federal-contracting-mcpsCAUTION
mcp/1102tools-dev/federal-contracting-mcps
Free, open-source MCP servers for federal contracting: SAM.gov, USAspending, GSA CALC+, eCFR, Federal Register, and more. 5,571 collected regression tests. In the Claude and ChatGPT directories.
Verdict
CAUTION
Grade
F
Trust score
56 /100
Exposed tools
126 125r · 1w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
23
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://1102tools.com/#why) [](license) [](#why-these-mcps)
[](#local-or-hosted) [
claude mcp add acquisition-gov-mcp -- None acquisition-gov-mcp==1.0.8
03
Exposed tools (126)
125 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
autocomplete_awarding_agency | read | Find awarding agency names by partial match. |
autocomplete_cfda | read | Find CFDA (Catalog of Federal Domestic Assistance) program numbers |
autocomplete_funding_agency | read | Find funding agency names by partial match (companion to awarding agency). |
autocomplete_glossary | read | Find glossary terms (acquisition + spending vocabulary) by partial match. |
autocomplete_naics | read | Autocomplete lookup for NAICS codes. |
autocomplete_psc | read | Autocomplete lookup for Product/Service Codes (PSC). |
autocomplete_recipient | read | Find recipient names by partial name or UEI/DUNS. |
awards_last_updated | read | Get the timestamp of the last USASpending award data refresh. |
check_exclusion_by_uei | read | Check if an entity has any exclusion/debarment records by UEI. |
compare_locations | read | Compare per diem rates across multiple locations. |
compare_metros | read | Compare wages for one occupation across multiple metro areas. |
compare_occupations | read | Compare wages across multiple occupations in one location. |
compare_versions | read | Compare the text of a CFR section at two different dates. |
detect_latest_year | read | Report the OEWS data year this server answers from. |
estimate_travel_cost | read | Estimate total per diem cost for a trip. |
exact_search | read | Exact match search on a specific field. |
far_case_history | read | Get all Federal Register documents for a FAR/DFARS case or FAC. |
filtered_browse | read | Browse rates with filters only (no search keyword). |
find_far_definition | read | Search for a term |
find_recent_changes | read | Find CFR sections that have been modified since a given date. |
get_access_status | read | Check Regulations.gov credential presence without returning or validating it. |
get_agency_awards | read | Get award summary totals for an agency in a given fiscal year. |
get_agency_budgetary_resources | read | Get an agency |
get_agency_federal_accounts | read | List the Treasury Account Symbols (federal accounts) used by an agency. |
get_agency_object_classes | read | List the object class breakdown (what an agency spends money on). |
get_agency_obligations_by_award_category | read | Get an agency |
get_agency_overview | read | Get summary information for a specific agency in a given fiscal year. |
get_agency_program_activities | read | List the program activities (specific programs) within an agency. |
get_agency_sub_agencies | read | List the subordinate (subtier) organizations of a toptier agency. |
get_ancestry | read | Get the breadcrumb hierarchy path for a section, part, or appendix. |
get_award_count | read | Count awards matching filters, broken down by award category. |
get_award_detail | read | Fetch full details for a single award by its generated_internal_id. |
get_award_federal_account_count | read | Count of distinct federal accounts (TAS) funding an award. |
get_award_funding | read | Fetch File C funding data for an award: federal account, object class, program activity. |
get_award_funding_rollup | read | Get a rollup of an award |
get_award_subaward_count | read | Count of subawards (FFATA subcontracts/subawards) reported on an award. |
get_award_transaction_count | read | Count of transactions (modifications) on an award. |
get_award_types_reference | read | Return the full mapping of award type codes to descriptions. |
get_cfr_content | read | Get the full text of a CFR section, subpart, part, or appendix. |
get_cfr_structure | read | Get the hierarchical table of contents for a CFR title or subset. |
get_comment_detail | read | Get full details for a single comment. |
get_corrections | read | Get editorial corrections for a CFR title. |
get_data_status | read | Report the date of the SAM.gov file behind every answer, when it was loaded, how many active notices it holds by type, and what changed in the last nightly load. Use it to judge how current results are. |
get_def_codes_reference | read | Return all Disaster Emergency Fund (DEFC) codes with public laws. |
get_docket_detail | read | Get full details for a single docket. |
get_document | read | Get full details for a single Federal Register document by number. |
get_document_detail | read | Get full details for a single Regulations.gov document. |
get_documents_batch | read | Fetch multiple documents in one call (up to ~20). |
get_entity_integrity_info | read | Fetch FAPIIS proceedings integrity information for an entity by UEI. |
get_entity_reps_and_certs | read | Fetch FAR/DFARS representations and certifications for an entity by UEI. |
get_facet_counts | read | Get document counts grouped by type, agency, topic, or time period. |
get_federal_account_detail | read | Get an individual federal account |
get_federal_account_fy_snapshot | read | Get a single-fiscal-year snapshot of a federal account |
get_federal_account_object_classes | read | Get the object class breakdown of obligations for a federal account. |
get_federal_account_program_activities | read | Get the program activities funded under a federal account. |
get_glossary | read | Get the full USASpending glossary of acquisition + spending terms. |
get_idv_activity | read | List child task/delivery orders awarded under an IDV. |
get_idv_amounts | read | Top-line amounts for an Indefinite Delivery Vehicle (IDV). |
get_idv_children | read | Fetch child awards (task/delivery orders) under an IDV. |
get_idv_funding | read | List the funding records (File C) for an IDV |
get_idv_funding_rollup | read | Funding rollup totals for an IDV (single dict, not paginated). |
get_latest_date | read | Get the most recent available date for a CFR title. |
get_mie_breakdown | read | Get the M&IE (meals and incidental expenses) tier breakdown table. |
get_naics_details | read | Get details for a NAICS code (2-6 digits). |
get_opportunity_description | read | Fetch the full description text for a contract opportunity by notice ID. |
get_organization_hierarchy | read | Get the immediate child organizations of a federal organization. |
get_psc_filter_tree | read | Get the PSC hierarchy tree. |
get_public_inspection | read | Get current public inspection documents (pre-publication). |
get_recipient_children | read | Get the child recipients (subsidiaries) of a parent recipient. |
get_recipient_profile | read | Get full profile for a recipient by their USASpending hash. |
get_rfo_agency_deviation | read | Resolve an indexed source ID and return page-numbered official PDF text. |
get_rfo_guidance | read | Return an allowlisted Acquisition.gov RFO FAQ or guidance resource. |
get_rfo_part | read | Return parsed, paginated model-deviation text for one FAR part. |
get_state_profile | read | Get spending profile for a US state by its 2-digit FIPS code. |
get_submission_periods | read | Return the list of agency submission periods (when each agency last |
get_transactions | read | Fetch the full transaction (modification) history for an award. |
get_version_history | read | Get the version history of a CFR section, subpart, or part. |
get_wage_data | read | Get wage data for an occupation by SOC code. |
igce_benchmark | read | Get ceiling rate benchmarks for IGCE development. |
igce_wage_benchmark | read | Get wage benchmarks formatted for IGCE development. |
keyword_search | read | Search GSA CALC+ ceiling rates by keyword. |
list_agencies | read | List all agencies with their CFR title and chapter references. |
list_common_metros | read | List common metro area MSA codes for wage lookups. |
list_common_soc_codes | read | List common SOC code mappings for federal IT and professional services. |
list_federal_accounts | read | List Treasury federal accounts (TAS) with budgetary resources. |
list_rfo_agency_deviations | read | List official agency-deviation links discovered through the RFO index. |
list_rfo_parts | read | List official RFO model parts and counts of posted agency deviations. |
list_sections_in_part | read | List all sections in a FAR/DFARS part with their headings. |
list_states | read | List all states with their FIPS codes and award totals. |
list_toptier_agencies | read | List all top-tier federal agencies tracked by USASpending. |
lookup_award_by_piid | read | Look up contract award modifications for a single PIID. |
lookup_city_perdiem | read | Look up federal per diem rates for a city and state. |
lookup_entity_by_cage | read | Look up a federal entity by its CAGE code. |
lookup_entity_by_uei | read | Look up a federal entity by its Unique Entity ID (UEI). |
lookup_far_clause | read | Convenience tool: look up the current text of a FAR or DFARS clause. |
lookup_piid | read | Look up awards by PIID or PIID prefix with automatic award-type detection. |
lookup_psc_code | read | Look up a Product/Service Code (PSC) by its code value. |
lookup_state_rates | read | Get all Non-Standard Area (NSA) per diem rates for a state. |
lookup_zip_perdiem | read | Look up federal per diem rates by ZIP code. |
new_awards_over_time | read | Pipeline trend of new awards to a recipient over time. |
open_comment_periods | read | Find documents with currently open comment periods, soonest deadline first. |
price_reasonableness_check | read | Evaluate a proposed hourly rate against GSA ceiling rate distribution. |
search_acquisition_subawards | read | Search FFATA subcontract reports (acquisition subawards). |
search_assistance_subawards | read | Search FFATA grant subaward reports (financial assistance subawards). |
search_awards | read | Search federal awards (contracts, IDVs, grants, loans, etc.) on USASpending.gov. |
search_cfr | read | Full-text search across the Code of Federal Regulations. |
search_comments | read | Search public comments on Regulations.gov. |
search_contract_awards | read | Search contract award records on SAM.gov (FPDS replacement). |
search_deleted_awards | read | Search contract award records that have been deleted from FPDS/SAM.gov. |
search_dockets | read | Search Regulations.gov dockets. |
search_documents | read | Search Federal Register documents. |
search_entities | read | Search SAM.gov entities with flexible filters. |
search_exclusions | read | Search SAM.gov exclusion records with flexible filters. |
search_federal_organizations | read | Search the SAM.gov Federal Hierarchy. |
search_opportunities | read | Search contract opportunities on SAM.gov. |
search_psc_free_text | read | Free-text search for Product/Service Codes (PSC). |
search_recipients | read | Search USASpending recipients (vendors and grantees) by keyword. |
search_subawards | read | Search FFATA subaward reports on USASpending. |
spending_by_category | read | Aggregate spending by a dimension (top vendors, top agencies, top NAICS, etc.). |
spending_by_geography | read | Geographic breakdown of spending. |
spending_by_subaward_grouped | write | Search subawards using the standard filters object (grouped result set). |
spending_by_transaction | read | Search at the transaction (modification) level. |
spending_over_time | read | Aggregate spending amounts over time, grouped by fiscal year, quarter, or month. |
suggest_contains | read | Discover exact field values via autocomplete/contains matching. |
vendor_rate_card | read | Get ceiling rates for a specific vendor, one page at a time. |
vendor_responsibility_check | read | Composite pre-award vendor responsibility check per FAR 9.104-1. |
04
Trust audit
CAUTIONgrade F · trust 56/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (14 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
MEDIUMInventory / provenance · inv.binary · CWE-1104
servers/gsa-perdiem-mcp/src/gsa_perdiem_mcp/data/fy2021.json.gz
fy2021.json.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
servers/gsa-perdiem-mcp/src/gsa_perdiem_mcp/data/fy2022.json.gz
fy2022.json.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
servers/gsa-perdiem-mcp/src/gsa_perdiem_mcp/data/fy2023.json.gz
fy2023.json.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
servers/gsa-perdiem-mcp/src/gsa_perdiem_mcp/data/fy2024.json.gz
fy2024.json.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/dell/cloudflared-config.yml:7
service: http://127.0.0.1:8790
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/dell/cloudflared-config.yml:9
service: http://127.0.0.1:8790
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/dell/cloudflared-config.yml:11
service: http://127.0.0.1:8790
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/dell/cloudflared-config.yml:13
service: http://127.0.0.1:8790
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/dell/cloudflared-config.yml:15
service: http://127.0.0.1:8790
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
servers/gsa-perdiem-mcp/tests/test_access_status.py:40
secret = "perdiem-secret-value"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
servers/gsa-perdiem-mcp/tests/test_access_status.py:49
secret = "publisher-secret-value"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
servers/gsa-perdiem-mcp/tests/test_credential_redaction.py:19
SECRET = "rc5-perdiem-secret/value"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
servers/regulations-gov-mcp/tests/test_access_status.py:36
secret = "regulations-secret-value"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
servers/regulations-gov-mcp/tests/test_access_status.py:66
secret = "regulations-secret-value"
LOWInventory / provenance · inv.binary · CWE-1104
servers/acquisition-gov-mcp/tests/fixtures/rfo-part-52-2026-09-13.html.gz
rfo-part-52-2026-09-13.html.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
deploy/gsa-calc/tests/hourly-budget.test.mjs:8
sql: { exec(query, ...params) {Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
servers/sam-gov-mcp/tests/live_audit/paced_probe.py:134
return hashlib.md5(
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
deploy/acquisition-gov/src/rpc.ts:3
import SERVER from "../../../servers/acquisition-gov-mcp/server.json" with {type: "json"};LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
deploy/acquisition-gov/src/worker.ts:1
import {MAX_BODY_BYTES, listenAtEdge, readBounded, tooLarge, withinLimit} from "../../shared/edge.ts";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
deploy/acquisition-gov/test/worker.test.ts:25
const ROOT = fileURLToPath(new URL("../../../", import.meta.url));LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
deploy/acquisition-gov/test/worker.test.ts:27
const SERVER = JSON.parse(read("../../../servers/acquisition-gov-mcp/server.json"));LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
deploy/bls-oews/src/rpc.ts:3
import SERVER from "../../../servers/bls-oews-mcp/server.json" with {type: "json"};LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
servers/acquisition-gov-mcp/tests/test_boundaries.py:17
'https://169.254.169.254/latest/meta-data','https://www.acquisition.gov.evil.test/',
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
servers/acquisition-gov-mcp/tests/test_boundaries.py:60
calls=[];locations=['/safe','https://169.254.169.254/']
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
servers/acquisition-gov-mcp/tests/test_per_tool.py:56
return httpx.Response(302,headers={'Location':'https://169.254.169.254/'})Why it matters. cloud metadata endpoint: the classic SSRF credential grab
Gates applied: no_behavioural_pass.
Audited 2026-10-09 · audit v0.4.1 · source sha
a9d984b77cadfull audit observations/trust-audit/mcp-server/1102tools-dev__federal-contracting-mcps.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | a9d984b77cad | CAUTION | F | 56 | first audit |
06
Questions
What is the federal-contracting-mcps MCP server?
Free, open-source MCP servers for federal contracting: SAM.gov, USAspending, GSA CALC+, eCFR, Federal Register, and more. 5,571 collected regression tests. In the Claude and ChatGPT directories.
What tools does federal-contracting-mcps expose?
126 in total: 125 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is federal-contracting-mcps safe to connect to an agent?
With care. The audit graded it F (56/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does federal-contracting-mcps need?
It reads BLS_API_KEY, CLOUDFLARE_API_TOKEN, CLOUDFLARE_D1_TOKEN, PERDIEM_API_KEY, REGULATIONS_GOV_API_KEY, SAM_API_KEY and SAM_AUDIT_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does federal-contracting-mcps run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as 1102tools-usaspending-remote at 1.0.8.
How current is this page?
The grade is for one exact copy of the source (a9d984b77cad), read on 2026-10-09. The repository is watched and re-audited when it changes.