# GSA CALC+ (remote · gsa-calc.1102tools.com) GSA CALC+ awarded labor ceiling rates from more than 230,000 MAS contract records. 8 tools. - Trust score: 67/100 (medium) - Change this week: +3 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-11-05 ## Components - remote · `gsa-calc.1102tools.com`: 67/100 (this document), [markdown](https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc.md), [page](https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc) - pypi · `gsa-calc-mcp`: 73/100, [markdown](https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc-mcp.md), [page](https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc-mcp) ## Channel facts - Endpoint: `https://gsa-calc.1102tools.com/mcp` - Transports: `streamable-http` - Auth: `none` - Version: `1.0.24` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-11-05. - **Endpoint Security**: 63/100 - The endpoint's TLS certificate is valid, in date, and uses a strong key. - No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. - HSTS check failed: the Strict-Transport-Security header is absent. - DNSSEC check failed: this domain isn't protected by DNSSEC. - **Transport & Reachability**: 100/100 - Verified streamable-http transport via a live MCP handshake. - **Schema Quality & AI Usability**: 51/100 - AI-judged instruction clarity (good). - Context-footprint check failed: tool/resource definitions use about 2718 tokens (~339/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 50/100 - Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 71/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 0% of tool parameters carry a description. - Structured output schemas are declared (100% of tools); any adoption earns full credit. - **Tool Safety**: 100/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation. - An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a current MCP spec version (2026-07-28). ## Install ### How do I install the GSA CALC+ MCP server? GSA CALC+ is a hosted endpoint at https://gsa-calc.1102tools.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add --transport http com-1102tools-gsa-calc-mcp 'https://gsa-calc.1102tools.com/mcp' ``` ### Cursor ```json { "mcpServers": { "com-1102tools-gsa-calc-mcp": { "url": "https://gsa-calc.1102tools.com/mcp" } } } ``` ### VS Code ```json { "servers": { "com-1102tools-gsa-calc-mcp": { "type": "http", "url": "https://gsa-calc.1102tools.com/mcp" } } } ``` ### Codex ```toml [mcp_servers.com-1102tools-gsa-calc-mcp] url = "https://gsa-calc.1102tools.com/mcp" ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "com-1102tools-gsa-calc-mcp": { "type": "remote", "url": "https://gsa-calc.1102tools.com/mcp", "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add com-1102tools-gsa-calc-mcp --url 'https://gsa-calc.1102tools.com/mcp' --transport streamable-http ``` ### Hermes ```yaml mcp_servers: com-1102tools-gsa-calc-mcp: url: "https://gsa-calc.1102tools.com/mcp" ``` ### Netclaw ```json { "McpServers": { "com-1102tools-gsa-calc-mcp": { "Transport": "http", "Url": "https://gsa-calc.1102tools.com/mcp" } } } ``` ### Vellum ```bash assistant mcp add com-1102tools-gsa-calc-mcp -t streamable-http -u 'https://gsa-calc.1102tools.com/mcp' ``` ### Other ```json { "mcpServers": { "com-1102tools-gsa-calc-mcp": { "type": "http", "url": "https://gsa-calc.1102tools.com/mcp" } } } ``` The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs. ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-11-04 (score 67, +1) No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-11-02 (score 66, +1) No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-31 (score 65, +1) No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-30 (score 64, 0) - [functional] Server version: 1.0.23 → 1.0.24 - [functional] Server version: 1.0.22 → 1.0.23 ### 2026-10-29 (score 64, +1) No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-27 (score 63, +1) - [functional] Server version: 1.0.21 → 1.0.22 ### 2026-10-25 (score 62, +1) No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-23 (score 61, +1) No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes. ## MCP tools (8) ### `keyword_search` (~456 tokens) Search GSA CALC+ ceiling rates by keyword. Performs wildcard matching across labor_category, vendor_name, and idv_piid fields. This is the primary search tool for finding rates. Returns matching rate records plus aggregation statistics (wage_stats, percentiles, education breakdown, business size) covering the FULL result set even when individual hits are capped at 10,000. Important notes: - These are NTE (not-to-exceed) ceiling rates, not prices paid - Rates are fully burdened hourly rates from GSA MAS contracts - Data refreshes nightly from vendor price proposal tables - Use P50 from percentiles for median (more accurate than median_price) Filter parameters: - education_level: AA, BA, HS, MA, PHD, TEC (pipe-delimited for OR: 'BA|MA') - experience_min/max: years of experience range - price_min/max: hourly rate range in USD - business_size: 'S' (small) or 'O' (other/large) - security_clearance: 'yes' or 'no' - sin: Special Item Number (e.g., '54151S' for IT Professional Services) - worksite: NOT supported (the v3 API silently ignores it; passing a value raises so callers are not handed unfiltered data) ordering: current_price, labor_category, vendor_name, education_level, min_years_experience, next_year_price, idv_piid, business_size. sort: 'asc' or 'desc'. exclude: pipe-delimited hit _id values to exclude from results and stats. Input parameters: - `business_size` - `education_level` - `exclude` - `experience_max` - `experience_min` - `keyword` (string, required) - `ordering` (string) - `page` (integer) - `page_size` (integer) - `price_max` - `price_min` - `security_clearance` - `sin` - `sort` (string) - `worksite` ### `exact_search` (~252 tokens) Exact match search on a specific field. Use suggest_contains() first to discover the exact field value, then pass it here. The API requires exact string matching -- partial matches return 0 results. Fields: labor_category, vendor_name, idv_piid (GSA MAS contract number). For a discovered value containing a colon, GSA's exact-field search can return only the text before the colon. This tool uses literal keyword search instead and accepts its statistics only when the complete, non-approximate requested-field aggregation proves every rate row has the exact value. If that cannot be verified, it withholds the misleading population and gives keyword_search recovery guidance. Source statistics remain unchanged; empty results and thin samples retain their limits. Input parameters: - `business_size` - `education_level` - `experience_max` - `experience_min` - `field` (string, required) - `ordering` (string) - `page` (integer) - `page_size` (integer) - `price_max` - `price_min` - `sort` (string) - `value` (string, required) ### `suggest_contains` (~168 tokens) Discover exact field values via autocomplete/contains matching. Returns aggregation buckets showing matching values and their record counts. Use this BEFORE exact_search() to find the right value string. Minimum 2 characters required for the search term. GSA lists at most 100 values, most records first. When more values match, truncated is true and other_records counts the records under values not shown; use a longer term to narrow the list. Example workflow: 1. suggest_contains('vendor_name', 'booz') -> finds 'Booz Allen Hamilton Inc.' 2. exact_search('vendor_name', 'Booz Allen Hamilton Inc.') -> all their rates Input parameters: - `field` (string, required) - `term` (string, required) ### `filtered_browse` (~145 tokens) Browse rates with filters only (no search keyword). Useful for market segment statistics: "what do all BA-level rates with 5-15 years experience look like across all of GSA MAS?" Returns rate records plus full aggregation statistics. Input parameters: - `business_size` - `education_level` - `experience_max` - `experience_min` - `ordering` (string) - `page` (integer) - `page_size` (integer) - `price_max` - `price_min` - `security_clearance` - `sin` - `sort` (string) - `worksite` ### `igce_benchmark` (~431 tokens) Get ceiling rate benchmarks for IGCE development. Returns statistical summary for a labor category: count, min, max, avg, median, standard deviation, percentile distribution (P10-P90), education breakdown, worksite counts (worksite_breakdown: Customer_Facility / Contractor_Facility / Virtual; counts only, prices are pooled across sites), and outlier bounds. GSA's keyword search matches labor_category, vendor_name and idv_piid. The returned statistics pool all matching rate rows, including unrelated labor titles when a vendor name or contract number matches the phrase. Check population_scope and matched_titles before using the statistics. off_title_matches_detected flags observed titles that do not match the requested phrase; title_only_population_verified is false when the title aggregation is missing, empty, truncated or approximate. A title containing the phrase is not necessarily the exact grade: 'Registered Nurse I' also matches Nurse II, III and IV. Check exact_title_population_verified, exact_title_rate_count and non_exact_title_examples before treating a pool as that specific title. For title-only rates, call suggest_contains on labor_category to discover an exact title, then exact_search on labor_category. Different spellings remain separate searches ('Cyber Security Analyst' vs 'Cybersecurity Analyst'). Statistics are on current-year ceiling rates (current_price), not next-year or option-year prices. These are not-to-exceed ceiling rates, not prices paid. Ceiling-rate comparisons alone do not establish a proposed price's reasonableness. Optional filters: education_level, experience_min/max, business_size ('S' or 'O'), sin (e.g. '541611'), security_clearance ('yes' or 'no'). Input parameters: - `business_size` - `education_level` - `experience_max` - `experience_min` - `labor_category` (string, required) - `security_clearance` - `sin` ### `price_reasonableness_check` (~424 tokens) Evaluate a proposed hourly rate against GSA ceiling rate distribution. GSA's keyword search matches labor titles, vendor names and contract numbers. Check population_scope: unrelated titles can enter the pooled statistics through a matching vendor or contract. Returns MIXED_SEARCH_FIELDS with no verdict when off-title matches are detected, or UNVERIFIED_POPULATION with no verdict when the title list is missing, empty, truncated or approximate. Discover an exact title with suggest_contains, then use exact_search on labor_category for title-only rates. Filters match igce_benchmark, including sin and security_clearance. Returns MIXED_LABOR_TITLES with no verdict when the phrase matches different grades, specialties or title variants; pooled statistics remain visible, with the exact-title count when verified. For example, Nurse I must not be compared as if Nurse II/III/IV rates were the same grade. Use exact_search with its supported education, experience and business-size filters to inspect that title. It does not accept SIN or clearance filters; check those requirements in the returned records and retain paging limits. A verified exact-title population with at least 20 rates returns z-score, median comparison, IQR position and delta from average. The z-score is null when the mean or standard deviation is unavailable or variance is zero. Missing means produce null average deltas. A verified exact-title population with fewer than 20 rates returns LOW_SAMPLE without a high/low verdict; zero rates return NO_DATA. Statistics compare not-to-exceed ceiling rates, not prices paid, and do not by themselves establish price reasonableness or performance risk. Input parameters: - `business_size` - `education_level` - `experience_max` - `experience_min` - `labor_category` (string, required) - `proposed_rate` (number, required) - `security_clearance` - `sin` ### `vendor_rate_card` (~611 tokens) Get ceiling rates for a specific vendor, one page at a time. For a complete vendor card or a role-specific subset (for example, project managers), fetch every page: while has_more is true, call this tool again with page=next_page and the same vendor_name, page_size, ordering, and sort. Stop only when has_more is false, then combine the pages and match the requested roles client-side. If you stop early, say clearly that the results are partial, report the fetched returned_range against total_rates, and explain that later pages may contain additional matching roles or rates. Do not claim a role is absent or present a complete role-specific rate range from a partial card. Auto-discovers the exact vendor name via suggest-contains, then pulls their rate records. Returns labor categories, rates, education levels, experience requirements, SINs, contract numbers, contract end dates, and worksite. A vendor often lists the same category twice at two prices, one for work at the customer's site (Customer_Facility) and one at the contractor's site (Contractor_Facility); check worksite before comparing. Pass a partial name (e.g., 'booz' for Booz Allen Hamilton). The tool finds the exact registered name automatically. Use part of the legal name, not an acronym ('Science Applications', not 'SAIC'). total_rates counts rate rows, not titles: one title can have several rows (worksite, contract, SIN). distinct_labor_categories is the number of distinct titles (case-sensitive); when a vendor has more than 500 it is null and distinct_labor_categories_min gives the floor. Large vendors span many pages: Booz Allen Hamilton carries ~1,900 rate rows (more than 500 distinct titles). The default page_size is 100 (~23KB) because a 500-row page for a vendor that size is ~114KB and overflows MCP client output limits. Rows are ordered by labor_category ascending by default, so a partial… Input parameters: - `ordering` (string) - `page` (integer) - `page_size` (integer) - `sort` (string) - `vendor_name` (string, required) ### `sin_analysis` (~231 tokens) Get rate distribution and statistics for a specific SIN. Returns rate statistics, education breakdown, business size breakdown, and labor_categories for a GSA MAS Special Item Number: the 25 titles with the most rates on the SIN, with counts (exact, case-sensitive titles). It does not return individual rate rows or per-title prices; for what a title costs on the SIN, call igce_benchmark(title, sin=...). When GSA's 500-title list is cut off, labor_categories.distinct is null and records_in_titles_not_listed counts the rates under titles not listed. Common SINs for professional services (live-verified to return records): - 54151S: IT Professional Services - 541611: Management and Financial Consulting - 541715: Engineering R&D - 541330ENG: Engineering Services - 561210FAC: Facilities Maintenance and Management - 611430: Training Input parameters: - `page_size` (integer) - `sin_code` (required) ## Diagnostics Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc#diagnostics ## Score history - 2026-11-05: 67 - 2026-11-04: 67 - 2026-11-03: 66 - 2026-11-02: 66 - 2026-11-01: 65 - 2026-10-31: 65 - 2026-10-30: 64 - 2026-10-29: 64 - 2026-10-28: 63 - 2026-10-27: 63 - 2026-10-26: 62 - 2026-10-25: 62 - 2026-10-24: 61 - 2026-10-23: 61 - 2026-10-22: 60 - 2026-10-21: 60 ## Common questions ### What is the GSA CALC+ MCP server? GSA CALC+ is an MCP server listed in the public MCP registry as com.1102tools/gsa-calc-mcp. GSA CALC+ awarded labor ceiling rates from more than 230,000 MAS contract records. 8 tools. This page covers its hosted endpoint (https://gsa-calc.1102tools.com/mcp). ### Is the GSA CALC+ MCP server safe to use? GSA CALC+ scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the GSA CALC+ MCP server expose? GSA CALC+ exposes 8 tools: keyword_search, exact_search, suggest_contains, filtered_browse, igce_benchmark, and 3 more. Their descriptions and schemas cost roughly 2,718 tokens of context every time the server is loaded. ### Does the GSA CALC+ MCP server require authentication? No. We connected to GSA CALC+ without credentials and it answered, so anything it exposes is reachable by anyone who knows the address. ### Is the GSA CALC+ MCP server still maintained? GSA CALC+ is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ### What did VerifyMCP test on the GSA CALC+ MCP server? VerifyMCP ran 12 checks on GSA CALC+, covering TLS certificate, Authorization, HSTS header, DNSSEC and 8 more. One item could not be completed, a gap on our side rather than a finding about GSA CALC+: HTTPS. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out. ## Links - Remote endpoint: https://gsa-calc.1102tools.com/mcp - Repository: https://github.com/1102tools-dev/federal-contracting-mcps - Website: https://1102tools.com/ - Changelog RSS feed: https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc.xml - Changelog JSON feed: https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc/changelog.json - Trust report (JSON): https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc.json - HTML version of this page: https://verifymcp.io/servers/com-1102tools-gsa-calc-mcp/gsa-calc