Agent checklist: install an MCP server safely

Before connect

1. census_search the brand or package name.
2. Prefer Official matches for vendor tools.
3. Reject archived / deprecated / impersonation flags unless policy overrides.
4. Record the exact server_name you approved.

At connect

• Least-privilege secrets
• Confirm transport (stdio vs HTTP) matches the card’s run-as shape
• Pin versions when your client allows

After connect

• Re-query census on a schedule for allowlisted names
• Watch for health flips to issues

Endpoint

API docs · llms.txt