# Agent checklist: install an MCP server safely

For coding agents and humans driving them — a short runbook.

## Before connect
1. `census_search` the brand or package name.
2. Prefer Official matches for vendor tools.
3. Reject archived / deprecated / impersonation flags unless policy overrides.
4. Record the exact `server_name` you approved.

## At connect
- Least-privilege secrets
- Confirm transport (stdio vs HTTP) matches the card’s run-as shape
- Pin versions when your client allows

## After connect
- Re-query census on a schedule for allowlisted names
- Watch for health flips to issues

## Endpoint
[API docs](/api) · [llms.txt](/llms.txt)