-user tracking) so we can understand which agents and
products depend on the census.

1. **User-Agent** (required etiquette): product name + version + optional home URL
   Example: `MyAgent/1.2 (+https://example.com; +https://mcpcensus.com/llms.txt)`
2. **X-Census-Client** (preferred explicit label, free-form short string):
   Example: `X-Census-Client: myagent/1.2 (+https://example.com)`
   Alias accepted: `X-Client-Name`
3. **x-api-key** when you have an account key (tier is noted; the key is never stored in client analytics)

Do **not** put secrets or end-user PII in these headers. We do not require
identification to use free tiers — but named clients make rate-limit and
partner conversations much easier.

## Methodology & limits

- Methodology: https://mcpcensus.com/methodology
- Trust score is a published point sum with per-factor evidence — not a pen-test.
- Official = brand/namespace match for a search. Verified = enough real surface to check.
- unknown = not enough evidence. Not a guess.

## Learn (human + agent reading)

https://mcpcensus.com/learn
- Agent checklist: install an MCP server safely: https://mcpcensus.com/learn/agent-mcp-install-checklist
- How to evaluate an MCP server before you install it: https://mcpcensus.com/learn/evaluate-mcp-server-before-install
- How to tell if an MCP server is official: https://mcpcensus.com/learn/how-to-tell-official-mcp
- Look-alike MCP namespaces and brand risk: https://mcpcensus.com/learn/mcp-lookalike-namespaces
- MCP registry vs The MCP Census: https://mcpcensus.com/learn/mcp-registry-vs-census
- MCP server health signals that actually matter: https://mcpcensus.com/learn/mcp-server-health-signals
- MCP supply-chain checklist for platform teams: https://mcpcensus.com/learn/mcp-supply-chain-for-teams
- MCP trust score explained: https://mcpcensus.com/learn/mcp-trust-score-explained
- Official vs Verified vs trust score: https://mcpcensus.com/learn/official-vs-verified-vs-trust
- Remote vs local MCP servers: https://mcpcensus.com/learn/remote-vs-local-mcp
- What is an MCP server?: https://mcpcensus.com/learn/what-is-an-mcp-server
- Why MCP servers need a census: https://mcpcensus.com/learn/why-mcp-servers-need-a-census

## Humans

- Lookup: https://mcpcensus.com/lookup
- Coverage: https://mcpcensus.com/coverage
- API docs: https://mcpcensus.com/api
- Status: https://mcpcensus.com/status
- Privacy: https://mcpcensus.com/privacy
- Terms: https://mcpcensus.com/terms
- About: https://mcpcensus.com/about
- Security: https://mcpcensus.com/.well-known/security.txt

Contact: info@mcpcensus.com