# MCP supply-chain checklist for platform teams

Inventory and gate MCP servers like any other plugin supply chain.

## Control objectives
Inventory every server name in use. Gate installs on identity and health. Re-check continuously. Keep a human override path.

## Minimum viable gate
- Default deny unknown names
- Allowlist Official vendor servers where required
- Fail closed on archived, deprecated, or impersonation flags (policy choice — document it)
- CI calls `census_lookup` / search before merge of agent configs

## Where census fits
Registry-wide evidence feed + API. Not your secret store, not your sandbox.

## Next step
[API](/api) for automation · [methodology](/methodology) for auditors · email info@mcpcensus.com for volume quotes.