Censys vs GreyNoise

Censys 55

Graded as a hosted service on the Platform API. Atlassian Statuspage at status.censys.com with Platform API, Authentication, Credit Management and three MCP server components (20). Its feed lists 12 entries from 24 August to 2 November 2026. Two were maintenance on ASM. The rest include intermittent 500s on the Platform from 13:52 on 24 August to 09:52 the next day, periodic query failures from 20 to 22 September, historical data calls timing out for about an hour on 18 September, an internal networking outage of the Platform and ASM from 00:35 to 13:46 EDT on 30 September, and failing searches from 14:26 EST on 2 November still in monitoring at 19:08. One full outage of about 13 hours and two multi-hour periods of failing core queries, read as more than one major (5). Limits are published with numbers, concurrency 1 or 25 per organisation and 25 requests a second per IP with a burst of 125 (15). Overruns return 429 or 503, but no Retry-After, backoff guidance or idempotency keys were found, and the SDKs say only that they follow the API's default retry strategy (5 of 15). No SLA found. The terms disclaim any warranty that the service will meet requirements, and the pricing page names none (0). The v3 API is generally available (10). 20 + 5 + 15 + 5 + 0 + 10 = 55.

GreyNoise 78

Read with the hosted lines for the v3 REST API. Status page at status.greynoise.io on incident.io with 16 components, ten of them GreyNoise's own, including API and API Data Freshness (20). No incident is listed for the 90 days to 3 November 2026. The API component shows 99.94 per cent uptime for August to November and the group 99.83 per cent, downtime the page gives no incident for, so read as clean or trivial with that caveat (25 of 30). Limits with numbers exist only for the free side, 10 lookups a day unauthenticated and 50 searches a week on a free account; paid plans are 'Unlimited' on the plans page and no per-minute figure was found (8 of 15). 429 responses are defined on 29 of 70 operations and a 503 at query engine capacity carries a documented Retry-After header, which the official SDK and MCP client honour with backoff. No idempotency keys for the blocklist, alert and feed writes (10 of 15). The plans page publishes an SLA of 1 business day, 8 hours or 4 hours on paid tiers beside support hours, which reads as a response time, and no availability SLA was found (5 of 10). The v3 API is generally available and v2 was decommissioned on 30 April 2026 (10). 20 + 25 + 8 + 10 + 5 + 10 = 78.

Censys 55

Personal access tokens as a Bearer header, several per user, named, shown once and deletable, with no scopes or expiry stated. Service accounts on Search and Core plans use OAuth 2 client credentials with module roles and a rotatable secret, and the MCP server takes OAuth with a consent page. Only the organisation id, not a secret, may travel in the query string (26 of 30). Module roles (Analyst, Manager), an API Access role and the advice to grant service accounts only the roles they need, but no read-only token and no confirmation step for deleting a collection (12 of 20). Results carry banners, HTML titles and certificate subjects from scanned hosts, and no guidance on treating them as untrusted was found in the API, MCP or skills docs (3 of 15). A platform audit log for admins that records service account activity, credit usage per member through the API and X-Request-ID on every response, with no documented per-call log for token holders (10 of 15). security@censys.com on the contact page. security.txt 404, no bug bounty, and the compliance page says Censys helps customers with SOC 2, ISO 27001 and FedRAMP without claiming any for itself (4 of 20). 26 + 12 + 3 + 10 + 4 = 55.

GreyNoise 40

One API key per workspace with no scopes and no read-only variant, sent in a key header, and no page read documents rotation or revocation; the MCP security page says only to rotate on compromise (12 of 30). Most endpoints read, and the MCP server marks its write and destructive tools and has a read-only validation mode, but the API has no read-only key or confirmation step for deleting a blocklist or alert (10 of 20). IP context returns raw HTTP paths, user agents and payloads sent by scanners, and GNQL returns the same at scale; no prompt-injection guidance was found in the docs, the MCP server page or its SECURITY.md (3 of 15). The workspace page shows weekly search usage and the MCP security page says to watch the dashboard for unexpected usage; no per-call log or key activity record was found (5 of 15). SOC 2 Type II announced on 8 June 2023, security@greynoise.io named in the MCP server's SECURITY.md, but security.txt returns 404, the trust centre at greynoise.hypercomply.io renders by script and was not read, and no bug bounty or disclosure policy was found (10 of 20). 12 + 10 + 3 + 5 + 10 = 40.

Censys 64

A closed service under terms effective 1 October 2018 that are clear on who may use the data for what, with MIT SDKs and an Apache-2.0 CLI (15 of 30). Privacy policy of 1 April 2025 keeps data 'for as long as necessary' with no periods, while the retention policy revised 11 July 2023 gives seven days for queries before anonymisation and up to three years for ASM seed data after an account expires, and still names the retired Censys Search. Two GDPR representatives are named. No public DPA found, and the privacy page's mailto points to censys.io while its text says censys.com (16 of 30). The transition guide gives the Legacy Search API no sunset date, the Accept header allows schema versions but no lifecycle is published, and credit packs were discontinued on 2 November with no notice period stated (5 of 20). Hosted in the United States, Stripe and Google named, unnamed analytics, advertising and session replay vendors, no subprocessor list (8 of 20). 15 + 16 + 5 + 8 = 44.

GreyNoise 76

Closed service under an EULA last modified 7 May 2025 that is clear on scope, with the MCP server and SDK under MIT (15 of 30). Privacy policy of 3 September 2026 with retention periods (threat data indefinitely, backups 14 days, logs about 30 days, account data until deletion is requested), named subprocessors and standard contractual clauses for transfers; no DPA named, and the page as served repeats its sections twice with small differences, such as whether Cloudflare is a subprocessor (20 of 30). The migration matrix dates v2's deprecation (28 July 2025), end of life (1 January 2026) and decommission (30 April 2026) and marks five v3 endpoints deprecated, while the EULA lets GreyNoise discontinue any product at any time with 10 days' notice of EULA changes (15 of 20). Amazon Web Services, Snowflake, Auth0, Stripe, Stigg, Datadog, Webflow, Google, HubSpot and Cloudflare named, with hosting in the United States (15 of 20). 15 + 20 + 15 + 15 = 65.

Censys 84

Newest changelog entry 2 November 2026 and censys-platform 0.16.7 on 29 October (30). Ten dated changelog entries between 8 September and 2 November and eight PyPI releases since 4 August (20). A closed service with a weekly changelog, a Gainsight community forum with Platform Q and A sections, an in-app feedback portal and support@censys.com. GitHub issue replies weren't read (12 of 15). Official SDKs in three languages regenerated from the spec, the Go and TypeScript repositories pushed on 3 November and PyPI on 29 October (15). The SDKs are 0.x and generated, with a stated grace period for dropping Python versions. CI wasn't read (7 of 10). 30 + 20 + 12 + 15 + 7 = 84.

GreyNoise 75

Read for a closed service with an open-source MCP server and SDK. MCP server v0.5.5 tagged 9 October 2026, 25 days before the check, and product updates on 31 August 2026 (30). In the 90 days to 3 November, dated entries are the Visualizer post of 17 August, the CrowdStrike post of 31 August and the MCP release of 9 October; the Python SDK's last tag is v3.1.0 of 9 July (12 of 20). The MCP repository merged pull request 18 from an outside account on 9 October and has commits from two outside contributors; issues could not be read on github.com; Slack and Discord communities and support@greynoise.io (15 of 25). The official MCP server is not in the official MCP registry, where three third-party servers are; the Python SDK is current (10 of 15). CI runs typecheck, tests, a build, npm audit and an MCPB pack, with a live read-only validation against the API, and releases publish from tags with npm provenance; the SDK repository has only a Slack notice workflow (8 of 10). 30 + 12 + 15 + 10 + 8 = 75.