MCP Census developer API

# search
curl "https://api.mcpcensus.com/v1/search?q=github" \
  -H "x-api-key: YOUR_KEY"

# one server
curl "https://api.mcpcensus.com/v1/server?name=io.github.netdata/mcp-server" \
  -H "x-api-key: YOUR_KEY"

Headers: x-ratelimit-remaining, x-tier. No key = 10/day. Free account key = 100/day. Quotas count unique lookups — asking for the same query or server again the same day is free. &limit= default 20, max 50.

Apply one named policy to one exact server

Input is closed. policy_id defaults to builtin:baseline. refresh defaults to never. if_stale needs an account key and can only probe the canonical stored Census URL under bounded quota and cooldown rules.

# exact policies and canonical ruleset
curl https://api.mcpcensus.com/v1/policies

# evaluate one exact canonical name
curl -X POST https://api.mcpcensus.com/v1/preflight \
  -H "content-type: application/json" \
  -H "x-api-key: YOUR_KEY" \
  -d '{"server_name":"io.github.owner/name","policy_id":"builtin:baseline","refresh":"never"}'

# authenticated audit history
curl -H "x-api-key: YOUR_KEY" https://api.mcpcensus.com/v1/evaluations
curl -H "x-api-key: YOUR_KEY" https://api.mcpcensus.com/v1/evaluations/AUDIT_ID

Every completed result includes ordered reasons, facts, source times, facts_digest, policy.digest, decision_input_digest, evaluated_at, valid_until, audit_signed: false, and limitations. Authenticated completed calls also include a random account-scoped audit ID retained for 90 days. Digests are not signatures.

Exact policy objects → · Method and limits → · Human console →

Point a client at the streamable HTTP endpoint. The server exposes exactly 10 tools:

• census_search — search and select one exact canonical name
• census_lookup — full evidence card for an exact name
• census_stats — ecosystem headline counts
• census_recent — recently discovered servers
• census_coverage — public coverage and provenance report
• census_watch_subscribe — watch one server (API key)
• census_watch_list — list watches (API key)
• census_watch_unsubscribe — stop a watch (API key)
• census_preflight — PASS, REVIEW, or BLOCK for one exact name and policy
• census_policy_list — exact policies and canonical ruleset

Required flow: search and select one exact canonical name; run census_preflight with a named policy; stop on BLOCK; ask a human on REVIEW; review permissions, scopes, code, data access, and runtime isolation after PASS; never install or run from a Census result alone.

{
  "mcpServers": {
    "mcp-census": {
      "url": "https://api.mcpcensus.com/mcp",
      "headers": { "x-api-key": "YOUR_KEY" }
    }
  }
}

Best path: paste this into any coding agent and let it install itself — same pattern as Cloudflare’s agent setup.

Fetch https://mcpcensus.com/agent-setup/prompt.md

Or one-click / copy-paste for a specific client. No button pretends more than the client can do.

Endpoint: https://api.mcpcensus.com/mcp · agent install guide: /agent-setup/prompt.md · product map: /llms.txt

Subscribe to one MCP server at a time. We notify only when something real changes on that server — remote goes down or comes back, health flips, verification-relevant legs move, or OSV security findings change. No noise when nothing happened.

Agent path (preferred): HTTPS webhook. Your agent POSTs a subscribe call; we POST signed events back. Human path: email. Free account key: 5 watches · pro: 50 · more by request.

# subscribe (API key required)
curl -X POST https://api.mcpcensus.com/v1/watch \
  -H "content-type: application/json" \
  -H "x-api-key: YOUR_KEY" \
  -d '{"server_name":"com.vercel/vercel-mcp","webhook_url":"https://your.agent/hooks/census"}'

# list · unsubscribe
curl -H "x-api-key: YOUR_KEY" https://api.mcpcensus.com/v1/watch
curl -X DELETE -H "x-api-key: YOUR_KEY" "https://api.mcpcensus.com/v1/watch?id=WATCH_ID"

# MCP tools (same server): census_watch_subscribe · census_watch_list · census_watch_unsubscribe

Webhook headers: X-Census-Event, X-Census-Signature: sha256=… (HMAC of body with the watch secret), X-Census-Watch-Id. Events: remote_down · remote_up · health_change · verified_change · security. Full agent notes in /llms.txt.

{
  "server_name": "io.github.owner/name",
  "health": "healthy | issues | unknown",
  "health_problems": ["repo_gone", "npm_deprecated", ...],
  "verified": true,
  "gh_stars": 1234, "months_since_push": 0.9,
  "gh_archived": false, "npm_deprecated": false,
  "name_collision_count": 3, "registry_status": "active",
  "trust_score": 78,
  "trust_factors": [{ "factor": "repo_live", "points": 10, "pillar": "maintenance",
      "evidence": "GitHub repo confirmed present and not archived" },
    { "factor": "awesome_listed", "points": 2, "pillar": "adoption",
      "evidence": "repository is listed in awesome-mcp-servers — https://github.com/punkpeye/awesome-mcp-servers" }, ...],
  "trust_pillars": [{ "pillar": "identity", "points": 15, "max": 20 },
      { "pillar": "maintenance", "points": 41, "max": 59 },
      { "pillar": "adoption", "points": 24, "max": 51 },
      { "pillar": "security", "points": 0, "max": 0 }], ...
}

health is healthy / issues / unknown. trust_score is 0–100 with trust_factors (and pillar groups) in the same response. Unknown is not a guess. Registry, GitHub, npm, PyPI.

verified: true = live repo (not archived) + live package + active registry listing. Not a claim that npm publisher equals GitHub owner.

Free SVG badge for READMEs. No key. Links to lookup.

# the image
GET https://mcpcensus.com/badge/io.github.owner/name.svg

# markdown embed
[![MCP Census](https://mcpcensus.com/badge/io.github.owner/name.svg)](https://mcpcensus.com/lookup?q=io.github.owner/name)