io.github.IDNSIDNS/tenderapi-mcp
PYPI · TENDERAPI-MCP · 2 COMPONENTS
MCP server for French (BOAMP) + EU (TED) public procurement data via TenderAPI.
Available components
Last scanned (7 hours ago)
Scores higher than 59% of PyPI servers
Category Search and Retrieval
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 31 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 21 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3786 tokens (~291/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_profile" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 3 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 2 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 1 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
- 30 Oct 26 0
- Stability: pass → 0.97 functional
- 29 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 24 Oct 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/tenderapi-mcp@0.9.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 31 packages
| Packages resolved | 31 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
billing_portal ~63
Return a Stripe Customer Portal URL for the authenticated key. The user can manage their subscription, update payment method, download invoices, or cancel. Present this URL to the human user; the agent cannot interact with the portal directly.
| Name | Type | Req | Description |
|---|---|---|---|
| return_url | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
create_profile ~548
Create a matching profile. New tenders matching the filters are delivered automatically as an EMAIL digest (channel="email"), an Adaptive Card to Microsoft TEAMS (channel="teams"), or pushed to a WEBHOOK (channel="webhook"). Free key: pass channel="email" (Teams and webhook return 403). One profile, delivered every Monday to the account address (email_to is ignored). Pro: up to 10 profiles, delivered every morning, any channel. At least one filter (keywords, cpv_codes, regions, departments, siret, descripteur_keywords, or a budget range) should be set, otherwise the profile matches everything. Args: name: Human-readable label. channel: "email" (email digest: weekly on free, daily on Pro), "teams" (Adaptive Card to a Teams workflow URL), or "webhook" (per-tender HTTP push). Defaults to "webhook" if omitted. webhook_url: Destination URL for channel="webhook" (JSON POST) or channel="teams" (paste the Teams workflow's incoming POST URL). email_to: Recipient address for the digest (channel="email", Pro only; a free key always delivers to its account address). siret: Restrict to a specific buyer. keywords: List of substrings matched against title/description. cpv_codes: List of exact CPV codes. regions: List of French region slugs. departments: List of French department codes. descripteur_keywords: List of BOAMP business descripteurs (max 20); requires match_descripteur=True. Targets MAPA notices that carry no CPV code. budget_min / budget_max: Budget window in EUR. match_cpv_family: If true, `cpv_codes` are treated as 2-digit family prefixes (e.g. "72" matches every CPV starting with 72). match_descripteur: If true, enable matching on `descripteur_keywords` (default false). active: Whether the profile is active (default true). Set false to pause webhook deliveries without deleting it.
| Name | Type | Req | Description |
|---|---|---|---|
| active | – | – | – |
| budget_max | – | – | – |
| budget_min | – | – | – |
| channel | – | – | – |
| cpv_codes | – | – | – |
| departments | – | – | – |
| descripteur_keywords | – | – | – |
| email_to | – | – | – |
| keywords | – | – | – |
| match_cpv_family | – | – | – |
| match_descripteur | – | – | – |
| name | string | yes | – |
| regions | – | – | – |
| siret | – | – | – |
| webhook_url | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
delete_profile ~29
Delete a matching profile. Stops all future webhook deliveries for it.
| Name | Type | Req | Description |
|---|---|---|---|
| profile_id | integer | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_award ~35
Fetch the full record of a single award notice by its ID. Requires the Pro tier.
| Name | Type | Req | Description |
|---|---|---|---|
| award_id | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_profile ~26
Fetch a single matching profile by its integer ID.
| Name | Type | Req | Description |
|---|---|---|---|
| profile_id | integer | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_tender ~58
Fetch the full record of a single tender by its ID. Use this after `search_tenders` to get the complete details (description, documents, contact info, raw fields) of a specific notice.
| Name | Type | Req | Description |
|---|---|---|---|
| tender_id | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
list_profiles ~121
List the matching profiles owned by the authenticated key. A profile = a saved filter + a delivery channel. New tenders matching the profile's criteria are delivered automatically: an EMAIL digest (channel="email"), an Adaptive Card to Microsoft TEAMS (channel="teams"), or a per-tender push to a WEBHOOK (channel="webhook"). Free key: 1 profile, email only, sent to the account address every MONDAY with the week's new notices. Pro: up to 10 profiles, delivered every morning, email, Teams or webhook.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
me ~67
Return the authenticated key's tier, quota, and available features. Useful for the agent to check quota before launching many calls or to pick a tier-appropriate strategy. Response includes `tier`, `quota_day_limit`, `quota_remaining_today`, `requests_today`, `requests_month`, `features`.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
search_awards ~887
Search award notices: who won which public contract, for how much. Requires the Pro tier. A free key gets the exact match count with the rows locked (see below); if the user wants the rows, `upgrade_tier` opens checkout. Args: cpv: Exact CPV code. cpv_family: 2-digit CPV family prefix. descripteur: BOAMP business descripteur(s), comma-separated; substring match for notices without a CPV code. region: French region slug (INSEE region codes like "11" accepted). department: French department code. country: ISO 3166-1 alpha-2 country code (e.g. "FR", "DE"); alpha-3 also accepted for supported countries. source: "boamp" or "ted". outcome: Filter by award result: "awarded" | "cancelled" (comma-separated list accepted, e.g. "awarded,cancelled"). winner_name: Partial match on winning company name. winner_siret: Exact winner SIRET (14 digits — one establishment). winner_siren: Winner SIREN (9 digits — company level; matches every establishment of the company). Prefer this to aggregate a whole group. buyer_siret: Exact buyer SIRET. buyer_keyword: Partial match on buyer name. keyword: Full-text search across the award notice text (accent-insensitive). Words are combined with AND — every word must appear in the same notice. Join synonyms with the OR operator for a broad search, e.g. keyword=dragage OR dredging OR draguage. Comma- or pipe-separated lists are NOT parsed as OR. amount_min: Minimum contract amount, EUR. amount_max: Maximum contract amount, EUR. awarded_after: ISO date; award date after this. awarded_before: ISO date; award date before this. has_parent_tender: Filter by linkage to the originating tender (AO). True = only awards linked to their tender; False = only standalone awards (negotiated/direct procedures with no published prior notice). Omit for all. published_after: ISO date. published_before: ISO date. sort: "date" (default — newest first) or "relevance" (BM25 best-ma…
| Name | Type | Req | Description |
|---|---|---|---|
| amount_max | – | – | – |
| amount_min | – | – | – |
| awarded_after | – | – | – |
| awarded_before | – | – | – |
| buyer_keyword | – | – | – |
| buyer_siret | – | – | – |
| country | – | – | – |
| cpv | – | – | – |
| cpv_family | – | – | – |
| department | – | – | – |
| descripteur | – | – | – |
| has_parent_tender | – | – | – |
| keyword | – | – | – |
| limit | – | – | – |
| outcome | – | – | – |
| page | integer | – | – |
| page_size | integer | – | – |
| published_after | – | – | – |
| published_before | – | – | – |
| region | – | – | – |
| sort | – | – | – |
| source | – | – | – |
| winner_name | – | – | – |
| winner_siren | – | – | – |
| winner_siret | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_tenders ~1,286
Search public procurement tenders from BOAMP (France) and TED (EU). Returns a paginated list of tender notices matching the filters. Args: cpv: Exact CPV code (e.g. "72000000" for IT services). cpv_family: 2-digit CPV family prefix (e.g. "72" matches all IT-services CPVs). descripteur: BOAMP business descripteur(s), comma-separated (e.g. "couverture" or "etude,btp"). Case-insensitive substring match; targets MAPA notices that carry no CPV code. keyword: Full-text search across title and description (accent-insensitive). Words are combined with AND — every word must appear in the SAME notice, so a long space-separated list (e.g. "bathymetric hydrographic survey lidar coastal") almost always returns zero results. For a broad topic search, join synonyms with the OR operator instead, e.g. keyword=bathymétrie OR hydrographie OR lidar OR dredging. TED notices are indexed in their publication language (FR/DE/ES/IT/EN), so include each concept in the relevant languages joined by OR. Comma- or pipe-separated lists are NOT parsed as OR. region: French region slug, lowercase (e.g. "occitanie", "ile-de-france", "bretagne"). Pre-2016 region names and INSEE region codes ("11", "76", "84") are accepted as aliases. department: French department code (e.g. "75", "2A", "974"). country: ISO 3166-1 alpha-2 country code (e.g. "FR", "DE"). Alpha-3 (e.g. "FRA") also accepted for supported countries. Defaults to FR for BOAMP. source: "boamp" (France) or "ted" (FR/DE/IT/ES/UK). Omit to include both. include_planning: When True, include TED prior-information notices (PINs) that announce upcoming procurements. Excluded by default (not yet biddable, no deadline). status: "open" or "closed", nothing else. "open" = submission deadline in the future, or unknown on a notice still published. Awarded contracts are not a tender status: use search_awards for those. procedure_type: Procurement procedure (e.g. "open", "restricted", "negotiated"). contra…
| Name | Type | Req | Description |
|---|---|---|---|
| budget_max | – | – | – |
| budget_min | – | – | – |
| buyer_keyword | – | – | – |
| buyer_siret | – | – | – |
| contract_type | – | – | – |
| country | – | – | – |
| cpv | – | – | – |
| cpv_family | – | – | – |
| deadline_after | – | – | – |
| deadline_before | – | – | – |
| department | – | – | – |
| descripteur | – | – | – |
| include_null_budget | boolean | – | – |
| include_null_deadline | boolean | – | – |
| include_planning | boolean | – | – |
| keyword | – | – | – |
| limit | – | – | – |
| page | integer | – | – |
| page_size | integer | – | – |
| procedure_type | – | – | – |
| published_after | – | – | – |
| published_before | – | – | – |
| region | – | – | – |
| sort | – | – | – |
| source | – | – | – |
| status | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
update_profile ~176
Replace a profile's filters and webhook. Only non-None fields are sent; fields left as None keep their current value on the server. `descripteur_keywords` (with `match_descripteur=True`) matches MAPA notices that carry no CPV code. `active=False` pauses webhook deliveries without deleting the profile.
| Name | Type | Req | Description |
|---|---|---|---|
| active | – | – | – |
| budget_max | – | – | – |
| budget_min | – | – | – |
| channel | – | – | – |
| cpv_codes | – | – | – |
| departments | – | – | – |
| descripteur_keywords | – | – | – |
| email_to | – | – | – |
| keywords | – | – | – |
| match_cpv_family | – | – | – |
| match_descripteur | – | – | – |
| name | – | – | – |
| profile_id | integer | yes | – |
| regions | – | – | – |
| siret | – | – | – |
| webhook_url | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
upgrade_tier ~230
Start a Stripe Checkout session to upgrade the authenticated key to a higher tier. Only "pro" is sold (15 €/month); "starter" was retired on 2026-10-14. IMPORTANT: this does NOT charge anything by itself. It returns a `checkout_url` that the agent MUST present to the human user. Payment requires the user's card on Stripe's hosted page. Once paid, the key is automatically upgraded. Use this when a tool call fails with 402/403 because the feature is gated (`search_awards`, `get_award` and `winner_intel` need Pro), or when the user wants their watch delivered every morning instead of every Monday. Args: tier: "pro" (default, the only tier on sale). success_url: Where Stripe redirects after successful payment. cancel_url: Where Stripe redirects if the user cancels. Returns: {"checkout_url": "...", "session_id": "..."}
| Name | Type | Req | Description |
|---|---|---|---|
| cancel_url | – | – | – |
| success_url | – | – | – |
| tier | string | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
winner_intel ~260
Aggregated winner statistics: top companies by contract count and total amount. Requires Pro tier. Use for competitive intelligence: "which companies win IT contracts in Occitanie in 2025?" or "what has SIRET 12345678901234 won across all sectors?". Args: cpv: CPV code filter. cpv_family: 2-digit CPV family prefix filter. region: Region slug (INSEE region codes like "11" accepted). country: ISO 3166-1 alpha-2 country code (e.g. "FR", "DE"); alpha-3 also accepted for supported countries. year: Integer year filter (e.g. 2025). winner_siret: Pin to a single establishment (14-digit SIRET). winner_siren: Pin to a whole company (9-digit SIREN — aggregates all its establishments). limit: Top N results (default 10, max 50).
| Name | Type | Req | Description |
|---|---|---|---|
| country | – | – | – |
| cpv | – | – | – |
| cpv_family | – | – | – |
| limit | integer | – | – |
| region | – | – | – |
| winner_siren | – | – | – |
| winner_siret | – | – | – |
| year | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
How do I install the io.github.IDNSIDNS/tenderapi-mcp server?
io.github.IDNSIDNS/tenderapi-mcp runs locally as a PyPI package, launched with uvx tenderapi-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · tenderapi-mcp
claude mcp add idnsidns-tenderapi-mcp -- uvx tenderapi-mcp
What is the io.github.IDNSIDNS/tenderapi-mcp server?
io.github.IDNSIDNS/tenderapi-mcp is listed in the public MCP registry as io.github.IDNSIDNS/tenderapi-mcp. MCP server for French (BOAMP) + EU (TED) public procurement data via TenderAPI. This page covers its PyPI package (tenderapi-mcp).
Is the io.github.IDNSIDNS/tenderapi-mcp server safe to use?
io.github.IDNSIDNS/tenderapi-mcp scores 62 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.IDNSIDNS/tenderapi-mcp server expose?
io.github.IDNSIDNS/tenderapi-mcp exposes 13 tools: search_tenders, get_tender, search_awards, get_award, winner_intel, and 8 more. Their descriptions and schemas cost roughly 3,786 tokens of context every time the server is loaded.
Is the io.github.IDNSIDNS/tenderapi-mcp server still maintained?
io.github.IDNSIDNS/tenderapi-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.IDNSIDNS/tenderapi-mcp server under?
io.github.IDNSIDNS/tenderapi-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.