eCFR
PYPI · ECFR-MCP · SCANNED SEP 20
Electronic Code of Federal Regulations including FAR, DFARS, and agency supplements. 13 tools.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 34 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 6 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability58
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2267 tokens (~174/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the eCFR MCP server?
eCFR runs locally as a PyPI package, launched with uvx ecfr-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · ecfr-mcp
claude mcp add com-1102tools-ecfr-mcp -- uvx ecfr-mcp
{
"mcpServers": {
"com-1102tools-ecfr-mcp": {
"command": "uvx",
"args": [
"ecfr-mcp"
]
}
}
} {
"servers": {
"com-1102tools-ecfr-mcp": {
"command": "uvx",
"args": [
"ecfr-mcp"
]
}
}
} codex mcp add com-1102tools-ecfr-mcp -- uvx ecfr-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-1102tools-ecfr-mcp": {
"type": "local",
"command": [
"uvx",
"ecfr-mcp"
],
"enabled": true
}
}
} openclaw mcp add com-1102tools-ecfr-mcp --command uvx --arg ecfr-mcp
mcp_servers:
com-1102tools-ecfr-mcp:
command: "uvx"
args: ["ecfr-mcp"] {
"McpServers": {
"com-1102tools-ecfr-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"ecfr-mcp"
]
}
}
} assistant mcp add com-1102tools-ecfr-mcp -t stdio -c uvx -a ecfr-mcp
{
"mcpServers": {
"com-1102tools-ecfr-mcp": {
"command": "uvx",
"args": [
"ecfr-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 13 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Package version: 1.0.6 → 1.0.10 functional
- Package version: 1.0.6 → 1.0.9 functional
- Package version: 1.0.6 → 1.0.8 functional
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/ecfr-mcp@1.0.10
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 34 packages
| Packages resolved | 34 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
compare_versions ~172
Compare the text of a CFR section at two different dates. Useful for understanding what changed in a regulatory amendment. Returns the parsed text at both dates side by side. You can then diff the paragraphs to identify specific changes. Dates must be in YYYY-MM-DD format and within the eCFR's tracking range (January 2017 to present). Both dates must not exceed the title's up_to_date_as_of value. This tool always returns the section-level XML parsed -- pass a small section_id like '15.305', not a whole part. Whole-part comparisons can exceed 100 KB per side.
| Name | Type | Req | Description |
|---|---|---|---|
| chapter | – | – | – |
| date_after | string | yes | – |
| date_before | string | yes | – |
| section_id | – | yes | – |
| title_number | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
find_far_definition ~150
Search for a term's definition in FAR 2.101 (master definition section). FAR 2.101 contains definitions used throughout the Federal Acquisition Regulation. This tool fetches the full section and searches for paragraphs containing the term, returning matching paragraphs with surrounding context. Note: FAR 2.101 is large (~109KB XML). This tool parses the full section server-side and returns only matching paragraphs. term must be at least 3 characters. max_matches caps returned matches (default 20, max 100); common terms like 'offeror' hit many paragraphs.
| Name | Type | Req | Description |
|---|---|---|---|
| date | – | – | – |
| max_matches | integer | – | – |
| term | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
find_recent_changes ~148
Find CFR sections that have been modified since a given date. Uses the search API with last_modified_on_or_after filter to find sections amended after the specified date. Returns section identifiers, headings, and excerpts, most recently amended first. since_date must be in YYYY-MM-DD format. Results are capped at 10,000 by the API. Use title/chapter/part filters to narrow if needed. Common pattern: find FAR changes since a specific date to check for regulatory updates that might affect ongoing acquisitions.
| Name | Type | Req | Description |
|---|---|---|---|
| chapter | – | – | – |
| part | – | – | – |
| per_page | integer | – | – |
| since_date | string | yes | – |
| title | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_ancestry ~106
Get the breadcrumb hierarchy path for a section, part, or appendix. Returns ancestors from title down to the target node: title > chapter > subchapter > part > subpart > section. Useful for understanding where a section sits in the CFR hierarchy and what regulation it belongs to. part/section/appendix accept int or string.
| Name | Type | Req | Description |
|---|---|---|---|
| appendix | – | – | – |
| date | – | – | – |
| part | – | – | – |
| section | – | – | – |
| title_number | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_cfr_content ~391
Get the full text of a CFR section, subpart, part, or appendix. This is the primary workhorse for reading regulatory text. Returns parsed clean text by default (heading, paragraphs, citations, plus tables and editorial_notes when present). Set raw_xml=True to get the original XML instead. Specify the narrowest scope possible to keep responses manageable: - section='15.305' for a single FAR section - subpart='15.3' for a subpart - part='15' for an entire part (can be large) - chapter='1' for an entire chapter (often >1 MB, avoid) - appendix='Appendix A to Chapter 2' (with chapter='2') for a DFARS appendix Date auto-resolves to the latest available if not provided. Do NOT use today's date directly -- eCFR lags 1-2 business days and today often 404s. Title 48 = FAR/DFARS. Chapter 1 = FAR (Parts 1-99), Chapter 2 = DFARS (Parts 200-299). Other chapters = agency FAR supplements (GSAR, VAAR, HSAR, etc.). For DFARS clauses, use chapter='2' (e.g., section='252.227-7014'). part/subpart/section accept int or string. Common prefix mistakes like section='FAR 15.305' or '48 CFR 15.305' are stripped automatically, and trailing paragraph cites like section='15.305(a)(2)' resolve to the base section '15.305'.
| Name | Type | Req | Description |
|---|---|---|---|
| appendix | – | – | – |
| chapter | – | – | – |
| date | – | – | – |
| part | – | – | – |
| raw_xml | boolean | – | – |
| section | – | – | – |
| subpart | – | – | – |
| title_number | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_cfr_structure ~181
Get the hierarchical table of contents for a CFR title or subset. Returns a nested tree of titles, chapters, parts, subparts, and sections with identifiers, descriptions, and byte sizes. IMPORTANT: Does NOT support section-level filtering (returns 400). Use part or subpart, then walk the children to find sections. Common patterns: - chapter='1' for all FAR parts - chapter='2' for all DFARS parts - part='15' for FAR Part 15 structure - subpart='15.3' for just that subpart's sections part/subpart/chapter/appendix accept int or string.
| Name | Type | Req | Description |
|---|---|---|---|
| appendix | – | – | – |
| chapter | – | – | – |
| date | – | – | – |
| part | – | – | – |
| subchapter | – | – | – |
| subpart | – | – | – |
| title_number | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_corrections ~126
Get editorial corrections for a CFR title. Returns a list of corrections with CFR references, corrective actions, error dates, and FR citations. Useful for checking whether a section's current text has been corrected since its last amendment. limit caps the number of corrections returned (default 50, max 1000). since_year further filters to corrections with year >= since_year. Title 48 has ~280 corrections across all years; use since_year to focus on recent ones.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| since_year | – | – | – |
| title_number | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_latest_date ~142
Get the most recent available date for a CFR title. CRITICAL: eCFR lags 1-2 business days behind the Federal Register. Using today's date on versioner endpoints causes 404 errors. Call this first to get the safe date, then pass it to other tools. Default title 48 = Federal Acquisition Regulations System (FAR, DFARS, and all agency supplements). Other common titles: 2 (Grants/Agreements), 5 (Administrative Personnel), 29 (Labor), 41 (Public Contracts). Raises ValueError for titles 1-50 that are reserved (no content).
| Name | Type | Req | Description |
|---|---|---|---|
| title_number | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_version_history ~130
Get the version history of a CFR section, subpart, or part. Returns a list of content versions with dates, amendment info, and whether each version was a substantive text change vs editorial. The 'substantive' field is key: True = the regulatory text actually changed. False = only editorial/formatting change. History goes back to January 2017 only. Pre-2017 changes are not tracked. part/subpart/section accept int or string.
| Name | Type | Req | Description |
|---|---|---|---|
| part | – | – | – |
| section | – | – | – |
| subpart | – | – | – |
| title_number | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
list_agencies ~141
List all agencies with their CFR title and chapter references. Returns agency names, slugs, and which CFR titles/chapters they own. Useful for finding which chapter corresponds to an agency's FAR supplement. summary_only (default True) strips the `children` and most of `cfr_references` to keep the response compact (~20 KB vs ~100 KB). References owned by child agencies are merged into the parent row, so chapter lookups like DFARS (chapter 2, on a DoD child agency) still work in summary mode. Set False for the full raw payload including children.
| Name | Type | Req | Description |
|---|---|---|---|
| summary_only | boolean | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
list_sections_in_part ~101
List all sections in a FAR/DFARS part with their headings. Returns a flat list of sections extracted from the structure tree. Useful for understanding the scope of a FAR part before drilling into specific sections. Default chapter='1' (FAR). Use chapter='2' for DFARS. part_number accepts int or string.
| Name | Type | Req | Description |
|---|---|---|---|
| chapter | – | – | – |
| date | – | – | – |
| part_number | – | yes | – |
| title_number | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
lookup_far_clause ~177
Convenience tool: look up the current text of a FAR or DFARS clause. Pass a section identifier like '15.305', '52.212-4', '2.101', etc. Default chapter='1' (FAR). Use chapter='2' for DFARS (e.g., '252.227-7014'). Auto-resolves the latest available date. Returns parsed clean text with heading, paragraphs, and citations. Common FAR sections: 2.101 (Definitions), 9.104-1 (Responsibility), 15.305 (Proposal Evaluation), 19.502-2 (Small Business Set-Asides), 52.212-4 (Commercial Terms), 52.212-5 (Required Commercial Terms).
| Name | Type | Req | Description |
|---|---|---|---|
| chapter | – | – | – |
| date | – | – | – |
| section_id | – | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_cfr ~302
Full-text search across the Code of Federal Regulations. Returns matching sections with excerpts, headings, scores, and hierarchy. CRITICAL: Set current_only=True (default) to search only in-effect text. Without it, search returns ALL historical versions including superseded, so a section amended 5 times appears 5 times. Search caps at 10,000 total results. Use hierarchy filters (title, chapter, part) to narrow if you hit the cap. order controls result ordering: 'relevance' (default), 'newest_first', 'oldest_first', 'hierarchy', or 'citations'. agency_slugs filters to one or more agencies (single slug string or a list, e.g. 'defense-acquisition-regulations-system'). Use list_agencies() to find slugs. last_modified_after/before use YYYY-MM-DD format and filter by the date sections were last amended. Useful for finding recent regulatory changes. per_page accepts 1 to 5000 (default 20); paginate with page for more.
| Name | Type | Req | Description |
|---|---|---|---|
| agency_slugs | – | – | – |
| chapter | – | – | – |
| current_only | boolean | – | – |
| last_modified_after | – | – | – |
| last_modified_before | – | – | – |
| order | – | – | – |
| page | integer | – | – |
| part | – | – | – |
| per_page | integer | – | – |
| query | string | yes | – |
| section | – | – | – |
| subpart | – | – | – |
| title | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
What is the eCFR MCP server?
eCFR is an MCP server listed in the public MCP registry as com.1102tools/ecfr-mcp. Electronic Code of Federal Regulations including FAR, DFARS, and agency supplements. 13 tools. This page covers its PyPI package (ecfr-mcp).
Is the eCFR MCP server safe to use?
eCFR scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the eCFR MCP server expose?
eCFR exposes 13 tools: get_latest_date, get_cfr_content, get_cfr_structure, get_version_history, get_ancestry, and 8 more. Their descriptions and schemas cost roughly 2,267 tokens of context every time the server is loaded.
Is the eCFR MCP server still maintained?
eCFR is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the eCFR MCP server under?
eCFR declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.