# How to check an MCP server is safe before you install it

No tool can prove an MCP server is safe. Check the public evidence first, then review its tools and permissions, then scan it in a sandbox.

This page gives the order I use. The first step costs nothing and takes a minute. I re-ran the Census steps below on 4 November 2026.

| Step | What it tells you | Tool |
|---|---|---|
| 1. Look up the server | Whether this exact name is the official one, and its health | [Census lookup](/lookup), `census_search`, `POST /v1/preflight` |
| 2. Read the evidence | Why it passed or failed: identity, repository, package, endpoint, advisories | Census decision and reasons |
| 3. Audit your config | One decision per entry in your `.mcp.json` | `POST /v1/audit` |
| 4. Run it in CI | Fails a pull request on a BLOCK | [GitHub Action](/agent-setup/census-preflight.yml) |
| 5. Review tools, then scan | What the server can do with your access | Your own review, then a scanner in a sandbox ([comparison](/compare/mcp-scan)) |

Registries such as Smithery, Glama and the official registry list servers; they do not make this check. See [MCP registries compared](/compare/mcp-registries).

## 1. Look up the exact server

Open [lookup](/lookup) and search for the server by name or brand. Pick the exact canonical name, for example `io.github.github/github-mcp-server`, not a similar one. Agents can do the same with the `census_search` tool, then `census_stamp` or `census_preflight` on that one name. Over REST, search with `GET /v1/search?q=github`, then call `POST /v1/preflight`:

```
curl -s -X POST https://api.mcpcensus.com/v1/preflight \
  -H 'content-type: application/json' \
  -d '{"server_name":"io.github.github/github-mcp-server","policy_id":"builtin:baseline"}'
```

Without a key you get 10 unique lookups a day per IP address.

## 2. Read the evidence

The result is a decision plus the facts behind it. Look at these:

- **Official or lookalike.** Is the publisher the vendor, proven by its domain or GitHub organisation, or only a name that resembles it? See [how to tell an official MCP server](/learn/how-to-tell-official-mcp).
- **Health.** Is the repository archived or gone, or the npm package deprecated or missing?
- **Hosted endpoint.** If the server claims a remote URL, did a public handshake answer?
- **Advisories.** Does OSV list an advisory for the package?

The decision is one of four words. **PASS** means every rule in the named policy passes on the facts shown. **REVIEW** means a person has to decide, or a fact is missing or stale. **BLOCK** means a confirmed hard failure, such as a proven impersonation, a gone repository, or a missing or deprecated package. **UNKNOWN** appears in a config audit when the Census holds no row for an entry, which is not the same as safe. Stop on BLOCK and ask a person on REVIEW or UNKNOWN. The exact rules are on the [policies](/policies) page.

## 3. Audit your whole config

Most people already have servers configured. Post your `.mcp.json` to the audit endpoint and you get one decision per entry. Strip `env` and headers first. Only `url`, `command`, `args` and `type` are read, and nothing else is stored, but there is no reason to send secrets.

```
jq '.mcpServers |= map_values({url, command, args, type})' .mcp.json \
  | curl -s -X POST https://api.mcpcensus.com/v1/audit \
      -H 'content-type: application/json' -H 'accept: text/plain' --data @-
```

An entry with a `url` resolves to the hosted server that uses it. An `npx`, `bunx` or `pnpm dlx` command resolves to its npm package, and `uvx` to its PyPI package. A Docker image, a local script or a Git URL comes back UNKNOWN with the reason named. This is real output from 4 November 2026 for a two-entry config:

```
CENSUS-AUDIT/1
policy=builtin:baseline
as_of=2026-11-04T00:58:01.132Z
valid_until=2026-11-05T00:58:01.132Z
entries=2 pass=1 review=1 block=0 unknown=0
exit_code=0
---
alias=github decision=PASS name=io.github.github/github-mcp-server reasons=identity_first_party,hosted_liveness_live
alias=fs decision=REVIEW name=io.github.modelcontextprotocol/server-filesystem reasons=hosted_liveness_not_applicable,osv_package_advisory
---
scope=public_evidence_policy not_a_malware_scan=true pass_is_not_a_sandbox=true
```

(I left out the config digest and the per-line expiry field.) Without a key you can audit one config of up to 25 entries per IP address per UTC day, and the same config again that day is free. A free account key allows up to 100 entries per config and 1,000 credits a month, with one credit per config per day. The JSON form, the `exit_code` field and the full contract are at [/agent-setup/audit.md](/agent-setup/audit.md). Send `"strict": true` in a `{"config": ...}` body and REVIEW or UNKNOWN also return exit code 2.

## 4. Run it in CI

The repository ships a GitHub Action that does step 3 for you. It finds `.mcp.json`, `mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, `claude_desktop_config.json` and `.codex/config.toml`, strips `env` and headers, and posts each file to `/v1/audit`. To install it, copy the file into your workflow folder:

```
mkdir -p .github/workflows
curl -fsSL https://mcpcensus.com/agent-setup/census-preflight.yml -o .github/workflows/census-preflight.yml
```

It runs on pull requests that touch one of those files, nightly, and on demand. A BLOCK fails the job. REVIEW and UNKNOWN show as warnings. To fail on those too, run the workflow by hand and set the `strict` input to `1`, or change the default in the file. A `CENSUS_API_KEY` repository secret is optional, but a repository with more than one MCP config file should set it: the keyless allowance covers one config per IP address per day, and a refused request fails the job. The file is at [/agent-setup/census-preflight.yml](/agent-setup/census-preflight.yml).

## 5. Review the tools and secrets, then scan in a sandbox

A PASS says the public record supports installing the server. It does not read the server's code or its tool descriptions. So read the tool list, and note which secrets and scopes the server asks for and what each one could reach. Give it the least access that works.

If you want a second look, run a scanner on the servers you kept, inside a container or a throwaway machine. Snyk Agent Scan (formerly mcp-scan) and Cisco MCP Scanner both connect to servers and analyse tool descriptions or code, and both can start local servers to do it. How they differ is on the [comparison page](/compare/mcp-scan). For the relationship between a Census stamp and a scanner, see [Census stamp vs mcp-scan](/learn/census-stamp-vs-mcp-scan). A shorter checklist is in [how to evaluate an MCP server before you install it](/learn/evaluate-mcp-server-before-install).

## FAQ

### Can any tool tell me an MCP server is safe?
No. A Census PASS means the public evidence meets a named policy. It is not a malware scan, a permission review or a sandbox, and a scanner can only report what it finds in tool text or code. Check the evidence, review the tools and secrets, and run the server with limited access.

### Is a PASS enough to install a server?
No. PASS is a first gate. It tells you the identity, repository, package and endpoint evidence looks right. You still need to read what the server can do with the access you give it.

### What does UNKNOWN mean?
In a config audit, UNKNOWN means the Census holds no row for that entry, for example a local script or a Docker image. It does not mean the entry is unsafe, and it is never upgraded to PASS. Treat it as REVIEW.

### Do I need an account to audit my config?
No. Without a key you can audit one config of up to 25 entries per IP address per UTC day. A free account key raises the limits.