Server data from the Official MCP Registry
Regulations.gov rulemaking dockets, documents, public comments, and comment periods. 8 tools.
About
Regulations.gov rulemaking dockets, documents, public comments, and comment periods. 8 tools.
Security Report
This is a well-structured suite of federal contracting MCP servers with solid security practices. Authentication is properly scoped via API keys (BLS, SAM.gov, api.data.gov), and code quality is high with comprehensive input validation and error handling. Rate limiting is implemented to prevent abuse. However, minor concerns around environment variable handling and broad exception catching in some areas prevent a higher score. Supply chain analysis found 7 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue (1 critical, 0 high severity).
4 files analyzed · 13 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
Unverified package source
We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.
What You'll Need
Set these up before or after installing:
Environment variable: REGULATIONS_GOV_API_KEY
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"com-1102tools-regulations-gov-mcp": {
"env": {
"REGULATIONS_GOV_API_KEY": "your-regulations-gov-api-key-here"
},
"args": [
"acquisition-gov-mcp"
],
"command": "uvx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
federal-contracting-mcps
Free and open source MCP servers for federal contracting data and policy tracking. SAM.gov, USASpending, GSA CALC+, BLS OEWS, per diem, eCFR, Federal Register, Regulations.gov, and Acquisition.gov are exposed through deterministic tool calls.
Your assistant queries the real APIs instead of recalling what it thinks the FAR says. Same input, same output, every time.
Website: 1102tools.com
Most users should start with an agent
The packaged 1102tools agents already include the source connections required by each guided job. The beginner-facing Agent Setup Guide covers Codex and Claude Code.
Use this repository when you specifically want standalone source servers or custom MCP configurations. Follow each selected server's README and testing record; standalone setup is advanced and self-supported. The MCP-oriented request library remains available as a repository, not a maintained PDF product.

Safety release v1.0.9 (August 2026)
Every package enforces a provisional, cross-process anti-burst gate
before every upstream request. SAM.gov, BLS OEWS, USASpending, GSA CALC+,
eCFR, Federal Register, and Acquisition.gov default to one request every 3 seconds. GSA Per
Diem and Regulations.gov default to 4 seconds and share one api.data.gov
bucket when they use the same key.
This is a 1102tools safety safeguard, not a statement that every provider
requires that exact interval. It protects independently launched MCP and agent
processes on the same computer, honors Retry-After without automatically
retrying, and never writes a raw credential to pacing state. It cannot
coordinate the same key running on another computer or create additional
daily quota.
Set FEDERAL_API_MIN_INTERVAL_SECONDS to a different finite, non-negative
number when you have a documented reason. Setting it to 0 deliberately
disables the local gate. FEDERAL_API_PACING_DIR overrides the per-user state
directory for managed or temporary environments.
The release also makes PyPI publication depend on the complete offline test matrix and wheel inspection. Current package versions are listed in each server's changelog and README.
1.0.0 stable baseline (August 2026)
The original eight servers first reached 1.0.0 together. That was the first stable
suite release and the largest update since launch. Acquisition.gov joined at 1.0.0 with the same safety contract. Packages now version
independently so a correction to one server does not force no-op releases of
the others.
Rebuilt on v2 of the MCP Python SDK
The MCP Python SDK, the library every one of these servers is built on, released version 2.0 in July. It renamed its high-level server class from FastMCP to MCPServer and removed the old module entirely. Every server uses it.
The original eight retain the same 124 tools, parameters, and responses. Acquisition.gov adds five source-specific tools, bringing the catalog to 129. The dependency is bounded at mcp>=2.0.0,<3, so the next major SDK release produces a clean error at install time instead of a crash at startup.
Two problems this release fixes, and both were affecting people
BLS wage lookups were returning empty results. When BLS published its May 2025 OEWS estimates this spring, it withdrew the 2024 series. bls-oews-mcp still defaulted to 2024, so any wage query that did not pass an explicit year came back with no values, which is indistinguishable from a privacy-suppressed cell. There was no error and no warning. The default is now 2025, and detect_latest_year() will confirm the current year at any time.
If you pulled wage figures for an IGCE between roughly April and August 2026, re-check them.
Fresh installs were failing outright. Every 0.x package declared mcp>=1.0.0 with no upper limit. When SDK 2.0.0 published on July 28, new installs resolved to it and died immediately with ModuleNotFoundError: No module named 'mcp.server.fastmcp'. Existing installs were unaffected, but anyone installing for the first time in that window hit a wall. Bounding the requirement fixes it permanently.
Apologies to anyone who lost time to either one.
Claude Desktop .mcpb bundles are discontinued
The double-click bundles are gone. They could not be signed in a way Claude Desktop recognizes, so every install showed an untrusted-developer prompt with no way to clear it, and the bundle re-resolved its dependencies on every launch rather than pinning them, which made it the install path most exposed to the failure above. The config block in Install does the same job with fewer moving parts. Existing bundle installs keep working until removed, but will not receive updates.
Verified before shipping
The original eight recorded 5,078 collected regression tests during the v1.0.9 safety validation. Acquisition.gov adds 21 collected tests: 20 deterministic checks pass and one serialized live gate remains opt-in. Its 2026-08-22 release check passed against the index, one model part, one indexed agency PDF, and the FAQ. Per-server detail is in each testing.md and changelog.md.
Server catalog
All source lives under servers/<name>/. Each server is self-contained: code, tests, per-server README with a copy-paste config block.
Procurement data
- sam-gov-mcp: SAM.gov entity registration, exclusions, opportunities, contract awards (FPDS replacement), federal hierarchy, FFATA subawards
- usaspending-gov-mcp: federal contract, award, FFATA subaward, recipient, agency, and Treasury federal account data
- gsa-calc-mcp: GSA CALC+ awarded NTE hourly rates from MAS contracts (230K+ records)
- bls-oews-mcp: BLS OEWS market wage data across ~830 occupations and 530+ metros
- gsa-perdiem-mcp: federal travel lodging and M&IE rates for all CONUS
Regulatory and policy tracking
- ecfr-mcp: current CFR text updated daily, FAR / DFARS / agency supplement lookups
- federal-register-mcp: proposed rules, final rules, notices, executive orders, FAR cases
- regulations-gov-mcp: federal rulemaking dockets, public comments, comment period tracking
- acquisition-gov-mcp: RFO model-part pages, the official posted agency-deviation index, indexed deviation PDFs, and approved RFO guidance
Combined: 129 deterministic tool calls and 5,099 collected package tests. The Acquisition.gov live source gate passed on 2026-08-22; future releases must repeat it because upstream content and availability can change.
Install
Requires Python 3.10+ and uv. MCP is an open standard, but standalone client setup is outside the beginner support path. Use the exact configuration and current evidence in the selected server directory.
1. Register the free API keys you need. BLS, api.data.gov (covers Per Diem and Regulations.gov), SAM.gov. USASpending, GSA CALC+, eCFR, Federal Register, and Acquisition.gov need no key.
2. Add the servers you want to your client config. Configuration surfaces differ by client. Use the selected server's README as the source of truth, verify the server starts, and confirm its tools are actually visible before relying on it.
{
"mcpServers": {
"ecfr": {
"command": "uvx",
"args": ["--refresh-package", "ecfr-mcp", "--from", "ecfr-mcp", "ecfr-mcp"]
},
"sam-gov": {
"command": "uvx",
"args": ["--refresh-package", "sam-gov-mcp", "--from", "sam-gov-mcp", "sam-gov-mcp"],
"env": { "SAM_API_KEY": "your-key-here" }
}
}
}
The --refresh-package flag tells uv to check PyPI for a newer release each time your client launches the server, so fixes and new tools arrive automatically. Without it, uv keeps serving whatever version it first cached. It adds a moment of network time at startup; if your platform enforces a short MCP startup timeout, raise it (the setup guide covers this per platform).
3. Restart the client. Each server's README has its own block with the correct package name and environment variable.
Docker images and a Smithery config ship with each server for hosted or containerized setups.
If you are pinned to mcp 1.x and cannot move, stay on the 0.x line of each package.
Repo layout
federal-contracting-mcps/
├── servers/
│ ├── bls-oews-mcp/
│ ├── acquisition-gov-mcp/
│ ├── ecfr-mcp/
│ ├── federal-register-mcp/
│ ├── gsa-calc-mcp/
│ ├── gsa-perdiem-mcp/
│ ├── regulations-gov-mcp/
│ ├── sam-gov-mcp/
│ └── usaspending-gov-mcp/
├── license
└── readme.md
Each server directory ships its own pyproject.toml, source, regression tests, Dockerfile, and testing record.
Companion repo
federal-contracting-skills: portable skills that orchestrate these MCPs into acquisition deliverables and evidence workflows, including SOW/PWS, three IGCE methods, OT scope and cost, market research, GovCon growth, and acquisition policy.
MCPs handle data. Skills handle deliverables.
Why MCPs (and not skills for the API calls)
- Deterministic. MCP servers execute tested Python. Claude does not generate API-call code on the fly. Same input, same output.
- Low context cost. Tool schemas are ~100 tokens each. The deprecated API-data skills cost 500-1000 lines of context per run.
- Production-hardened. Each MCP went through 3-6 audit rounds with live testing against its production API.
- Portable protocol. MCP is an open standard, so the same source server can be configured in multiple compatible clients. Current support claims remain bounded by each server's testing record.
Website
License
MIT
Author
Built by James Jenrette, lead systems analyst and contracting officer. Independently developed and not endorsed by any federal agency.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
