Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Diavgis — Greek Public Procurement

REMOTE · MCP.DIAVGIS.GR

Greek public procurement: tenders, awards, contracts, payments, suppliers, expiring contracts.

Available components

0 this week 89 Trust /100

Last scanned (17 hours ago)

Scores higher than 97% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Finance and Payments

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security83
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. See how to fix → View diagnostics → Partial
  • HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
  • The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
  • DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
Schema Quality & AI Usability75
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3026 tokens (~302/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 94% of tool parameters carry a description.Partial
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
What we tested

Checks we ran (13)

  • TLS certificate
  • Authorization
  • HTTPS
  • HSTS header
  • DNSSEC
  • Transport
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this hosted endpoint (2)

  • Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
  • Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 28 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “expiring_contracts” rewrote its description, which is the text the model reads security
    • Tool “find_entity” rewrote its description, which is the text the model reads security
    • Tool “get_quota” rewrote its description, which is the text the model reads security
    • Tool “search_tenders” rewrote its description, which is the text the model reads security
    • Tool “spend_by_cpv” rewrote its description, which is the text the model reads security
    • Server version: 1.4.0 → 1.5.0 functional
  • 25 Oct 26 0
    • Tool “get_act” rewrote its description, which is the text the model reads security
    • Server version: 1.3.0 → 1.4.0 functional
  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 2 Sept 26 0
    • Tool “get_act” rewrote its description, which is the text the model reads security
    • Tool “get_chain” rewrote its description, which is the text the model reads security
  • 1 Sept 26 0
    • Stability: 0.97 → pass security
  • 29 Aug 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Schema quality: 303 → 272 ▲ functional
    • Tool coverage: 88% → 100% ▲ functional
    • Tool “expiring_contracts” now declares an output schema ▲ functional
    • Server version: 1.2.0 → 1.3.0 functional
    • New tool “find_entity” functional
    • New tool “get_quota” functional
  • 28 Aug 26 0
    • Judged manipulation: unverified → pass ▲ security
    • Tool “search_tenders” rewrote its description, which is the text the model reads security
    • Schema quality: unverified → excellent ▲ functional
    • “search_tenders” added an optional parameter “deadline_after” cosmetic
    • “search_tenders” added an optional parameter “region” cosmetic
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://mcp.diavgis.gr/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=diavgis.gr CN=WE1,O=Google Trust Services,C=US 9 Oct 2026 7 Jan 2027 ECDSA 256 ECDSA-SHA256 532702a124814bff0e6ea7603d8d5ef3
SANs: diavgis.gr, mcp.diavgis.gr, *.mcp.diavgis.gr
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC secure

Validation of mcp.diavgis.gr. — Secure

Zone DS Keys Algorithms Outcome
. Trust anchor 20326, 38696 8, 8 Verified
gr. DS published 51282 13 Verified
diavgis.gr. DS published 2371 13 Verified
mcp.diavgis.gr. Verified address RRset verified with the apex keys
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains; preload
x-content-type-options nosniff

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.diavgis.gr/mcp Verified 200
http (plaintext) http://mcp.diavgis.gr/mcp HTTPS enforced 301 https://mcp.diavgis.gr/mcp
MCP tools · 10 exposed · ~2,048 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
entity_counterparties ~89

Top counterparties of an entity (ΑΦΜ): for a buyer, the suppliers it pays most; for a supplier, its top public buyers — with act counts and EUR totals. The 'who does business with whom' due-diligence view.

NameTypeReqDescription
afmstringyes9-digit ΑΦΜ
limitnumber–max 30, default 10
NameTypeReqDescription
afmstringyes–
counterpartiesarrayyes–

No examples provided.

expiring_contracts ~330

Greek public contracts that are RUNNING NOW and expire within a horizon of 0, 7, 30 or 180 days — the renewal pipeline. Each row carries who currently holds the contract and HOW it was awarded (direct award vs competitive tender, and the number of bids where the source reports it), which is what tells you whether the re-tender is worth chasing. One procurement is counted ONCE: Greek sources publish the duration on the award record as well as the contract, so award records are dropped when a contract in the same lifecycle chain already defines the expiry. ⚠ `expiry_basis` on every row states how the date was obtained — `published` (the buyer published an end date), `computed_from_start` (start date + declared duration) or `computed_from_publication` (no start date published, so the publication date was substituted; systematically early). A computed date is an estimate, not a published date. ACCESS: horizon 0 (expiring today) is free on every plan and returns the complete record. Horizons 7/30/180 require a paid plan — lead time is the paid product.

NameTypeReqDescription
cpvstring–CPV division, 2 digits (e.g. 33 for medical equipment)
hnumber–horizon in days; 0 = expiring today (free on every plan). Default 180.
page_sizenumber–rows to return, 1-200 (default 50)
regionstring–NUTS code, e.g. EL30 for Attica
NameTypeReqDescription
dataarrayyes–
horizon_daysnumber––
nextnumber|nullyesnext page NUMBER, or null at the end
pagenumberyes–
page_sizenumberyes–
totalnumberyes–

No examples provided.

find_entity ~145

Resolve a Greek buyer or supplier NAME to its ΑΦΜ. For when you have a name but no ΑΦΜ: get_entity, entity_counterparties and the buyer_afm/supplier_afm filters take the 9-digit number. Matching is accent- and case-insensitive; returns the closest names with their ΑΦΜ.

NameTypeReqDescription
kindstring–Restrict to public bodies (buyer) or companies (supplier). Omit for all.
limitnumber–1-20, default 8
namestringyesFull or partial name, e.g. "Δήμος Αθηναίων". Accents and case are ignored.
NameTypeReqDescription
matchesarrayyes–
querystringyes–

No examples provided.

get_act ~221

Full detail of one act by its id (Διαύγεια ΑΔΑ, ΚΗΜΔΗΣ 'kimdis:<ΑΔΑΜ>', or TED 'ted:<number>'): canonical fields, resolved buyer/supplier entities, CPV codes with labels, and its cross-source lifecycle chain if linked. On ΚΗΜΔΗΣ contracts, `commitment_ada` carries the Διαύγεια ΑΔΑ of the budget-commitment decision the source declares (comma-separated when more than one). It is a pointer INTO Διαύγεια, not an act we necessarily hold — resolve it at diavgeia.gov.gr, not through this API — and it is deliberately NOT a chain edge: one annual commitment funds many unrelated contracts. On tenders and public-works awards/contracts, `discount` carries the contractor discount (official from the document, or calculated) — see its schema.

NameTypeReqDescription
adastringyesact id — ΑΔΑ, 'kimdis:<ΑΔΑΜ>' or 'ted:<number>'
NameTypeReqDescription
actobjectyes–
buyerobject|nullyes–
chainobject|nullyes–
cpvsarrayyesCPV classifications with their official Greek labels
discountobject–Contractor discount, only on tenders and on public-works (CPV 45) awards/contracts. The key is ABSENT when there is nothing to show (not null). basis "document" = the percentage exactly as the award…
supplierobject|nullyes–

No examples provided.

get_chain ~143

A reconstructed procurement lifecycle chain by chain_id: the linked sequence of related acts (e.g. commitment → award → contract → payments) with confidence and link method. Get a chain_id from the chain_id field of any act. A chain is ONE procurement's lifecycle, not everything an act references: an administrative umbrella cited by more than 25 acts (e.g. one annual expense-approval decision referenced by thousands of a buyer's acts) is deliberately NOT merged, so a chain never swallows a year of unrelated activity. Those references are still published — see the act's own references — they simply do not form a chain.

NameTypeReqDescription
chain_idstringyes–
NameTypeReqDescription
chain_idstringyes–
membersarrayyes–

No examples provided.

get_entity ~117

Profile of a legal entity (company or public body) by 9-digit ΑΦΜ: name, role, and spend/receipt statistics as buyer and as supplier. EUR totals = the COMMITTED procurement value counted ONCE per procurement (deduplicated across ΚΗΜΔΗΣ/Διαύγεια sources and the award→contract→payment lifecycle; tenders/budgets excluded), so it reflects real committed spend, not a sum of every published act.

NameTypeReqDescription
afmstringyes9-digit ΑΦΜ
NameTypeReqDescription
afmstringyes–
first_seenstring|null––
kindstring–buyer | supplier
last_seenstring|null––
namestringyes–
statsobject|nullyes–

No examples provided.

get_quota ~74

What your Diavgis plan allows right now (the same for an API key and a connected account): plan, calls used this period, calls remaining, per-minute rate, page-size and pagination caps, and when the period resets. Free — this call is not counted against the quota. Useful for sizing a long job.

Input schema present but exposes no named parameters.

NameTypeReqDescription
limitnumber|null–monthly quota, null if unlimited
max_page_sizenumberyes–
max_pagesnumberyespagination depth cap; deeper pages return an error, narrow with filters instead
period_resetstringyesISO date when used resets to 0
planstringyes–
pricing_urlstring––
rate_per_minnumberyes–
remainingnumber|null––
usednumberyescalls consumed this period (REST + MCP share one counter)

No examples provided.

rank_entities ~175

Rank top Greek public-procurement entities. role=buyer (default) or supplier; by=spend (default — COMMITTED procurement value in EUR, counted ONCE per procurement: deduplicated across sources and lifecycle stages, tenders excluded), single_bidder (count of ≤1-bid awards/contracts) or direct_award (count of απευθείας ανάθεση). Answers 'top 10 suppliers by public revenue', 'which buyers award most without competition'. Returns afm, name, metric, total. Precomputed and refreshed every 6 hours, so it is instant and always the top 15.

NameTypeReqDescription
bystring–default spend
limitnumber–max 15, default 15 — the published ranking holds the top 15
rolestring–default buyer
NameTypeReqDescription
bystringyes–
resultsarrayyes–
rolestringyes–

No examples provided.

search_tenders ~628

Search Greek public-procurement acts across THREE cross-linked sources — Διαύγεια, ΚΗΜΔΗΣ (Central Electronic Public Procurement Registry) and EU TED. Filter by source (diavgeia|kimdis|ted), lifecycle status (request|tender|award|contract|payment), buyer or supplier ΑΦΜ (9-digit tax id), CPV code, EUR budget range, NUTS region, submission deadline (deadline_after=TODAY + status=tender ⇒ the OPEN tenders a supplier can still bid on), free-text q over the act title, and procurement signals (published facts from ΚΗΜΔΗΣ): direct_award (απευθείας ανάθεση), single_bidder (≤1 bid on the contract), cancelled. Returns a paginated envelope; 'next' is the next PAGE NUMBER or null. Natural-person counterparties are redacted. Summing amount_net across results double-counts, because one procurement appears at several stages; rank_entities and spend_by_cpv count each procurement once.

NameTypeReqDescription
budget_maxnumber–maximum amount_net in EUR
budget_minnumber–minimum amount_net in EUR
buyer_afmstring–9-digit buyer ΑΦΜ
cancelledboolean–only acts the source marked as cancelled
cpvstring–CPV code (e.g. 79710000)
deadline_afterstring–ISO date (YYYY-MM-DD). Only acts whose submission deadline is on/after this date. Pass TODAY to get OPEN tenders — the ones a supplier can still bid on. Combine with status="tender".
direct_awardboolean–only direct awards (procedure = απευθείας ανάθεση) — a published ΚΗΜΔΗΣ fact
has_chainboolean–only acts linked into a reconstructed lifecycle chain (request→tender→award→contract→payment)
pagenumber–1-based page number; pagination DEPTH is capped per plan
page_sizenumber–max 200
price_onlyboolean–only awards/contracts decided on lowest-price alone (award_criteria = Βάσει τιμής / Χαμηλότερη Τιμή), excluding most-economically-advantageous (MEAT) criteria
qstring–free-text search over the act title
regionstring–NUTS region code prefix, e.g. EL30 (Attica), EL52 (Central Macedonia). Matches by prefix, so EL3 covers all of Attica.
single_bidderboolean–only contracts where ≤1 bid was submitted (maxBidsSubmitted; single bidder)
sourcestring–filter by data source
statusstring––
supplier_afmstring–9-digit supplier ΑΦΜ
yearstring–4-digit issue year, e.g. 2026 — restricts to acts issued that year
NameTypeReqDescription
dataarrayyes–
nextnumber|nullyesnext page NUMBER, or null when there are no more pages — not a URL
pagenumberyes–
page_sizenumberyes–
totalnumberyestotal acts matching the filters

No examples provided.

spend_by_cpv ~126

Committed public procurement value by CPV category (2-digit division), optionally for one year. Value = counted ONCE per procurement (deduplicated across sources and award/contract/payment stages; tenders excluded). Answers 'what does the Greek state spend the most on'. Returns cpv_division, acts, spend (EUR) for the top divisions by spend — precomputed nightly, so it is instant. Divisions outside the top list are available through search_tenders with cpv=.

NameTypeReqDescription
yearstring–4-digit year; omit for all-time
NameTypeReqDescription
divisionsarrayyes–
yearstringyesthe year filtered on, or 'all'

No examples provided.

Install

How do I install the Diavgis — Greek Public Procurement MCP server?

Diavgis — Greek Public Procurement is a hosted endpoint at https://mcp.diavgis.gr/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.diavgis.gr

# add to Claude Code
claude mcp add --transport http gr-diavgis-procurement 'https://mcp.diavgis.gr/mcp'
Common questions

What is the Diavgis — Greek Public Procurement MCP server?

Diavgis — Greek Public Procurement is an MCP server listed in the public MCP registry as gr.diavgis/procurement. Greek public procurement: tenders, awards, contracts, payments, suppliers, expiring contracts. This page covers its hosted endpoint (https://mcp.diavgis.gr/mcp).

Is the Diavgis — Greek Public Procurement MCP server safe to use?

Diavgis — Greek Public Procurement scores 89 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Diavgis — Greek Public Procurement MCP server expose?

Diavgis — Greek Public Procurement exposes 10 tools: search_tenders, expiring_contracts, get_act, get_entity, get_chain, and 5 more. Their descriptions and schemas cost roughly 2,048 tokens of context every time the server is loaded.

Does the Diavgis — Greek Public Procurement MCP server require authentication?

No. We connected to Diavgis — Greek Public Procurement without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Diavgis — Greek Public Procurement MCP server still maintained?

Diavgis — Greek Public Procurement is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What did VerifyMCP test on the Diavgis — Greek Public Procurement MCP server?

VerifyMCP ran 13 checks on Diavgis — Greek Public Procurement, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.