MCP Census, mcp-scan (Snyk Agent Scan) and Cisco MCP Scanner

These tools answer different questions. The MCP Census is a first gate on public evidence before you install a server, not a security audit. mcp-scan (now Snyk Agent Scan) and Cisco MCP Scanner connect to servers you have chosen and analyse their tool descriptions or code.

Page owner: Jaco Veldsman, The MCP Census, Australia · [email protected]
Checked 21 October 2026

Facts

Every statement about the two scanners comes from the sources listed at the end, read on 21 October 2026. Their CLI output and flags change between releases, so check their own docs before you rely on a detail.

Topic	The MCP Census	mcp-scan / Snyk Agent Scan	Cisco MCP Scanner
Made by	Jaco Veldsman, Australia.	Snyk. Published first as mcp-scan by Invariant Labs; the old repository redirects to snyk/agent-scan.	Cisco AI Defense (cisco-ai-defense/mcp-scanner).
Licence	Hosted service. The API contract is public.	Apache-2.0 (PyPI).	Apache-2.0 (README badge).
Question it answers	Does the public record support installing this exact server?	Do the tool descriptions and skills on this machine show known risks?	Do this server’s tools, prompts, resources or code show security findings?
What it checks	Publisher identity, official versus lookalike names, repository and package health, advisories, whether a hosted endpoint answers. No tool-description analysis.	v0.6 and later report scored risk indicators such as prompt injection, untrusted or private data exposure, destructive capabilities and malicious skills (risk reference). It covers MCP servers, tools, prompts, resources and skills.	YARA rules, an LLM-based analyzer and the Cisco AI Defense inspect API over tools, prompts, resources and server instructions. It can also scan server source code, PyPI and npm packages, Python dependencies for known vulnerabilities, and binaries through VirusTotal hash lookups.
How you run it	Web lookup, REST, or MCP. Command below.	`uvx snyk-agent-scan@latest`, or a standalone binary from GitHub Releases.	`uv tool install cisco-ai-mcp-scanner`, then `mcp-scanner`.
What it needs	Nothing for the keyless allowance. A free account key raises the limits.	A Snyk API token in `SNYK_TOKEN`, and uv or the binary.	Python 3.11+ and uv. A Cisco AI Defense API key, an LLM provider key and a VirusTotal key are each optional. The README requires a key only for the API and LLM analyzers; its quick-start examples use the YARA analyzer.
Does it connect to or run servers	It does not install or run your servers. For a hosted endpoint it records whether a public handshake answers.	Yes. It starts stdio servers by running the config’s commands, after consent in interactive runs, and connects to remote URLs with the configured headers. The README says to run it in a sandbox for untrusted configs.	Yes for live scans: it connects to remote HTTP/SSE servers and launches stdio servers. A static mode scans pre-generated JSON files offline.
CI	GitHub Action: BLOCK fails the job.	`--ci` exits non-zero when findings or operational failures remain. Its README example is `snyk-agent-scan --ci --dangerously-run-mcp-servers`.	The README describes static mode as suited to CI/CD pipelines and air-gapped environments.
Where your data goes	The config’s `url`, `command`, `args` and `type` are read; `env` and headers are ignored and never stored. Strip them before posting.	Agent application details, MCP server configurations and signatures, tool names and descriptions, and skill content are sent to the Agent Scan API, with secrets redacted.	The README has no data-handling statement. Check what each analyzer receives before you enable it.

Run each one

census · audit your .mcp.json, no account

jq '.mcpServers |= map_values({url, command, args, type})' .mcp.json \
  | curl -s -X POST https://api.mcpcensus.com/v1/audit \
      -H 'content-type: application/json' -H 'accept: text/plain' --data @-

snyk agent scan · needs a Snyk token

export SNYK_TOKEN=your-api-token-here
uvx snyk-agent-scan@latest

cisco mcp scanner · yara analyzer

uv tool install --python 3.13 cisco-ai-mcp-scanner
mcp-scanner --scan-known-configs --analyzers yara --format summary

The Census command strips env and headers before posting, reads one config of up to 25 entries per IP per UTC day without a key, and returns one decision per entry. The contract is at /agent-setup/audit.md. Both scanner commands connect to the servers in your configs, which for stdio servers means starting them, so use a sandbox for configs you do not trust.

When to use which

Before you install. Use the Census to check who publishes a server, whether the name is the official one or a lookalike, whether the repository is archived or the package deprecated, whether there are advisories, and whether a hosted endpoint answers. Nothing is run.
After you have chosen a server. Use a scanner on it, in a sandbox, to read its tool descriptions or code for injected instructions and risky capabilities. Pick the one that fits your stack and your data rules: the Snyk tool needs a Snyk token and sends tool text to its API, the Cisco tool has an offline mode and optional keys.
Together. Census first, scanner second, then your own review of the tools and the secrets the server asks for. If the Census says BLOCK, you do not need the later steps. See how to check an MCP server is safe before you install it and Census stamp vs mcp-scan.

What the Census does not do

It is not a malware lab and it runs no antivirus or YARA pack over the catalog.
It has no tool-poisoning or prompt-injection classifier and does not analyse tool descriptions.
It does not review permissions, scopes or what a server does with your data.
PASS is not “safe”. It means the public evidence meets the named policy. UNKNOWN means the Census holds no row for the entry, not that the entry is fine.

Questions

Is the MCP Census a replacement for mcp-scan or Cisco MCP Scanner?

No. The Census reads public evidence about a server (who publishes it, whether the repository and packages exist, advisories, whether a hosted endpoint answers) and returns PASS, REVIEW, BLOCK or UNKNOWN before you install. The scanners connect to a server or read its code and analyse tool descriptions. Use the Census first, then a scanner on the servers you keep.

Is mcp-scan the same tool as Snyk Agent Scan?

Yes. On the check date, github.com/invariantlabs-ai/mcp-scan redirected to github.com/snyk/agent-scan, and the PyPI page for mcp-scan 0.4.3 said the package had been renamed to snyk-agent-scan and forwards the mcp-scan command.

Does scanning an MCP config run the servers in it?

With Snyk Agent Scan it can. Its README says it starts stdio servers by executing the commands in the config and connects to remote URLs with the configured headers, asks for consent in interactive runs, and recommends a sandbox. Cisco MCP Scanner also launches and connects to stdio and remote servers, and has an offline static mode that reads pre-generated JSON files instead. The Census does not install or run your servers.

Does a Census PASS mean a server is safe to run?

No. PASS means the public evidence meets the named policy. It is not a malware scan, a permission review or a sandbox. Review the tools and the secrets a server asks for, and run a scanner in a sandbox if you want a second look.

Sources read on 21 October 2026

Not independently tested: this page reports what their documentation says, not how either scanner performs. Corrections: [email protected].

Smithery · Glama · mcp.so · All registries compared · Lookup