The MCP Census
Vet any MCP server before you depend on it. Stamp: PASS, REVIEW, or BLOCK.
| Endpoint | https://api.mcpcensus.com/mcp (streamable-http) |
|---|---|
| Registry version | 1.4.0 |
| Now | 15 tools · grade D (64) · pin ts_8f88d36dd7633e033d721262442e78b3 · protocol 2025-06-18 |
| First / last listed | 2026-10-25 01:11 UTC / 2026-10-25 01:11 UTC |
| Grade over time | 2026-10-25: D (64), 15 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: census_lookup census_search census_stats census_recent census_coverage census_watch_subscribe census_watch_list census_watch_unsubscribe census_preflight census_policy_list census_credits census_stamp census_lookalikes census_audit_config census_changes
census_lookup | Get the live health verdict for one MCP server by its exact registry name (e.g. 'io.github.owner/name'). Returns stars, last-push recency, gone/archived/deprecated flags, name-collision count, and a fact-based health verdict (healthy | issues | unknown). params: name* |
census_search | Search MCP servers by keyword or partial name (e.g. 'github', 'postgres'). Returns ranked matches with health/trust. Also returns: resolved_query (auto typo fix), disambiguate (when unsure), known_brand (we recognize a strong product but it has no official MCP — e.g. CodeRabbit), research (watchlist/confirmed_absent), query_intent (brand_lookup|category|package|install_gate|junk — does not change params: query*, limit |
census_stats | Ecosystem headline numbers from the live census (same payload as GET /v1/stats). Unmetered. Returns total servers, healthy/issues counts, popular (gh_stars>=1000), remote-capable count, github-linked count, and captured_at. No invented metrics. params: none |
census_recent | Newest MCP servers by real first_seen_at (same payload as GET /v1/recent). Unmetered. Only rows with a known first-seen date — never invents or guesses discovery times. Optional limit 1–50 (default 20). params: limit |
census_coverage | Public transparency report (same payload as GET /v1/coverage). Unmetered. Live D1 census/identity/remote/protocol/adoption/pipeline counts plus method notes — never invents completeness percentages or a brand_audit punch list. params: none |
census_watch_subscribe | Subscribe this agent (or a human email) to alerts for ONE specific MCP server. Fires only on real observed changes: remote_down, remote_up, health_change, verified_change, security. Requires x-api-key. Prefer webhook_url (https) so your agent can receive POST callbacks; email optional. Returns a watch id + HMAC secret (X-Census-Signature: sha256=…). Free tier: 5 watches; pro: 50. params: server_name*, webhook_url, email, events, label |
census_watch_list | List active per-server watches for this API key. Requires x-api-key. params: none |
census_watch_unsubscribe | Deactivate a watch by id. Requires x-api-key that owns the watch. params: id* |
census_preflight | Evaluate one exact MCP server under a documented built-in install policy. Returns PASS, REVIEW, or BLOCK with evidence reasons, freshness, digests, and explicit limits. This is a first gate, not a security audit. refresh=if_stale requires x-api-key. params: server_name*, policy_id, refresh |
census_policy_list | List the exact immutable Preflight v1 built-in policy objects, canonical ruleset, and policy digests. Unmetered. params: none |
census_credits | Show remaining Census credits for this API key (wallet after the UTC-month grant). Unmetered. Without a key, returns anonymous unique-per-day remaining — not a wallet. params: none |
census_stamp | Census stamp for one exact MCP server under a built-in policy. Same input as census_preflight. Returns the preflight body plus compact CENSUS-STAMP/1 text and stamp_json. Cost matches preflight. Never connect without a stamp. PASS is not a malware scan or permission review. params: server_name*, policy_id, refresh |
census_lookalikes | Contested identity for one exact server_name: official_for, name_collision_count, and up to 10 other census server_name values sharing the same namespace brand or tail. Never invents lookalikes. Cost 1. params: server_name* |
census_audit_config | Audit a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, Codex config.toml text). Resolves every entry without guessing (url → remote_url, npx → npm package, uvx → PyPI package) and returns one PASS / REVIEW / BLOCK / UNKNOWN verdict per entry under a built-in policy, plus CENSUS-AUDIT/1 text, valid_until_epoch and exit_code (1 on any params: config*, format, policy_id, previous_tools_digests, strict |
census_changes | The Census change feed (CENSUS-CHANGES/1): observed transitions across every server — server_new, remote_down, remote_up, tools_changed, health_change, verified_change, security, endpoint_moved, registry_status, spec_era_change. Cursor-paginated: pass next_cursor back as since. Filter by events, server_names or namespace_domain. Only real transitions, never 'still fine'. Unmetered in v1; poll hour params: since, events, server_names, namespace_domain, limit |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.