---
title: "Evaluate one exact MCP server under one built-in policy"
method: POST
path: "/v1/preflight"
---

# Evaluate one exact MCP server under one built-in policy

`POST /v1/preflight`

## Request

- Base URL: `https://api.mcpcensus.com`
- URL: `https://api.mcpcensus.com/v1/preflight`
- Auth: one of:
  - none
  - API key in header `x-api-key`

Returns PASS, REVIEW, or BLOCK with ordered reasons, source facts and times, validity, reproducibility digests, and limitations. Anonymous calls must use refresh=never. Authenticated completed calls receive an account-scoped audit ID. A PASS does not authorize install or execution.

## Request body

- PreflightInput
  - `server_name` string, required: Exact canonical Census server name
  - `policy_id` 'builtin:baseline' | 'builtin:first-party' | 'builtin:strict'
  - `refresh` 'never' | 'if_stale'

## Response `200`

Completed policy decision

- PreflightResult
  - `ok` unknown, required
  - `decision` 'PASS' | 'REVIEW' | 'BLOCK', required
  - `decision_scope` 'public_evidence_policy', required
  - `meaning` string, required
  - `server_name` string, required
  - `policy` object, required
    - `id` 'builtin:baseline' | 'builtin:first-party' | 'builtin:strict', required
    - `revision` unknown, required
    - `digest` string, required
  - `reasons` PreflightReason[], required
    - `code` string, required
    - `result` 'pass' | 'review' | 'block' | 'context' | 'not_applicable' | 'unknown', required
    - `summary` string, required
    - `ecosystem` string
    - `artifact_id` string
    - `evidence` PreflightEvidence[], required
      - `source` string
      - `url` string, uri, nullable
      - `value` unknown
      - `observed_at` string, date-time, nullable
      - `attempted_at` string, date-time, nullable
      - `freshness_enforced` boolean
      - `canonical_evidence_id` string
  - `facts` object, required
  - `facts_digest` string, required
  - `decision_input_digest` string, required
  - `engine_version` string, required
  - `evaluated_at` string, date-time, required
  - `valid_until` string, date-time, required
  - `audit_id` string, uuid, nullable, required
  - `audit_signed` unknown, required
  - `limitations` string[], required

## Other responses

- `400`: Closed input validation failed
- `401`: Missing, invalid, or revoked account API key
- `404`: Exact resource not found
- `409`: A current-liveness refresh is already in progress
- `429`: Burst, daily, refresh, or per-server cooldown limit reached
- `503`: Authenticated audit could not be recorded

---

[API](https://skmtc.dev/mcpcensus/apis/the-mcp-census-api.md) · [All operations](https://skmtc.dev/mcpcensus/apis/the-mcp-census-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mcpcensus/apis/the-mcp-census-api/revisions/934a7da85b52?raw)