Vet any MCP server before you depend on it. Stamp: PASS, REVIEW, or BLOCK.
Inferido de los transportes que declara este listado (streamable-http). Que un cliente no aparezca aquí no significa que se haya descartado: simplemente Forge no puede confirmarlo.
La verificación confirma la identidad del publicador (la propiedad del repo), no la seguridad del código. El análisis de seguridad cubre los CVE conocidos y los scripts de instalación sospechosos.
Leído de un handshake MCP real initialize → tools/list contra el endpoint declarado. No se invocó ninguna herramienta: tools/list es la llamada de introspección de solo lectura que el protocolo define para esto. Refleja lo que el servidor anunciaba en ese momento; un endpoint alojado no está fijado a ninguna versión y puede cambiar sin avisar.
https://api.mcpcensus.com/mcp15 herramientas · 111 mscensus_lookupGet the live health verdict for one MCP server by its exact registry name (e.g. 'io.github.owner/name'). Returns stars, last-push recency, gone/archived/deprecated flags, name-collision count, and a fact-based health verdict (healthy | issues | unknown).Get the live health verdict for one MCP server by its exact registry name (e.g. 'io.github.owner/name'). Returns stars, last-push recency, gone/archived/deprecated flags, name-collision count, and a fact-based health verdict (healthy | issues | unknown).
| Parámetro | Tipo | Descripción |
|---|---|---|
| name* | string | Exact MCP registry server name |
census_searchSearch MCP servers by keyword or partial name (e.g. 'github', 'postgres'). Returns ranked matches with health/trust. Also returns: resolved_query (auto typo fix), disambiguate (when unsure), known_brand (we recognize a strong product but it has no official MCP — e.g. CodeRabbit), research (watchlis…Search MCP servers by keyword or partial name (e.g. 'github', 'postgres'). Returns ranked matches with health/trust. Also returns: resolved_query (auto typo fix), disambiguate (when unsure), known_brand (we recognize a strong product but it has no official MCP — e.g. CodeRabbit), research (watchlis…
| Parámetro | Tipo | Descripción |
|---|---|---|
| query* | string | Keyword or partial server name (>= 2 chars). Typos and space variants are resolved when confident. |
| limit | number | Max results 1–50 (default 20) |
census_statsEcosystem headline numbers from the live census (same payload as GET /v1/stats). Unmetered. Returns total servers, healthy/issues counts, popular (gh_stars>=1000), remote-capable count, github-linked count, and captured_at. No invented metrics.Ecosystem headline numbers from the live census (same payload as GET /v1/stats). Unmetered. Returns total servers, healthy/issues counts, popular (gh_stars>=1000), remote-capable count, github-linked count, and captured_at. No invented metrics.
No se publicó ningún esquema de entrada para esta herramienta.
census_recentNewest MCP servers by real first_seen_at (same payload as GET /v1/recent). Unmetered. Only rows with a known first-seen date — never invents or guesses discovery times. Optional limit 1–50 (default 20).Newest MCP servers by real first_seen_at (same payload as GET /v1/recent). Unmetered. Only rows with a known first-seen date — never invents or guesses discovery times. Optional limit 1–50 (default 20).
| Parámetro | Tipo | Descripción |
|---|---|---|
| limit | number | Max results 1–50 (default 20) |
census_coveragePublic transparency report (same payload as GET /v1/coverage). Unmetered. Live D1 census/identity/remote/protocol/adoption/pipeline counts plus method notes — never invents completeness percentages or a brand_audit punch list.Public transparency report (same payload as GET /v1/coverage). Unmetered. Live D1 census/identity/remote/protocol/adoption/pipeline counts plus method notes — never invents completeness percentages or a brand_audit punch list.
No se publicó ningún esquema de entrada para esta herramienta.
census_watch_subscribeSubscribe this agent (or a human email) to alerts for ONE specific MCP server. Fires only on real observed changes: remote_down, remote_up, health_change, verified_change, security. Requires x-api-key. Prefer webhook_url (https) so your agent can receive POST callbacks; email optional. Returns a wa…Subscribe this agent (or a human email) to alerts for ONE specific MCP server. Fires only on real observed changes: remote_down, remote_up, health_change, verified_change, security. Requires x-api-key. Prefer webhook_url (https) so your agent can receive POST callbacks; email optional. Returns a wa…
| Parámetro | Tipo | Descripción |
|---|---|---|
| server_name* | string | Exact registry name to watch |
| webhook_url | string | https URL that will receive signed POST event payloads |
| string | Optional human email for the same alerts | |
| events | array | Subset of remote_down,remote_up,health_change,verified_change,security,tools_changed (default: all) |
| label | string | Optional agent-chosen label |
census_watch_listList active per-server watches for this API key. Requires x-api-key.List active per-server watches for this API key. Requires x-api-key.
No se publicó ningún esquema de entrada para esta herramienta.
census_watch_unsubscribeDeactivate a watch by id. Requires x-api-key that owns the watch.Deactivate a watch by id. Requires x-api-key that owns the watch.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | Watch id from census_watch_subscribe |
census_preflightEvaluate one exact MCP server under a documented built-in install policy. Returns PASS, REVIEW, or BLOCK with evidence reasons, freshness, digests, and explicit limits. This is a first gate, not a security audit. refresh=if_stale requires x-api-key.Evaluate one exact MCP server under a documented built-in install policy. Returns PASS, REVIEW, or BLOCK with evidence reasons, freshness, digests, and explicit limits. This is a first gate, not a security audit. refresh=if_stale requires x-api-key.
| Parámetro | Tipo | Descripción |
|---|---|---|
| server_name* | string | Exact canonical Census server name |
| policy_id | string | — |
| refresh | string | — |
census_policy_listList the exact immutable Preflight v1 built-in policy objects, canonical ruleset, and policy digests. Unmetered.List the exact immutable Preflight v1 built-in policy objects, canonical ruleset, and policy digests. Unmetered.
No se publicó ningún esquema de entrada para esta herramienta.
census_creditsShow remaining Census credits for this API key (wallet after the UTC-month grant). Unmetered. Without a key, returns anonymous unique-per-day remaining — not a wallet.Show remaining Census credits for this API key (wallet after the UTC-month grant). Unmetered. Without a key, returns anonymous unique-per-day remaining — not a wallet.
No se publicó ningún esquema de entrada para esta herramienta.
census_stampCensus stamp for one exact MCP server under a built-in policy. Same input as census_preflight. Returns the preflight body plus compact CENSUS-STAMP/1 text and stamp_json. Cost matches preflight. Never connect without a stamp. PASS is not a malware scan or permission review.Census stamp for one exact MCP server under a built-in policy. Same input as census_preflight. Returns the preflight body plus compact CENSUS-STAMP/1 text and stamp_json. Cost matches preflight. Never connect without a stamp. PASS is not a malware scan or permission review.
| Parámetro | Tipo | Descripción |
|---|---|---|
| server_name* | string | Exact canonical Census server name |
| policy_id | string | — |
| refresh | string | — |
census_lookalikesContested identity for one exact server_name: official_for, name_collision_count, and up to 10 other census server_name values sharing the same namespace brand or tail. Never invents lookalikes. Cost 1.Contested identity for one exact server_name: official_for, name_collision_count, and up to 10 other census server_name values sharing the same namespace brand or tail. Never invents lookalikes. Cost 1.
| Parámetro | Tipo | Descripción |
|---|---|---|
| server_name* | string | Exact canonical Census server name |
census_audit_configAudit a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, Codex config.toml text). Resolves every entry without guessing (url → remote_url, npx → npm package, uvx → PyPI package) and returns one PASS / REVIEW / BLOCK / UNKNOWN verdict pe…Audit a whole MCP client config in one call (.mcp.json, claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, Codex config.toml text). Resolves every entry without guessing (url → remote_url, npx → npm package, uvx → PyPI package) and returns one PASS / REVIEW / BLOCK / UNKNOWN verdict pe…
| Parámetro | Tipo | Descripción |
|---|---|---|
| config* | — | The config document: an object with mcpServers | servers | mcp_servers, a list under entries[], or raw text (JSON or Codex config.toml) |
| format | string | — |
| policy_id | string | — |
| previous_tools_digests | object | alias → tools_digest from your last audit; sets tools_drift per entry |
| strict | boolean | exit_code 2 when any entry is REVIEW or UNKNOWN |
census_changesThe Census change feed (CENSUS-CHANGES/1): observed transitions across every server — server_new, remote_down, remote_up, tools_changed, health_change, verified_change, security, endpoint_moved, registry_status, spec_era_change. Cursor-paginated: pass next_cursor back as since. Filter by events, se…The Census change feed (CENSUS-CHANGES/1): observed transitions across every server — server_new, remote_down, remote_up, tools_changed, health_change, verified_change, security, endpoint_moved, registry_status, spec_era_change. Cursor-paginated: pass next_cursor back as since. Filter by events, se…
| Parámetro | Tipo | Descripción |
|---|---|---|
| since | string | next_cursor from the previous page, or an RFC 3339 time for the first call |
| events | array | Event names to include (default all) |
| server_names | array | Exact canonical names to include (≤50) |
| namespace_domain | string | Registrable domain of a DNS-verified namespace, e.g. notion.com |
| limit | integer | — |
15 de 15 herramientas publicaron una descripción.
Los nombres y descripciones de las herramientas los escribe el publicador y se muestran literalmente como texto inerte. Son las cadenas que un cliente MCP pasa al modelo, así que Forge las analiza en busca de patrones de inyección de prompts — cualquier hallazgo aparece junto al análisis de seguridad de arriba. «Privilegiada» es una coincidencia de palabra clave en el nombre de la herramienta, no una auditoría de lo que hace: un nombre inofensivo puede hacer cualquier cosa.
Vet any MCP server before you depend on it. Stamp: PASS, REVIEW, or BLOCK.
Los nombres enlazados abren el índice de Forge con todas las entradas que se observó que exponen esa herramienta. Ver todas las herramientas indexadas.
Esta entrada no publica ningún paquete de npm, así que Forge no tiene un árbol de dependencias para ella. Es una carencia de cobertura, no una afirmación de que no tenga dependencias.