federal-contracting-mcps

# federal-contracting-mcps

Free and open source MCP servers for federal contracting data and policy tracking. SAM.gov, USASpending, GSA CALC+, BLS OEWS, per diem, eCFR, Federal Register, Regulations.gov, and Acquisition.gov are exposed through deterministic tool calls.

Your assistant queries the real APIs instead of recalling what it thinks the FAR says. Same input, same output, every time.

Website: [1102tools.com](https://1102tools.com)

## Most users should start with an agent

The packaged [1102tools agents](https://github.com/1102tools-dev/federal-contracting-agents) include the source integrations required by each guided job. Some federal providers still require a free account or API key. The beginner-facing [HTML setup instructions](https://1102tools.com/setup) and [downloadable Agent Setup Guide](https://1102tools.com/downloads/1102tools-agent-setup-guide.pdf) cover Codex and Claude Code.

Use this repository when you specifically want standalone source servers or custom MCP configurations. Follow each selected server's README and testing record; standalone setup is advanced and self-supported. The MCP-oriented [request library](https://github.com/1102tools-dev/federal-contracting-prompts) remains available as a repository, not a maintained PDF product.

![Architecture diagram showing how a question travels from an AI client to a local MCP server and an official federal source. Regulatory and rulemaking coverage now includes eCFR, Federal Register, Regulations.gov, and Acquisition.gov.](docs/architecture.png)

---

## Credential-readiness correction (August 2026)

SAM.gov `1.0.11`, BLS OEWS `1.0.8`, GSA Per Diem `1.0.8`, and Regulations.gov `1.0.7` expose the same read-only `get_access_status` tool. It checks credential presence locally and never displays, transmits, logs, or validates the value.

| Server | No user key | Reported status |
|---|---|---|
| SAM.gov | SAM operations cannot run without `SAM_API_KEY` | `missing_required` |
| BLS OEWS | v1 fallback: 25 requests/day and 10 years/query | `limited_fallback` |
| GSA Per Diem | Shared `DEMO_KEY`: approximately 10 requests/hour | `limited_fallback` |
| Regulations.gov | Shared `DEMO_KEY`: approximately 10 requests/hour | `limited_fallback` |

Expected missing, rejected, authorization, rate-limit, network, malformed-response, and sanitized upstream failures return actionable MCP `ToolError` messages. A missing key is never retried or described as a provider outage. Configure credentials outside chat, restart the client, and rerun `get_access_status`.

- SAM.gov setup: [SAM.gov Help](https://sam.gov/help)
- BLS setup: [BLS registration](https://data.bls.gov/registrationEngine/)
- Per Diem and Regulations.gov setup: [api.data.gov signup](https://api.data.gov/signup/)

## Safety release v1.0.9 (August 2026)

Every package enforces a provisional, cross-process anti-burst gate
before every upstream request. SAM.gov, BLS OEWS, USASpending, GSA CALC+,
eCFR, Federal Register, and Acquisition.gov default to one request every 3 seconds. GSA Per
Diem and Regulations.gov default to 4 seconds and share one `api.data.gov`
bucket when they use the same key.

This is a 1102tools safety safeguard, not a statement that every provider
requires that exact interval. It protects independently launched MCP and agent
processes on the same computer, honors `Retry-After` without automatically
retrying, and never writes a raw credential to pacing state. It cannot
coordinate the same key running on another computer or create additional
daily quota.

Set `FEDERAL_API_MIN_INTERVAL_SECONDS` to a different finite, non-negative
number when you have a documented reason. Setting it to `0` deliberately
disables the local gate. `FEDERAL_API_PACING_DIR` overrides the per-user state
directory for managed or temporary environments.

The release also makes PyPI publication depend on the complete offline test
matrix and wheel inspection. Current package versions are listed in each
server's changelog and README.

## 1.0.0 stable baseline (August 2026)

**The original eight servers first reached 1.0.0 together.** That was the first stable
suite release and the largest update since launch. Acquisition.gov joined at `1.0.0` with the same safety contract. Packages now version
independently so a correction to one server does not force no-op releases of
the others.

### Rebuilt on v2 of the MCP Python SDK

The MCP Python SDK, the library every one of these servers is built on, released version 2.0 in July. It renamed its high-level server class from `FastMCP` to `MCPServer` and removed the old module entirely. Every server uses it.

The original eight retained the same 124 data tools at the stable baseline. Acquisition.gov added five source-specific tools, bringing that baseline to 129. Four later local readiness tools bring the current catalog to 133. The dependency is bounded at `mcp>=2.0.0,<3`, so the next major SDK release produces a clean error at install time instead of a crash at startup.

### Two problems this release fixes, and both were affecting people

**BLS wage lookups were returning empty results.** When BLS published its May 2025 OEWS estimates this spring, it withdrew the 2024 series. `bls-oews-mcp` still defaulted to 2024, so any wage query that did not pass an explicit year came back with no values, which is indistinguishable from a privacy-suppressed cell. There was no error and no warning. The default is now 2025, and `detect_latest_year()` will confirm the current year at any time.

If you pulled wage figures for an IGCE between roughly April and August 2026, re-check them.

**Fresh installs were failing outright.** Every 0.x package declared `mcp>=1.0.0` with no upper limit. When SDK 2.0.0 published on July 28, new installs resolved to it and died immediately with `ModuleNotFoundError: No module named 'mcp.server.fastmcp'`. Existing installs were unaffected, but anyone installing for the first time in that window hit a wall. Bounding the requirement fixes it permanently.

Apologies to anyone who lost time to either one.

### Claude Desktop `.mcpb` bundles are discontinued

The double-click bundles are gone. They could not be signed in a way Claude Desktop recognizes, so every install showed an untrusted-developer prompt with no way to clear it, and the bundle re-resolved its dependencies on every launch rather than pinning them, which made it the install path most exposed to the failure above. The config block in [Install](#install) does the same job with fewer moving parts. Existing bundle installs keep working until removed, but will not receive updates.

### Verified before shipping

The original eight recorded 5,078 collected regression tests during the v1.0.9 safety validation. Acquisition.gov adds 21 collected tests: 20 deterministic checks pass and one serialized live gate remains opt-in. Its 2026-08-22 release check passed against the index, one model part, one indexed agency PDF, and the FAQ. Per-server detail is in each `testing.md` and `changelog.md`.

---

## Server catalog

All source lives under `servers/<name>/`. Each server is self-contained: code, tests, per-server README with a copy-paste config block.

**Procurement data**
- [sam-gov-mcp](servers/sam-gov-mcp): SAM.gov entity registration, exclusions, opportunities, contract awards (FPDS replacement), federal hierarchy, FFATA subawards
- [usaspending-gov-mcp](servers/usaspending-gov-mcp): federal contract, award, FFATA subaward, recipient, agency, and Treasury federal account data
- [gsa-calc-mcp](servers/gsa-calc-mcp): GSA CALC+ awarded NTE hourly rates from MAS contracts (230K+ records)
- [bls-oews-mcp](servers/bls-oews-mcp): BLS OEWS market wage data across ~830 occupations and 530+ metros
- [gsa-perdiem-mcp](servers/gsa-perdiem-mcp): federal travel lodging and M&IE rates for all CONUS

**Regulatory and policy tracking**
- [ecfr-mcp](servers/ecfr-mcp): current CFR text updated daily, FAR / DFARS / agency supplement lookups
- [federal-register-mcp](servers/federal-register-mcp): proposed rules, final rules, notices, executive orders, FAR cases
- [regulations-gov-mcp](servers/regulations-gov-mcp): federal rulemaking dockets, public comments, comment period tracking
- [acquisition-gov-mcp](servers/acquisition-gov-mcp): RFO model-part pages, the official posted agency-deviation index, indexed deviation PDFs, and approved RFO guidance

Combined: 133 deterministic tools. The Acquisition.gov live source gate passed on 2026-08-22; future releases must repeat it because upstream content and availability can change.

## Install

Requires Python 3.10+ and [uv](https://docs.astral.sh/uv/). MCP is an open standard, but standalone client setup is outside the beginner support path. Use the exact configuration and current evidence in the selected server directory.

**1. Register the free API keys you need.** [BLS](https://data.bls.gov/registrationEngine/), [api.data.gov](https://api.data.gov/signup/) (covers Per Diem and Regulations.gov), and [SAM.gov Help](https://sam.gov/help). USASpending, GSA CALC+, eCFR, Federal Register, and Acquisition.gov need no key. Never paste a key into chat.

**2. Add the servers you want to your client config.** Configuration surfaces differ by client. Use the selected server's README as the source of truth, verify the server starts, and confirm its tools are actually visible before relying on it.

```json
{
  "mcpServers": {
    "ecfr": {
      "command": "uvx",
      "args": ["--refresh-package", "ecfr-mcp", "--from", "ecfr-mcp", "ecfr-mcp"]
    },
    "sam-gov": {
      "command": "uvx",
      "args": ["--refresh-package", "sam-gov-mcp", "--from", "sam-gov-mcp", "sam-gov-mcp"],
      "env": { "SAM_API_KEY": "your-key-here" }
    }
  }
}
```

The `--refresh-package` flag tells uv to check PyPI for a newer release each time your client launches the server, so fixes and new tools arrive automatically. Without it, uv keeps serving whatever version it first cached. It adds a moment of ne