SAM.gov
PYPI · SAM-GOV-MCP · SCANNED SEP 20
SAM.gov readiness, entities, exclusions, opportunities, awards, hierarchy, and subawards. 20 tools.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 34 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability58
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 5450 tokens (~272/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the SAM.gov MCP server?
SAM.gov runs locally as a PyPI package, launched with uvx sam-gov-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · sam-gov-mcp
claude mcp add com-1102tools-sam-gov-mcp -- uvx sam-gov-mcp
{
"mcpServers": {
"com-1102tools-sam-gov-mcp": {
"command": "uvx",
"args": [
"sam-gov-mcp"
]
}
}
} {
"servers": {
"com-1102tools-sam-gov-mcp": {
"command": "uvx",
"args": [
"sam-gov-mcp"
]
}
}
} codex mcp add com-1102tools-sam-gov-mcp -- uvx sam-gov-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-1102tools-sam-gov-mcp": {
"type": "local",
"command": [
"uvx",
"sam-gov-mcp"
],
"enabled": true
}
}
} openclaw mcp add com-1102tools-sam-gov-mcp --command uvx --arg sam-gov-mcp
mcp_servers:
com-1102tools-sam-gov-mcp:
command: "uvx"
args: ["sam-gov-mcp"] {
"McpServers": {
"com-1102tools-sam-gov-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"sam-gov-mcp"
]
}
}
} assistant mcp add com-1102tools-sam-gov-mcp -t stdio -c uvx -a sam-gov-mcp
{
"mcpServers": {
"com-1102tools-sam-gov-mcp": {
"command": "uvx",
"args": [
"sam-gov-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
- Package version: 1.0.12 → 1.0.13 functional
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 5 Sept 26 −14
- Malware scan: pass → unverified ▼ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/sam-gov-mcp@1.0.13
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 34 packages
| Packages resolved | 34 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_exclusion_by_uei ~122
Check if an entity has any exclusion/debarment records by UEI. Returns exclusion records from the consolidated Excluded Parties List. totalRecords=0 means the entity is not currently excluded. totalRecords>0 means one or more exclusion records exist; check recordStatus='Active' on each entry to determine if the exclusion is currently in effect. This is the single most important check for FAR 9.104-1 responsibility determinations and FAR 9.405 debarment prohibitions.
| Name | Type | Req | Description |
|---|---|---|---|
| uei | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_access_status ~21
Check SAM.gov credential presence without returning or validating its value.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
get_entity_integrity_info ~77
Fetch FAPIIS proceedings integrity information for an entity by UEI. integrityInformation is NOT included in the default response or even includeSections=All. Requires explicit request plus proceedingsData=Yes query parameter. Returns proceedings disclosures per FAR 52.209-7/9.
| Name | Type | Req | Description |
|---|---|---|---|
| uei | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_entity_reps_and_certs ~281
Fetch FAR/DFARS representations and certifications for an entity by UEI. repsAndCerts is NOT included in the default response or even in includeSections=All. It must be explicitly requested. Returns the entity's responses to standard FAR 52.212-3, FAR 52.204-17, FAR 52.209-2, FAR 52.219-1, FAR 52.222-18, FAR 52.225-2, DFARS 252.204-7016, and other certification clauses. Combined with entityRegistration for identification context. Parameters: - summary_only (default True): returns a condensed view (clause ID, title, and answer summary per clause) instead of the full certification text. The full repsAndCerts payload for a large entity can exceed 70KB, which blows the MCP response budget. Set False to get the raw response. - clause_filter: list of FAR/DFARS clause identifiers to include (e.g. ['FAR 52.204-17', 'FAR 52.219-1']). Case-insensitive substring match. Combines with summary_only.
| Name | Type | Req | Description |
|---|---|---|---|
| clause_filter | – | – | – |
| summary_only | boolean | – | – |
| uei | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_opportunity_description ~73
Fetch the full description text for a contract opportunity by notice ID. The 'description' field in search_opportunities results is a URL, not inline text. This tool handles the second fetch to retrieve the actual HTML description. Pass the noticeId from the search results.
| Name | Type | Req | Description |
|---|---|---|---|
| notice_id | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_organization_hierarchy ~92
Get the immediate child organizations of a federal organization. Pass an FH org ID (use search_federal_organizations to find one) and receive the list of its direct subordinates. To traverse the full tree, call recursively on each child. Pagination uses limit (1-100) / offset.
| Name | Type | Req | Description |
|---|---|---|---|
| fh_org_id | – | yes | – |
| limit | integer | – | – |
| offset | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
lookup_award_by_piid ~211
Look up contract award modifications for a single PIID. Returns up to 100 modification records for the given Procurement Instrument Identifier, sorted by modification number client-side (the API returns them unsorted). Large IDVs can exceed 100 mods; when totalRecords is larger than the returned list a _note flags the truncation. This is the primary way to get the history of a contract action. PIIDs are alphanumeric identifiers assigned by the contracting office. Format varies by agency (e.g. "GS-35F-0119Y", "W912BV22P0112", "N0003925F7516"). The search is exact match. include_sections: comma-separated list of contractId, coreData, awardDetails. Defaults to all sections if not specified. Returns normalized response with awardSummary list containing all modifications. Check totalRecords for the number of mods found.
| Name | Type | Req | Description |
|---|---|---|---|
| include_sections | – | – | – |
| piid | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
lookup_entity_by_cage ~71
Look up a federal entity by its CAGE code. CAGE (Commercial and Government Entity) codes are 5-character alphanumeric identifiers assigned by DLA. Useful when you have a CAGE but no UEI.
| Name | Type | Req | Description |
|---|---|---|---|
| cage_code | string | yes | – |
| include_sections | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
lookup_entity_by_uei ~366
Look up a federal entity by its Unique Entity ID (UEI). Returns the full entity record from SAM.gov Entity Management v3. The UEI is a 12-character alphanumeric identifier assigned by SAM.gov. Matching is case-insensitive and whitespace-tolerant (live-verified). A UEI is NOT guaranteed unique: live data contains UEIs with multiple (sometimes duplicate) registration records, so totalRecords can exceed 1; inspect every entityData entry rather than assuming [0] is the only one. sam_registered='No' searches a separate ~614k-record population of "ID Assigned" entities (UEI issued, registration never completed). include_sections controls response size: - entityRegistration: UEI, CAGE, name, status, activation/expiration dates (ALWAYS include) - coreData: addresses, POCs at high level, business types, hierarchy - assertions: NAICS and PSC codes (in goodsAndServices subsection) - pointsOfContact: detailed POC records (name, title, address; email/phone FOUO only) - repsAndCerts: FAR/DFARS certification responses (must be explicitly requested) - integrityInformation: FAPIIS proceedings data (must be explicitly requested) - All: entityRegistration + coreData + assertions + pointsOfContact (but NOT repsAndCerts/integrityInformation) Default: entityRegistration + coreData. Always include entityRegistration alongside any other section or the response loses entity identification. sam_registered='Yes' (default) returns only fully registered entities. Use 'No' to find entities with a UEI assigned but incomplete registration.
| Name | Type | Req | Description |
|---|---|---|---|
| include_sections | – | – | – |
| sam_registered | string | – | – |
| uei | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
lookup_psc_code ~79
Look up a Product/Service Code (PSC) by its code value. Returns the PSC name, full name, level 1 and level 2 category information, and includes/excludes guidance. Useful for validating PSC codes before using them as filters in other searches.
| Name | Type | Req | Description |
|---|---|---|---|
| active_only | string | – | – |
| code | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_acquisition_subawards ~399
Search FFATA subcontract reports (acquisition subawards). These are subcontracts reported by prime contractors under the Federal Funding Accountability and Transparency Act. Use this to map prime contractors to their subs, see subcontract values, and identify the full distribution of a federal procurement dollar. CRITICAL: dates use ISO yyyy-MM-dd format (NOT MM/dd/yyyy like the rest of SAM.gov). Pagination uses pageNumber/pageSize (NOT limit/offset). Key filters: - prime_contract_key: business key for subawards under a prime - piid: Procurement Instrument ID of the prime contract (returns all subs) - referenced_idv_piid: prime contract family identifier (parent IDV) - referenced_idv_agency_id: agency on the parent IDV - agency_id: four-digit agency code on the prime (e.g. 9700 for DoD) - prime_award_type: type of the parent prime award - from_date / to_date: yyyy-MM-dd window (filters on subaward report date) - status: 'Published' (default) or 'Deleted' for audit trails - page_number: 0-based page index. Stay within ceil(totalRecords/page_size): pages past the end HANG upstream until timeout (live-verified 2026-08) - page_size: 1-1000, default 100 Response: {totalPages, totalRecords, pageNumber, nextPageLink, previousPageLink, data: [...]}.
| Name | Type | Req | Description |
|---|---|---|---|
| agency_id | – | – | – |
| from_date | – | – | – |
| page_number | integer | – | – |
| page_size | integer | – | – |
| piid | – | – | – |
| prime_award_type | – | – | – |
| prime_contract_key | – | – | – |
| referenced_idv_agency_id | – | – | – |
| referenced_idv_piid | – | – | – |
| status | string | – | – |
| to_date | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_assistance_subawards ~329
Search FFATA grant subaward reports (financial assistance subawards). These are subawards reported by prime grant recipients on cooperative agreements and grants. Use this to trace federal grant funds from prime recipient down to subrecipients. CRITICAL: dates use ISO yyyy-MM-dd format (NOT MM/dd/yyyy). Pagination uses pageNumber/pageSize. Key filters: - prime_award_key: business key identifying subawards under a prime grant - fain: Federal Award Identification Number for grants - agency_code: FOUR-DIGIT agency code on the prime (e.g. 9700 for DoD, 7529 for HHS/IHS). The API rejects anything else with "AgencyCode must be a four digit number"; 3-digit CGAC codes like 075 do NOT work here (unlike the Federal Hierarchy tools, which accept CGAC) - from_date / to_date: yyyy-MM-dd window - status: 'Published' (default) or 'Deleted' - page_number: 0-based page index. Stay within ceil(totalRecords/page_size): pages past the end HANG upstream until timeout (live-verified 2026-08) - page_size: 1-1000, default 100
| Name | Type | Req | Description |
|---|---|---|---|
| agency_code | – | – | – |
| fain | – | – | – |
| from_date | – | – | – |
| page_number | integer | – | – |
| page_size | integer | – | – |
| prime_award_key | – | – | – |
| status | string | – | – |
| to_date | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_contract_awards ~857
Search contract award records on SAM.gov (FPDS replacement). This is the replacement for FPDS.gov (decommissioned Feb 2026). Same data, new endpoint. Uses limit/offset pagination (NOT page/size), and note that despite the name, offset is a ZERO-BASED PAGE INDEX (live-verified 2026-08): offset=1 with limit=100 returns records 101-200. Never advance offset by limit or you will silently skip almost everything. CRITICAL date format: MM/dd/yyyy for single dates, [MM/dd/yyyy,MM/dd/yyyy] for ranges (brackets included). ISO 8601 dates are rejected. Boolean operators: use ~ for OR (e.g. naics_code="541512~541511"), use ! for NOT (e.g. extent_competed_code="!A"). Key parameters: - awardee_name: awardeeLegalBusinessName (partial match). NOT "vendorName". - awardee_uei: awardeeUniqueEntityId (exact match) - awardee_cage_code: awardeeCageCode (exact match) - piid: Procurement Instrument Identifier. Returns all mods for that PIID. - naics_code: 6-digit NAICS. Supports ~ for OR, ! for NOT. - psc_code: Product/Service Code (4-char). Supports ~ for OR. - contracting_department_code: top-level department (e.g. "9700" for DoD) - contracting_subtier_code: subtier agency (e.g. "1700" for Navy) - contracting_office_code: contracting office (e.g. "N00039") - date_signed: date of award action. MM/dd/yyyy or [MM/dd/yyyy,MM/dd/yyyy] - last_modified_date: when record was last modified. Same format. - fiscal_year: filter by FY (e.g. "2026"). Data observed back to FY1970. - award_or_idv: "AWARD" for contracts/orders, "IDV" for indefinite-delivery vehicles - type_of_contract_pricing_code: J=FFP, U=CPFF, etc. - type_of_set_aside_code: SBA, 8A, HZC, SDVOSBC, etc. - extent_competed_code: A=Full, B=Not Available, CDO=Competed Under SAP, etc. - dollars_obligated: bracket range [min,max] as string - modification_number: "0" for base award, specific mod number, or range - free_text: q parameter for full-text search across all fields - include_sections: comma-separated: contractId, coreData, awardD…
| Name | Type | Req | Description |
|---|---|---|---|
| award_or_idv | – | – | – |
| awardee_cage_code | – | – | – |
| awardee_name | – | – | – |
| awardee_uei | – | – | – |
| contracting_department_code | – | – | – |
| contracting_office_code | – | – | – |
| contracting_subtier_code | – | – | – |
| date_signed | – | – | – |
| dollars_obligated | – | – | – |
| extent_competed_code | – | – | – |
| fiscal_year | – | – | – |
| free_text | – | – | – |
| include_sections | – | – | – |
| last_modified_date | – | – | – |
| limit | integer | – | – |
| modification_number | – | – | – |
| naics_code | – | – | – |
| offset | integer | – | – |
| piid | – | – | – |
| psc_code | – | – | – |
| type_of_contract_pricing_code | – | – | – |
| type_of_set_aside_code | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_deleted_awards ~148
Search contract award records that have been deleted from FPDS/SAM.gov. Uses the same Contract Awards endpoint with deletedStatus=Y. Deleted records are removed from normal search results but remain accessible through this parameter. Useful for audit trails and historical research. Supports the same date format as search_contract_awards: MM/dd/yyyy or [MM/dd/yyyy,MM/dd/yyyy] for ranges. limit: 1-100 (default 10). offset: 0-based pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| awardee_name | – | – | – |
| contracting_department_code | – | – | – |
| last_modified_date | – | – | – |
| limit | integer | – | – |
| offset | integer | – | – |
| piid | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_entities ~707
Search SAM.gov entities with flexible filters. All filters are AND-ed together. Returns paginated results; note that Entity Management has a HARD CAP of 10 records per page (size <= 10). For more results, increment 'page' and make multiple calls. Key filter notes: - legal_business_name does partial matching with no relevance ranking. Cannot contain & or parentheses (API strips them, returns 0 results). For exact lookup use UEI or CAGE. - primary_naics matches the entity's designated primary NAICS only. - any_naics matches any NAICS the entity has on file. - business_type_code covers self-selected types: QF (SDVOSB), A2 (Women-Owned), 8W (WOSB), 23 (Minority-Owned), NB (Native American Owned), A3 (Labor Surplus Area Firm), and any other 2-character code from the SAM Functional Data Dictionary "Business Types" field: the full FDD set passes through. SDVOSB is NOT XS (that's S-Corp). - sba_business_type_code covers SBA-certified programs, which SAM.gov filters through a dedicated sbaBusinessTypeCode parameter: A6 (8(a) Program Participant), XX (HUBZone), JT (8(a) Joint Venture), A4 (Small Disadvantaged Business), A9 (SBA-Certified WOSB), A0 (SBA-Certified EDWOSB). Per the SAM data dictionary, XX is HUBZone and A6 is 8(a); do not swap them. Note A9 is the SBA-CERTIFIED WOSB population; 8W on business_type_code is the broader self-designated WOSB flag. SBA codes passed to business_type_code raise a redirect error. - state_code is 2-letter USPS. - purpose_of_registration: Z1=Federal Assistance Awards only, Z2=All Awards, Z3=IGT-Only (Intra-Governmental Transactions), Z4=Federal Assistance Awards and IGT, Z5=All Awards and IGT. (Pre-1.0.2 releases blocked Z3/Z4 and mislabeled Z5 as "Supplemental grants".) - free_text (q parameter) ANDs multiple words together. "cybersecurity cloud" returns entities matching BOTH words, not either. Default registration_status is 'A' (Active); use 'E' for expired registrations. Only A and E are real filt…
| Name | Type | Req | Description |
|---|---|---|---|
| any_naics | – | – | – |
| business_type_code | – | – | – |
| free_text | – | – | – |
| include_sections | – | – | – |
| legal_business_name | – | – | – |
| page | integer | – | – |
| primary_naics | – | – | – |
| psc_code | – | – | – |
| purpose_of_registration | – | – | – |
| registration_status | string | – | – |
| sba_business_type_code | – | – | – |
| size | integer | – | – |
| state_code | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_exclusions ~313
Search SAM.gov exclusion records with flexible filters. All filters are AND-ed. Unlike Entity Management, Exclusions uses 'size' (not 'limit') for pagination. Size can go up to 100 per page. Key filter notes: - entity_name: firm name for classification=Firm; for individuals use the full name. Cannot contain &, |, {, }, ^, backslash. - cage_code: 5-character CAGE of the excluded entity. - classification: Firm, Individual, Vessel, or Special Entity Designation. - exclusion_program: Reciprocal (cross-agency), NonProcurement, or Procurement. - excluding_agency_code: agency code that imposed the exclusion (e.g., DOD, HHS). - country: MUST be 3-character ISO alpha-3 (USA, CAN, GBR). 2-char codes (US, CA, GB) return 0 results. - activation_date_range: use bracket format [MM/DD/YYYY,MM/DD/YYYY]. - free_text (q parameter): supports wildcards (*), AND, OR operators. Example: "acme*" matches any company starting with acme.
| Name | Type | Req | Description |
|---|---|---|---|
| activation_date_range | – | – | – |
| cage_code | – | – | – |
| classification | – | – | – |
| country | – | – | – |
| entity_name | – | – | – |
| excluding_agency_code | – | – | – |
| exclusion_program | – | – | – |
| free_text | – | – | – |
| page | integer | – | – |
| size | integer | – | – |
| state_province | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_federal_organizations ~390
Search the SAM.gov Federal Hierarchy. Returns federal organizations (departments, agencies, sub-agencies, offices) with their FH IDs, codes, hierarchical relationships, and status. Useful for normalizing agency names to canonical FH IDs before passing them to Contract Awards, Opportunities, or Subaward searches. Filter notes: - fh_org_id: exact lookup by Federal Hierarchy organization ID (numeric). - fh_org_name: partial substring match on the organization name. - fh_org_type: case-insensitive substring filter. Live values from the API look like 'Department/Ind. Agency', but the API also accepts shorthand like 'DEPARTMENT' or 'AGENCY' and matches loosely. Pass whatever the response showed, or one of: department, agency, sub-agency, office, major command, field activity. - status: ACTIVE (default if filter omitted), INACTIVE (retired), or MERGED. Live audit (April 2026): the API defaults to ACTIVE-only when no filter is sent, so passing status='ACTIVE' is a no-op vs. the unfiltered call. Pass 'INACTIVE' to expand the search to retired orgs. - agency_code: legacy agency code if known. - cgac: Common Government-wide Accounting Classification (Treasury) code. Pagination uses limit (1-100) / offset (0-based). The Federal Hierarchy API uses lowercase 'totalrecords' and 'orglist' in responses (unlike the camelCase used elsewhere in SAM.gov); the normalizer preserves both keys.
| Name | Type | Req | Description |
|---|---|---|---|
| agency_code | – | – | – |
| cgac | – | – | – |
| fh_org_id | – | – | – |
| fh_org_name | – | – | – |
| fh_org_type | – | – | – |
| limit | integer | – | – |
| offset | integer | – | – |
| status | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_opportunities ~588
Search contract opportunities on SAM.gov. posted_from and posted_to are MANDATORY. Format is MM/DD/YYYY (not ISO 8601). The date range cannot exceed 364 days. For older notices or longer ranges, chain multiple calls with sequential date windows. Notice type codes: - p = Presolicitation - o = Solicitation - k = Combined Synopsis/Solicitation - r = Sources Sought - s = Special Notice - i = Intent to Bundle - a = Award Notice - u = Justification (J&A) - g = Sale of Surplus Property WORKING filters: title, solicitation_number, notice_id, notice_type, naics_code, psc_code, set_aside, state, zip_code, response_deadline_from, response_deadline_to. BROKEN filters (do not use): deptname, subtier. The SAM.gov API silently ignores these. To filter by agency, use agency_keyword: this tool will post-filter the results by checking fullParentPathName for a substring match. PSC code filter (psc_code) requires exact 4-character match. Prefix matching (e.g. 'R4') returns 0 results; use 'R425'. Set-aside codes: SBA, SBP, 8A, 8AN, HZC, HZS, SDVOSBC, SDVOSBS, WOSB, WOSBSS, EDWOSB, EDWOSBSS, LAS (Local Area), IEE (Buy Indian Act), ISBEE (Buy Indian Act small business), BICiv (IHS Buy Indian), VSA, VSS. Case-insensitive; documented casing goes on the wire. The 'description' field in each result is a URL, not inline text. Use get_opportunity_description() to fetch the actual description HTML. Pagination (live-verified 2026-08): offset is a ZERO-BASED PAGE INDEX (page size = limit), not a record skip count; offset=1 with limit=100 returns records 101-200. Compute the last page from totalRecords and stop there: pages past the end do NOT come back empty, they return one arbitrary record, so an empty-page loop terminator never fires.
| Name | Type | Req | Description |
|---|---|---|---|
| agency_keyword | – | – | – |
| limit | integer | – | – |
| naics_code | – | – | – |
| notice_id | – | – | – |
| notice_type | – | – | – |
| offset | integer | – | – |
| posted_from | string | yes | – |
| posted_to | string | yes | – |
| psc_code | – | – | – |
| response_deadline_from | – | – | – |
| response_deadline_to | – | – | – |
| set_aside | – | – | – |
| solicitation_number | – | – | – |
| state | – | – | – |
| title | – | – | – |
| zip_code | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_psc_free_text ~77
Free-text search for Product/Service Codes (PSC). Searches across PSC names, descriptions, and category hierarchy. Returns matching PSC codes with full context. Useful for discovering PSCs from plain-language descriptions like 'engineering' or 'application development'.
| Name | Type | Req | Description |
|---|---|---|---|
| active_only | string | – | – |
| query | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
vendor_responsibility_check ~200
Composite pre-award vendor responsibility check per FAR 9.104-1. Performs TWO API calls in sequence: 1. Entity Management lookup (registration status, business types, CAGE, activation/expiration dates, exclusion flag on the entity record) 2. Exclusions lookup (active debarment/suspension records) Returns a structured summary with: - registration: full registration details or None if not registered - exclusion: exclusion record count and active exclusion details - flags: list of responsibility concern flags Flag meanings: - NOT_REGISTERED: entity has no SAM registration (cannot receive award per FAR 4.1102) - REGISTRATION_NOT_ACTIVE: registration expired or inactive - EXCLUSION_FLAG_ON_ENTITY: entity record indicates exclusion exists - ACTIVE_EXCLUSION_FOUND: confirmed active exclusion (FAR 9.405 prohibits award) No flags = clear for responsibility determination.
| Name | Type | Req | Description |
|---|---|---|---|
| uei | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
What is the SAM.gov MCP server?
SAM.gov is an MCP server listed in the public MCP registry as com.1102tools/sam-gov-mcp. SAM.gov readiness, entities, exclusions, opportunities, awards, hierarchy, and subawards. 20 tools. This page covers its PyPI package (sam-gov-mcp).
Is the SAM.gov MCP server safe to use?
SAM.gov scores 63 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SAM.gov MCP server expose?
SAM.gov exposes 20 tools: get_access_status, lookup_entity_by_uei, lookup_entity_by_cage, search_entities, get_entity_reps_and_certs, and 15 more. Their descriptions and schemas cost roughly 5,401 tokens of context every time the server is loaded.
Is the SAM.gov MCP server still maintained?
SAM.gov is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SAM.gov MCP server under?
SAM.gov declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.