Census stamp vs mcp-scan

What each one is

| | Census stamp | mcp-scan (Invariant / Snyk) | |---|---|---| | Job | Identity, health, official vs lookalike, live remote — before you connect | Tool descriptions on servers you already configured | | Output | PASS / REVIEW / BLOCK + digests + audit_signed:false | Classifier / guardrail hits on description text | | Layer | Registry + GitHub/npm/PyPI + handshake | Your client config + live tools/list | | PASS / clean | Public evidence supports install under that policy. Not safe. | Not a permission review. High false-positive rate on keyword scans. |

The official registry tells you a server exists. Directories help you find one. Census tells you whether the public record supports installing this exact name. mcp-scan looks at tool text after connect. They do not replace each other.

What Census will not do

We do not run a malware lab, a YARA pack, or an LLM “poisoned description” classifier across the catalog. Measured noise on those scanners is high (hundreds of alerts, near-zero confirmed malice on public package samples). A BLOCK on a regex would train agents to ignore us.

A later Census fact is a tool-list digest on remotes we already handshake: if the list of tool names/descriptions changes, watches fire. That is “it moved”, not “it is malicious”. Auth-gated remotes stay unknown. Local stdio servers are out of scope.

Agent path

1. census_search → one exact canonical name.
2. census_stamp or census_preflight with a named built-in policy.
3. Stop on BLOCK. Ask a human on REVIEW.
4. On PASS, still review tools, secrets, and isolation. Optionally run mcp-scan on that host.

Prices and credit costs: pricing. Stamp format: CENSUS-STAMP/1.