SAM.gov
REMOTE · SAM.1102TOOLS.COM · 2 COMPONENTS
SAM.gov readiness, entities, exclusions, opportunities, awards, hierarchy, and subawards. 20 tools.
Available components
Last scanned (48 minutes ago)
Scores higher than 54% of remote servers
Reachable. Last reached 5 Nov 2026.
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability54
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2700 tokens (~450/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management50
- Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage94
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 82% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 0
- Server version: 1.1.18 → 1.1.19 functional
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 0
- Server version: 1.1.17 → 1.1.18 functional
- 28 Oct 26 +1
- Server version: 1.1.16 → 1.1.17 functional
- 27 Oct 26 0
- Server version: 1.1.15 → 1.1.16 functional
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://sam.1102tools.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=1102tools.com | CN=WE1,O=Google Trust Services,C=US | 27 Sept 2026 | 26 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | 45edb37c28e4a2ef0ebaddae94a41b42 |
| SANs: 1102tools.com, sam.1102tools.com, *.sam.1102tools.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of sam.1102tools.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| 1102tools.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://sam.1102tools.com/mcp | Verified | 200 | |
| http (plaintext) | http://sam.1102tools.com/mcp | Inconclusive | 405 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_data_status ~52
Report source file names and dates, load times, row counts and coverage limitations for public opportunities, entity registrations and exclusions. Includes opportunity counts by type and last-load changes. Use it to judge how current results are.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_opportunity ~166
Get one SAM.gov notice in full: description, response deadline, set-aside, NAICS and PSC codes, place of performance, contracting office, points of contact, award details for award notices, and the public sam.gov link. Also lists other active notices with the same solicitation number, such as earlier versions, amendments, or awards (with awardee and amount). Pass the 32-character notice ID from search results, or a solicitation number (returns its most recently posted current notice, preferring the solicitation over award notices and justifications). Attachments are not retrieved; open the sam.gov link for them.
| Name | Type | Req | Description |
|---|---|---|---|
| notice_id | string | – | 32-character SAM.gov notice ID. |
| solicitation_number | string | – | Solicitation number, used when notice_id is not given. |
No output schema declared.
No examples provided.
search_entities ~823
Answer SAM registration and socioeconomic questions: women-owned/WOSB/EDWOSB, veteran-owned/SDVOSB, HUBZone, 8(a), and small business. Search the monthly public extract by UEI, CAGE, name, NAICS and state; filters combine. any_naics includes secondary codes. Search defaults Active; UEI/CAGE includes inactive. Use the labeled business or SBA code filters below. For NAICS-specific small-business status, request assertions or All and check sbaSmallBusiness; 2X means for-profit, not small. Codes and active registration do not prove current SBA certification; check certificationExitDate and confirm SBA/SAM.gov status. Public-display opt-outs are excluded. Up to 10 records/page.
| Name | Type | Req | Description |
|---|---|---|---|
| any_naics | – | – | Any listed NAICS, 2-6 digits. |
| business_type_code | string | – | SAM business-type codes; ownership is generally self-selected, not SBA certification. Common codes: A2=Woman-Owned Business; 8W=Women-Owned Small Business; A5=Veteran-Owned Business; QF=Service-Disab… |
| cage_code | string | – | Exact 5-character CAGE code. |
| include_sections | array | – | Public sections only. Defaults to entityRegistration + coreData; entityRegistration is always included. |
| legal_business_name | string | – | Partial legal or DBA name; punctuation, spacing, ampersands and common company suffixes are normalized. Zero results include separately labeled possible name matches; names alone do not confirm ident… |
| page | integer | – | – |
| primary_naics | – | – | Designated primary NAICS, 2-6 digits. |
| purpose_of_registration | string | – | – |
| registration_status | string | – | A=Active (search default), E=expired (displayed as Inactive). |
| sba_business_type_code | string | – | SBA source codes: A6=SBA Certified 8(a) Program Participant; JT=SBA Certified 8(a) Joint Venture; XX=SBA Certified HUBZone Firm; A4=SBA Certified Small Disadvantaged Business (No longer Active); A9=S… |
| size | integer | – | – |
| state_code | string | – | Physical address state, 2-letter USPS code. |
| uei | string | – | Exact 12-character UEI. |
No output schema declared.
No examples provided.
search_exclusions ~238
Check SAM.gov public exclusion/debarment records by UEI, CAGE, or name. Filters combine. Searches the dated public extract, which is not a complete exclusion history; inactive or terminated historical records may be absent. Every result identifies the source file and date. No matches in the extract is not a live clearance or eligibility determination; confirm current status on SAM.gov.
| Name | Type | Req | Description |
|---|---|---|---|
| cage_code | string | – | 5-character CAGE; exact match. |
| classification | string | – | – |
| country | string | – | 3-character ISO alpha-3 country code, e.g. USA. |
| entity_name | string | – | Partial firm or individual name; punctuation, spacing, ampersands and common company suffixes are normalized, including first/middle/last names. Zero results include separately labeled possible name… |
| excluding_agency_code | string | – | – |
| exclusion_program | string | – | – |
| page | integer | – | – |
| size | integer | – | – |
| state_province | string | – | – |
| uei | string | – | 12-character Unique Entity ID; exact match. |
No output schema declared.
No examples provided.
search_opportunities ~742
Search active SAM.gov contract opportunity notices: solicitations, combined synopses, presolicitations, sources sought, special notices, award notices, and justifications. All filters combine. Keyword search covers titles and full descriptions. By default, only the latest version of each amended notice is included. Notices whose response deadline has passed are left out, except award notices and justifications; notices with no deadline are also included. Set include_past_deadlines to true to include other past-deadline notices. Results are sorted by soonest deadline, with notices that have no deadline last. Returns up to 100 notices per call with the total match count; use offset to page. Use get_opportunity for a notice's full description and contacts. Data is SAM.gov's public daily file of active notices, not live SAM.gov. Archived notices and attachments are not included.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | – | Text matched against the department, sub-tier, and office names, e.g. Army, Veterans Affairs, NSWC Dahlgren. Field activities post under their own office names, so a command name matches only its hea… |
| deadline_from | string | – | Earliest response deadline date, YYYY-MM-DD, in the deadline's own time zone. |
| deadline_to | string | – | Latest response deadline date, YYYY-MM-DD. |
| include_earlier_versions | boolean | – | Include earlier versions of amended notices. SAM.gov's file lists every version of a notice as its own row; by default only the latest version of each is included. |
| include_past_deadlines | boolean | – | Include notices whose response deadline has already passed. SAM.gov keeps notices active for a while after the deadline; by default they are left out. Award notices and justifications are always incl… |
| keywords | string | – | Words that must all appear in the title or full description. Put exact phrases in double quotes, e.g. zero trust "cloud migration". Word endings are matched loosely (bridge matches bridges). |
| limit | integer | – | – |
| naics_codes | array | – | NAICS codes or prefixes (2 to 6 digits); a prefix such as 5415 matches every code under it. |
| notice_types | array | – | Current notice types to include. Omit for all types. |
| office_state | string | – | Two-letter state code of the contracting office. Filled in on nearly every notice, but an office's state is not always where the work happens. |
| offset | integer | – | – |
| place_of_performance_state | string | – | Two-letter state code for the place of performance. Most notices leave the place of performance blank, so results also report how many more notices have a contracting office in that state (see office… |
| posted_from | string | – | Earliest posted date, YYYY-MM-DD. |
| posted_to | string | – | Latest posted date, YYYY-MM-DD. |
| psc_codes | array | – | Product and service codes or prefixes, e.g. D3 or R425. |
| set_aside_codes | array | – | SAM.gov set-aside codes, e.g. SBA (total small business), 8A, SDVOSBC, WOSB, HZC. NONE means the notice says no set-aside was used. |
| solicitation_number | string | – | Exact solicitation number. |
| sort | string | – | deadline: soonest response deadline first. newest: most recently posted first. relevance: best keyword match first (needs keywords). |
No output schema declared.
No examples provided.
summarize_opportunities ~679
Count active SAM.gov notices grouped by agency, sub-tier, office, NAICS, PSC, set-aside, notice type, place-of-performance state, contracting office state, or posted month. Accepts the same filters as search_opportunities, e.g. counts of open solicitations under one NAICS by set-aside, or which agencies posted the most sources sought notices this quarter. Counts cover active notices in SAM.gov's public daily file, including notices posted in earlier fiscal years that remain active. This is not a complete historical archive; archived notices are not included.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | – | Text matched against the department, sub-tier, and office names, e.g. Army, Veterans Affairs, NSWC Dahlgren. Field activities post under their own office names, so a command name matches only its hea… |
| deadline_from | string | – | Earliest response deadline date, YYYY-MM-DD, in the deadline's own time zone. |
| deadline_to | string | – | Latest response deadline date, YYYY-MM-DD. |
| group_by | string | yes | Field to group counts by. |
| include_earlier_versions | boolean | – | Include earlier versions of amended notices. SAM.gov's file lists every version of a notice as its own row; by default only the latest version of each is included. |
| include_past_deadlines | boolean | – | Include notices whose response deadline has already passed. SAM.gov keeps notices active for a while after the deadline; by default they are left out. Award notices and justifications are always incl… |
| keywords | string | – | Words that must all appear in the title or full description. Put exact phrases in double quotes, e.g. zero trust "cloud migration". Word endings are matched loosely (bridge matches bridges). |
| naics_codes | array | – | NAICS codes or prefixes (2 to 6 digits); a prefix such as 5415 matches every code under it. |
| notice_types | array | – | Current notice types to include. Omit for all types. |
| office_state | string | – | Two-letter state code of the contracting office. Filled in on nearly every notice, but an office's state is not always where the work happens. |
| place_of_performance_state | string | – | Two-letter state code for the place of performance. Most notices leave the place of performance blank, so results also report how many more notices have a contracting office in that state (see office… |
| posted_from | string | – | Earliest posted date, YYYY-MM-DD. |
| posted_to | string | – | Latest posted date, YYYY-MM-DD. |
| psc_codes | array | – | Product and service codes or prefixes, e.g. D3 or R425. |
| set_aside_codes | array | – | SAM.gov set-aside codes, e.g. SBA (total small business), 8A, SDVOSBC, WOSB, HZC. NONE means the notice says no set-aside was used. |
| solicitation_number | string | – | Exact solicitation number. |
| top | integer | – | Number of groups to return, largest first. For posted_month, the most recent months, in month order. |
No output schema declared.
No examples provided.
How do I install the SAM.gov MCP server?
SAM.gov is a hosted endpoint at https://sam.1102tools.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · sam.1102tools.com
claude mcp add --transport http com-1102tools-sam-gov-mcp 'https://sam.1102tools.com/mcp'
What is the SAM.gov MCP server?
SAM.gov is an MCP server listed in the public MCP registry as com.1102tools/sam-gov-mcp. SAM.gov readiness, entities, exclusions, opportunities, awards, hierarchy, and subawards. 20 tools. This page covers its hosted endpoint (https://sam.1102tools.com/mcp).
Is the SAM.gov MCP server safe to use?
SAM.gov scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SAM.gov MCP server expose?
SAM.gov exposes 6 tools: search_opportunities, get_opportunity, summarize_opportunities, get_data_status, search_entities, search_exclusions. Their descriptions and schemas cost roughly 2,700 tokens of context every time the server is loaded.
Does the SAM.gov MCP server require authentication?
No. We connected to SAM.gov without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the SAM.gov MCP server still maintained?
SAM.gov is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.