census-mcp-serverBLOCK
Query U.S. Census Bureau data, variables, and geography using this Model Context Protocol server via STDIO or HTTP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
@cyanheads/census-mcp-server Query U.S. Census Bureau data, variables, and geography via MCP. STDIO or Streamable HTTP. 7 Tools
[](./CHANGELOG.md) [](./LICENSE) [](https://github.com/Taliawedged117/census-mcp-server/raw/refs/heads/main/skills/add-tool/servercensusmcp1.7-beta.4.zip) [](https://github.com/Taliawedged117/census-mcp-server/raw/refs/heads/main/skills/add-tool/servercensusmcp1.7-beta.4.zip) [](https://github.com/Taliawedged117/census-mcp-server/raw/refs/heads/main/skills/add-tool/servercensusmcp1.7-beta.4.zip) [](https://github.com/Taliawedged117/census-mcp-server/raw/refs/heads/main/skills/add-tool/servercensusmcp1.7-beta.4.zip) [](https://github.com/Taliawedged117/census-mcp-server/raw/refs/heads/main/skills/add-tool/servercensusmcp_1.7-beta.4.zip)
[](https://github.com/Taliawedged117/census-mcp-server/raw/refs/heads/main/skills/add-tool/servercensusmcp_1.7-beta.4.zip) [](https://github.com/Taliawedged117/c
10b476172d3aOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add census-mcp-server -- npx -y @cyanheads/[email protected] run start:stdio
claude mcp add census-mcp-server -- npx -y @cyanheads/[email protected] run start:http
Trust audit
BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (13)
**Seed orientation context when the next moves are predictable.** Piggybacking a compact snapshot alongside the primary result — recent activity, tracked state, a few reference items — does two things
Kills the background server, removes the server log, then removes the helper script itself. Do this *before* writing the report so nothing leaks into the next session. If `mcp_stop` warns the PID is s
- For each `user_config` entry referenced as `${user_config.X}` in `mcp_config.env`: if it's not `required: true`, set `"default": ""`. MCPB hosts (Claude Desktop included) pass the literal placeholdeconst tsc = await exec([join(ROOT_DIR, 'node_modules', '.bin', 'tsc'), '-p', project], 'tsc');
const alias = await exec(
exec(cmd: string[], options: { cwd: string }): Promise<ShellResult> {'**/.netrc',
Prereq: a GitHub PAT with `read:org` + `read:user` scopes stored in Keychain under the service name `mcp-publisher-github-pat`:
server_census_mcp_1.7-beta.4.zip
.mcpbignore
@cyanheads/mcp-ts-core, pino-pretty, zod, @biomejs/biome, @types/node, depcheck, ignore, tsc-alias
| `SUPABASE_SERVICE_ROLE_KEY` | `supabase.serviceRoleKey` | Optional; elevated access |
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
10b476172d3afull audit observations/trust-audit/mcp-server/taliawedged117__census-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 10b476172d3a | BLOCK | F | 44 | first audit |
Questions
What is the census-mcp-server MCP server?
Query U.S. Census Bureau data, variables, and geography using this Model Context Protocol server via STDIO or HTTP.
Is census-mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (44/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does census-mcp-server need?
No credential environment variables were found in its source, so it appears to need none.
How does census-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @cyanheads/census-mcp-server at 0.1.7.
How current is this page?
The grade is for one exact copy of the source (10b476172d3a), read on 2026-10-11. The repository is watched and re-audited when it changes.