PubSec Radar
REMOTE · PUBSEC-SALES-MCP.KABRAWALA.WORKERS.DEV · SCANNED AUG 3
Federal sales intelligence: expiring-contract triggers, agency spend intel, deal qualification.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security46
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS not yet verified: we couldn't determine whether a plaintext access path exists. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1059 tokens (~211/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · pubsec-sales-mcp.kabrawala.workers.dev
claude mcp add --transport http kabrawala-pubsec-sales-mcp https://pubsec-sales-mcp.kabrawala.workers.dev/mcp
[mcp_servers.kabrawala-pubsec-sales-mcp] url = "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"kabrawala-pubsec-sales-mcp": {
"type": "remote",
"url": "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp",
"enabled": true
}
}
} openclaw mcp add kabrawala-pubsec-sales-mcp --url https://pubsec-sales-mcp.kabrawala.workers.dev/mcp --transport streamable-http
mcp_servers:
kabrawala-pubsec-sales-mcp:
url: "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp" {
"mcpServers": {
"kabrawala-pubsec-sales-mcp": {
"type": "http",
"url": "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Jul 26 −1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 29 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 58
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://pubsec-sales-mcp.kabrawala.workers.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=kabrawala.workers.dev | CN=WE1,O=Google Trust Services,C=US | 4 Jul 2026 | 2 Oct 2026 | ECDSA 256 | ECDSA-SHA256 | c7eec27148878e3713da1c19cd6360b0 |
| SANs: kabrawala.workers.dev, *.kabrawala.workers.dev | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
DNSSEC insecure
Validation of pubsec-sales-mcp.kabrawala.workers.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| workers.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://pubsec-sales-mcp.kabrawala.workers.dev/mcp | Verified | 200 | |
| http (plaintext) | http://pubsec-sales-mcp.kabrawala.workers.dev/mcp | Inconclusive | 406 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
agency_spend_profile Profile a federal agency's contract spending ~156
Use this to answer "what does this agency actually buy, and from whom?" before a first call: total contract obligations, 3-year trend, top 10 vendors, and top 10 NAICS categories for one fiscal year. Good queries name one agency, e.g. agency="HHS". Figures come from a daily snapshot of USAspending covering the current fiscal year plus a 3-year trend; freshness is stated in the response. Federal only. Read the coverage caveats — current-FY totals are partial-year and intel-agency spend is never published.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | yes | Federal agency name, acronym, or code — e.g. "HHS", "Department of Veterans Affairs", "075". |
No output schema declared.
No examples provided.
find_expiring_contracts Find expiring federal contracts ~244
Use this when prospecting or prepping a federal account and you want sales triggers: contracts at an agency that end soon, with the incumbent vendor, dollar values, and contracting office. Expiring contracts mean upcoming recompetes — the best time to displace an incumbent. Good queries name one agency and optionally a NAICS code, e.g. agency="DHS", naics_code="541512", window_days=90. Federal only (no state/local). Every response includes data-freshness and coverage caveats — read them; no data ≠ no spend.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | yes | Federal agency name, acronym, or code — e.g. "DHS", "Department of Defense", "070". Federal only; SLED is out of scope. |
| limit | integer | — | Max contracts to return (top by obligated amount). Default 15. |
| naics_code | string | — | Optional NAICS code to narrow by category, e.g. "541512" (computer systems design). |
| window_days | integer | — | How far ahead to look for contract end dates, in days from today. Default 90, max 365. |
No output schema declared.
No examples provided.
generate_discovery_questions Generate public-sector discovery questions ~220
Use this when prepping a meeting with a federal agency: it returns discovery questions tuned to public-sector selling (fiscal-year timing, contract vehicles, FedRAMP/ATO, incumbents), grounded in the agency's live spending data where possible — each data-backed question cites the number that motivated it with a source URL. Good queries name the agency, what you sell, and the meeting type, e.g. agency="DHS", product_category="zero-trust network security", meeting_context="first_call". Add naics_code to surface expiring-contract questions.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | yes | Federal agency the meeting is with — name, acronym, or code, e.g. "DHS". |
| meeting_context | string | — | What kind of meeting you are prepping for. |
| naics_code | string | — | Optional NAICS code for your category — adds questions about specific expiring contracts. |
| product_category | string | yes | What you sell, in plain words — e.g. "data analytics platform", "zero-trust network security". |
No output schema declared.
No examples provided.
incumbent_lookup Look up an incumbent vendor's federal contracts ~194
Use this to answer "who am I displacing and when?": a vendor name (plus optional agency scope) returns their current and recent awards with values and end dates, flagging awards that end within 12 months as displacement windows. Good queries use the vendor's registered name or a distinctive fragment, e.g. vendor="Booz Allen", agency="DHS". Federal only. Zero results ≠ no presence — check the caveats for name-matching tips.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | — | Optional federal agency to scope the lookup, e.g. "DHS". Omit to search government-wide. |
| limit | integer | — | Max awards to return (largest first). Default 15. |
| vendor | string | yes | Vendor/incumbent name as registered in federal awards, e.g. "Booz Allen Hamilton", "CACI". FPDS matches it as a phrase — shorter fragments match more. |
No output schema declared.
No examples provided.
qualify_opportunity Qualify a federal opportunity (public-sector MEDDPICC) ~245
Use this to pressure-test a federal deal: pass what you know per MEDDPICC dimension (leave unknowns empty) and get back an evidence-scored scorecard adapted for public sector — budget authority instead of generic economic buyer, procurement vehicle as the paper process — with gap-closing questions and public-record evidence pulled automatically (name the incumbent_vendor and their real awards/end dates at the agency get attached). Scores measure evidence specificity, not truth; the response says what verified evidence looks like for each dimension.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | yes | Federal agency the deal is at — name, acronym, or code, e.g. "DHS". |
| deal_facts | object | — | What you know so far, one field per MEDDPICC dimension. Omit entirely (or leave fields empty) for pure-discovery scoring — gaps are the output. |
| estimated_value_usd | number | — | Rough deal size in USD, if known. |
| incumbent_vendor | string | — | Competitor/incumbent vendor name if known — their real awards at this agency get pulled as evidence. |
| product_category | string | yes | What you are selling, e.g. "SIEM platform". |
No output schema declared.
No examples provided.