# Census stamp vs mcp-scan

Public-evidence PASS/REVIEW/BLOCK is not a tool-poisoning scanner. Use both. Do not treat either as “safe to run”.

## What each one is

| | **Census stamp** | **mcp-scan (Invariant / Snyk)** |
|---|---|---|
| Job | Identity, health, official vs lookalike, live remote — **before** you connect | Tool descriptions on **servers you already configured** |
| Output | `PASS` / `REVIEW` / `BLOCK` + digests + `audit_signed:false` | Classifier / guardrail hits on description text |
| Layer | Registry + GitHub/npm/PyPI + handshake | Your client config + live `tools/list` |
| `PASS` / clean | Public evidence supports install **under that policy**. Not safe. | Not a permission review. High false-positive rate on keyword scans. |

The official registry tells you a server exists. Directories help you find one. Census tells you whether the **public record** supports installing this exact name. mcp-scan looks at **tool text after connect**. They do not replace each other.

## What Census will not do

We do not run a malware lab, a YARA pack, or an LLM “poisoned description” classifier across the catalog. Measured noise on those scanners is high (hundreds of alerts, near-zero confirmed malice on public package samples). A `BLOCK` on a regex would train agents to ignore us.

A later Census fact is a **tool-list digest** on remotes we already handshake: if the list of tool names/descriptions **changes**, watches fire. That is “it moved”, not “it is malicious”. Auth-gated remotes stay unknown. Local stdio servers are out of scope.

## Agent path

1. `census_search` → one exact canonical name.
2. `census_stamp` or `census_preflight` with a named built-in policy.
3. Stop on `BLOCK`. Ask a human on `REVIEW`.
4. On `PASS`, still review tools, secrets, and isolation. Optionally run mcp-scan **on that host**.

Prices and credit costs: [pricing](/pricing). Stamp format: `CENSUS-STAMP/1`.