Server data from the Official MCP Registry
Look up, search, and track changes to the US Code of Federal Regulations (eCFR).
About
Look up, search, and track changes to the US Code of Federal Regulations (eCFR).
Security Report
This is a well-designed MCP server for retrieving public CFR regulation text with excellent input validation, proper error handling, and appropriate permission scoping. The server has no authentication requirements (which is correct for public APIs), implements smart caching to respect API resources, and carefully caps output to manage context budgets. Minor code quality observations exist but do not constitute security vulnerabilities. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.
5 files analyzed · 7 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-mccallar-cfr-mcp": {
"args": [
"cfr-mcp"
],
"command": "uvx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
cfr-mcp
An MCP server that gives AI assistants access to the US Code of Federal Regulations.
Ask "what does 21 CFR 101.9 require?" or "has 40 CFR 261 changed since 2023?" and get the actual regulation text, with citations, instead of a plausible-sounding guess.
Unofficial community project. Not affiliated with or endorsed by the Office of the Federal Register, NARA, or GPO, and uses no government seals or logos.
Maintained by one person as a personal project and provided as-is (MIT). Issues and pull requests are welcome but may not get a quick response. To report a security issue, see SECURITY.md.
Install
Requires Python 3.11+. No API key — the eCFR and Federal Register APIs are open.
Claude Code:
claude mcp add cfr -- uvx cfr-mcp
Any other MCP client:
{
"mcpServers": {
"cfr": {
"command": "uvx",
"args": ["cfr-mcp"]
}
}
}
Tools
| Tool | What it does |
|---|---|
lookup_citation | Text of a citation — 21 CFR 101.9, 40 CFR 261.4(b)(1), 40 CFR Part 261 Subpart C |
search_regulations | Full-text search; returns citations and snippets, never bodies |
where_does_term_appear | Which titles contain a term, with hit counts. Fetches no text |
browse_structure | The hierarchy of a title or part, no text |
what_changed | Amendment history for a citation, linking each change to the Federal Register rule that caused it, plus published corrections |
compare_versions | Diff of a citation's text between two dates — see exactly what an amendment changed |
list_agencies | Maps agency names to the CFR titles they administer |
Point-in-time works throughout: pass date as YYYY-MM-DD to read the CFR as it stood.
Design notes
Context budget is the whole game. The eCFR full endpoint returns an entire
downloadable XML document for a title-level request. Every tool here caps output and
degrades to an outline rather than dumping text into the model's context. Title-level
XML requests are refused outright.
Dates must be resolved, not assumed. Versioner routes 404 on dates that aren't
valid issue dates for a title, so the client resolves through titles.json first
rather than passing today's date blindly.
Caching is courtesy. The eCFR publishes no rate limit and has no key to identify
callers politely, so the client caches to disk (historical dates forever, since
point-in-time content is immutable) and self-limits concurrency. The cache lives in
~/.cache/cfr-mcp (respects XDG_CACHE_HOME); set CFR_MCP_CACHE_DIR to relocate it.
Legal
Regulation text is free to reproduce. 1 CFR 2.6 states that any person may reproduce or republish material appearing in the Federal Register, with no restrictions on what is reproduced, who reproduces it, or where. Federal government works are also outside copyright under 17 U.S.C. §105.
Incorporation by reference. Some CFR sections incorporate private standards (ASTM, NFPA, ASHRAE) whose copyright status after incorporation remains unsettled. The eCFR does not contain the text of those standards and neither does this server — it returns the citation only. Obtain standards from the issuing organization or the Office of the Federal Register reading room.
Status of the text. The eCFR is authoritative but unofficial. Anyone relying on it for legal research should verify against the current official CFR, the daily Federal Register, and the List of CFR Sections Affected (LSA).
Not legal advice. This is a retrieval tool. It returns the text of regulations; it does not tell you whether you are compliant with them.
Development
uv sync --extra dev
uv run pytest
MIT licensed.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption