io.github.IDNSIDNS/tenderapi-mcp
PYPI · TENDERAPI-MCP · 2 COMPONENTS · SCANNED SEP 20
MCP server for French (BOAMP) + EU (TED) public procurement data via TenderAPI.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 32 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 38 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability58
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3529 tokens (~271/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_profile" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the io.github.IDNSIDNS/tenderapi-mcp server?
io.github.IDNSIDNS/tenderapi-mcp runs locally as a PyPI package, launched with uvx tenderapi-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · tenderapi-mcp
claude mcp add idnsidns-tenderapi-mcp -- uvx tenderapi-mcp
{
"mcpServers": {
"idnsidns-tenderapi-mcp": {
"command": "uvx",
"args": [
"tenderapi-mcp"
]
}
}
} {
"servers": {
"idnsidns-tenderapi-mcp": {
"command": "uvx",
"args": [
"tenderapi-mcp"
]
}
}
} codex mcp add idnsidns-tenderapi-mcp -- uvx tenderapi-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"idnsidns-tenderapi-mcp": {
"type": "local",
"command": [
"uvx",
"tenderapi-mcp"
],
"enabled": true
}
}
} openclaw mcp add idnsidns-tenderapi-mcp --command uvx --arg tenderapi-mcp
mcp_servers:
idnsidns-tenderapi-mcp:
command: "uvx"
args: ["tenderapi-mcp"] {
"McpServers": {
"idnsidns-tenderapi-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"tenderapi-mcp"
]
}
}
} assistant mcp add idnsidns-tenderapi-mcp -t stdio -c uvx -a tenderapi-mcp
{
"mcpServers": {
"idnsidns-tenderapi-mcp": {
"command": "uvx",
"args": [
"tenderapi-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 +1
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 −3
- Stability: pass → 0.80 functional
- 11 Sept 26 +1
- Stability: 0.97 → pass security
- 9 Sept 26 −1
- Stability: pass → 0.93 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/tenderapi-mcp@0.8.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 32 packages
| Packages resolved | 32 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
billing_portal ~63
Return a Stripe Customer Portal URL for the authenticated key. The user can manage their subscription, update payment method, download invoices, or cancel. Present this URL to the human user; the agent cannot interact with the portal directly.
| Name | Type | Req | Description |
|---|---|---|---|
| return_url | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
create_profile ~482
Create a matching profile. New tenders matching the filters are delivered automatically as a daily EMAIL digest (channel="email"), an Adaptive Card to Microsoft TEAMS (channel="teams"), or pushed to a WEBHOOK (channel="webhook"). At least one filter (keywords, cpv_codes, regions, departments, siret, descripteur_keywords, or a budget range) should be set, otherwise the profile matches everything. Args: name: Human-readable label. channel: "email" (daily email digest), "teams" (Adaptive Card to a Teams workflow URL), or "webhook" (per-tender HTTP push). Defaults to "webhook" if omitted. webhook_url: Destination URL for channel="webhook" (JSON POST) or channel="teams" (paste the Teams workflow's incoming POST URL). email_to: Recipient address for the daily digest (for channel="email"). siret: Restrict to a specific buyer. keywords: List of substrings matched against title/description. cpv_codes: List of exact CPV codes. regions: List of French region slugs. departments: List of French department codes. descripteur_keywords: List of BOAMP business descripteurs (max 20); requires match_descripteur=True. Targets MAPA notices that carry no CPV code. budget_min / budget_max: Budget window in EUR. match_cpv_family: If true, `cpv_codes` are treated as 2-digit family prefixes (e.g. "72" matches every CPV starting with 72). match_descripteur: If true, enable matching on `descripteur_keywords` (default false). active: Whether the profile is active (default true). Set false to pause webhook deliveries without deleting it.
| Name | Type | Req | Description |
|---|---|---|---|
| active | – | – | – |
| budget_max | – | – | – |
| budget_min | – | – | – |
| channel | – | – | – |
| cpv_codes | – | – | – |
| departments | – | – | – |
| descripteur_keywords | – | – | – |
| email_to | – | – | – |
| keywords | – | – | – |
| match_cpv_family | – | – | – |
| match_descripteur | – | – | – |
| name | string | yes | – |
| regions | – | – | – |
| siret | – | – | – |
| webhook_url | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
delete_profile ~29
Delete a matching profile. Stops all future webhook deliveries for it.
| Name | Type | Req | Description |
|---|---|---|---|
| profile_id | integer | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_award ~36
Fetch the full record of a single award notice by its ID. Requires Starter tier or above.
| Name | Type | Req | Description |
|---|---|---|---|
| award_id | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_profile ~26
Fetch a single matching profile by its integer ID.
| Name | Type | Req | Description |
|---|---|---|---|
| profile_id | integer | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_tender ~58
Fetch the full record of a single tender by its ID. Use this after `search_tenders` to get the complete details (description, documents, contact info, raw fields) of a specific notice.
| Name | Type | Req | Description |
|---|---|---|---|
| tender_id | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
list_profiles ~79
List the matching profiles owned by the authenticated key. A profile = a saved filter + a delivery channel. New tenders matching the profile's criteria are delivered automatically: a daily EMAIL digest (channel="email"), an Adaptive Card to Microsoft TEAMS (channel="teams"), or a per-tender push to a WEBHOOK (channel="webhook").
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
me ~67
Return the authenticated key's tier, quota, and available features. Useful for the agent to check quota before launching many calls or to pick a tier-appropriate strategy. Response includes `tier`, `quota_day_limit`, `quota_remaining_today`, `requests_today`, `requests_month`, `features`.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
search_awards ~878
Search award notices: who won which public contract, for how much. Requires Starter tier or above. If the call returns 402/403, suggest the user upgrade via `upgrade_tier`. Args: cpv: Exact CPV code. cpv_family: 2-digit CPV family prefix. descripteur: BOAMP business descripteur(s), comma-separated; substring match for notices without a CPV code. region: French region slug (INSEE region codes like "11" accepted). department: French department code. country: ISO 3166-1 alpha-2 country code (e.g. "FR", "DE"); alpha-3 also accepted for supported countries. source: "boamp" or "ted". outcome: Filter by award result: "awarded" | "cancelled" (comma-separated list accepted, e.g. "awarded,cancelled"). winner_name: Partial match on winning company name. winner_siret: Exact winner SIRET (14 digits — one establishment). winner_siren: Winner SIREN (9 digits — company level; matches every establishment of the company). Prefer this to aggregate a whole group. buyer_siret: Exact buyer SIRET. buyer_keyword: Partial match on buyer name. keyword: Full-text search across the award notice text (accent-insensitive). Words are combined with AND — every word must appear in the same notice. Join synonyms with the OR operator for a broad search, e.g. keyword=dragage OR dredging OR draguage. Comma- or pipe-separated lists are NOT parsed as OR. amount_min: Minimum contract amount, EUR. amount_max: Maximum contract amount, EUR. awarded_after: ISO date; award date after this. awarded_before: ISO date; award date before this. has_parent_tender: Filter by linkage to the originating tender (AO). True = only awards linked to their tender; False = only standalone awards (negotiated/direct procedures with no published prior notice). Omit for all. published_after: ISO date. published_before: ISO date. sort: "date" (default — newest first) or "relevance" (BM25 best-match ranking; requires keyword; winner-name match…
| Name | Type | Req | Description |
|---|---|---|---|
| amount_max | – | – | – |
| amount_min | – | – | – |
| awarded_after | – | – | – |
| awarded_before | – | – | – |
| buyer_keyword | – | – | – |
| buyer_siret | – | – | – |
| country | – | – | – |
| cpv | – | – | – |
| cpv_family | – | – | – |
| department | – | – | – |
| descripteur | – | – | – |
| has_parent_tender | – | – | – |
| keyword | – | – | – |
| limit | – | – | – |
| outcome | – | – | – |
| page | integer | – | – |
| page_size | integer | – | – |
| published_after | – | – | – |
| published_before | – | – | – |
| region | – | – | – |
| sort | – | – | – |
| source | – | – | – |
| winner_name | – | – | – |
| winner_siren | – | – | – |
| winner_siret | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_tenders ~1,185
Search public procurement tenders from BOAMP (France) and TED (EU). Returns a paginated list of tender notices matching the filters. Args: cpv: Exact CPV code (e.g. "72000000" for IT services). cpv_family: 2-digit CPV family prefix (e.g. "72" matches all IT-services CPVs). descripteur: BOAMP business descripteur(s), comma-separated (e.g. "couverture" or "etude,btp"). Case-insensitive substring match; targets MAPA notices that carry no CPV code. keyword: Full-text search across title and description (accent-insensitive). Words are combined with AND — every word must appear in the SAME notice, so a long space-separated list (e.g. "bathymetric hydrographic survey lidar coastal") almost always returns zero results. For a broad topic search, join synonyms with the OR operator instead, e.g. keyword=bathymétrie OR hydrographie OR lidar OR dredging. TED notices are indexed in their publication language (FR/DE/ES/IT/EN), so include each concept in the relevant languages joined by OR. Comma- or pipe-separated lists are NOT parsed as OR. region: French region slug, lowercase (e.g. "occitanie", "ile-de-france", "bretagne"). Pre-2016 region names and INSEE region codes ("11", "76", "84") are accepted as aliases. department: French department code (e.g. "75", "2A", "974"). country: ISO 3166-1 alpha-2 country code (e.g. "FR", "DE"). Alpha-3 (e.g. "FRA") also accepted for supported countries. Defaults to FR for BOAMP. source: "boamp" (France) or "ted" (FR/DE/IT/ES/UK). Omit to include both. include_planning: When True, include TED prior-information notices (PINs) that announce upcoming procurements. Excluded by default (not yet biddable, no deadline). status: "open" | "closed" | "awarded" | "cancelled". procedure_type: Procurement procedure (e.g. "open", "restricted", "negotiated"). contract_type: "works" | "supplies" | "services". buyer_siret: Exact SIRET of the French contracting authority (14 digits). buyer_keyword: Part…
| Name | Type | Req | Description |
|---|---|---|---|
| budget_max | – | – | – |
| budget_min | – | – | – |
| buyer_keyword | – | – | – |
| buyer_siret | – | – | – |
| contract_type | – | – | – |
| country | – | – | – |
| cpv | – | – | – |
| cpv_family | – | – | – |
| deadline_after | – | – | – |
| deadline_before | – | – | – |
| department | – | – | – |
| descripteur | – | – | – |
| include_null_budget | boolean | – | – |
| include_null_deadline | boolean | – | – |
| include_planning | boolean | – | – |
| keyword | – | – | – |
| limit | – | – | – |
| page | integer | – | – |
| page_size | integer | – | – |
| procedure_type | – | – | – |
| published_after | – | – | – |
| published_before | – | – | – |
| region | – | – | – |
| sort | – | – | – |
| source | – | – | – |
| status | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
update_profile ~176
Replace a profile's filters and webhook. Only non-None fields are sent; fields left as None keep their current value on the server. `descripteur_keywords` (with `match_descripteur=True`) matches MAPA notices that carry no CPV code. `active=False` pauses webhook deliveries without deleting the profile.
| Name | Type | Req | Description |
|---|---|---|---|
| active | – | – | – |
| budget_max | – | – | – |
| budget_min | – | – | – |
| channel | – | – | – |
| cpv_codes | – | – | – |
| departments | – | – | – |
| descripteur_keywords | – | – | – |
| email_to | – | – | – |
| keywords | – | – | – |
| match_cpv_family | – | – | – |
| match_descripteur | – | – | – |
| name | – | – | – |
| profile_id | integer | yes | – |
| regions | – | – | – |
| siret | – | – | – |
| webhook_url | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
upgrade_tier ~190
Start a Stripe Checkout session to upgrade the authenticated key to a higher tier ("starter" or "pro"). IMPORTANT: this does NOT charge anything by itself. It returns a `checkout_url` that the agent MUST present to the human user. Payment requires the user's card on Stripe's hosted page. Once paid, the key is automatically upgraded. Use this when a tool call fails with 402/403 because the feature is gated (e.g. `search_awards` and `winner_intel` need Starter+ / Pro). Args: tier: "starter" or "pro". success_url: Where Stripe redirects after successful payment. cancel_url: Where Stripe redirects if the user cancels. Returns: {"checkout_url": "...", "session_id": "..."}
| Name | Type | Req | Description |
|---|---|---|---|
| cancel_url | – | – | – |
| success_url | – | – | – |
| tier | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
winner_intel ~260
Aggregated winner statistics: top companies by contract count and total amount. Requires Pro tier. Use for competitive intelligence: "which companies win IT contracts in Occitanie in 2025?" or "what has SIRET 12345678901234 won across all sectors?". Args: cpv: CPV code filter. cpv_family: 2-digit CPV family prefix filter. region: Region slug (INSEE region codes like "11" accepted). country: ISO 3166-1 alpha-2 country code (e.g. "FR", "DE"); alpha-3 also accepted for supported countries. year: Integer year filter (e.g. 2025). winner_siret: Pin to a single establishment (14-digit SIRET). winner_siren: Pin to a whole company (9-digit SIREN — aggregates all its establishments). limit: Top N results (default 10, max 50).
| Name | Type | Req | Description |
|---|---|---|---|
| country | – | – | – |
| cpv | – | – | – |
| cpv_family | – | – | – |
| limit | integer | – | – |
| region | – | – | – |
| winner_siren | – | – | – |
| winner_siret | – | – | – |
| year | – | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
What is the io.github.IDNSIDNS/tenderapi-mcp server?
io.github.IDNSIDNS/tenderapi-mcp is listed in the public MCP registry as io.github.IDNSIDNS/tenderapi-mcp. MCP server for French (BOAMP) + EU (TED) public procurement data via TenderAPI. This page covers its PyPI package (tenderapi-mcp).
Is the io.github.IDNSIDNS/tenderapi-mcp server safe to use?
io.github.IDNSIDNS/tenderapi-mcp scores 75 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.IDNSIDNS/tenderapi-mcp server expose?
io.github.IDNSIDNS/tenderapi-mcp exposes 13 tools: search_tenders, get_tender, search_awards, get_award, winner_intel, and 8 more. Their descriptions and schemas cost roughly 3,529 tokens of context every time the server is loaded.
Is the io.github.IDNSIDNS/tenderapi-mcp server still maintained?
io.github.IDNSIDNS/tenderapi-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.IDNSIDNS/tenderapi-mcp server under?
io.github.IDNSIDNS/tenderapi-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.