PubSec Radar
REMOTE · PUBSEC-SALES-MCP.KABRAWALA.WORKERS.DEV · SCANNED SEP 20
Federal sales intelligence: expiring-contract triggers, agency spend intel, deal qualification.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security46
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 406, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1059 tokens (~211/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the PubSec Radar MCP server?
PubSec Radar is a hosted endpoint at https://pubsec-sales-mcp.kabrawala.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · pubsec-sales-mcp.kabrawala.workers.dev
claude mcp add --transport http kabrawala-pubsec-sales-mcp 'https://pubsec-sales-mcp.kabrawala.workers.dev/mcp'
{
"mcpServers": {
"kabrawala-pubsec-sales-mcp": {
"url": "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp"
}
}
} {
"servers": {
"kabrawala-pubsec-sales-mcp": {
"type": "http",
"url": "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp"
}
}
} [mcp_servers.kabrawala-pubsec-sales-mcp] url = "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"kabrawala-pubsec-sales-mcp": {
"type": "remote",
"url": "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp",
"enabled": true
}
}
} openclaw mcp add kabrawala-pubsec-sales-mcp --url 'https://pubsec-sales-mcp.kabrawala.workers.dev/mcp' --transport streamable-http
mcp_servers:
kabrawala-pubsec-sales-mcp:
url: "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp" {
"McpServers": {
"kabrawala-pubsec-sales-mcp": {
"Transport": "http",
"Url": "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp"
}
}
} assistant mcp add kabrawala-pubsec-sales-mcp -t streamable-http -u 'https://pubsec-sales-mcp.kabrawala.workers.dev/mcp'
{
"mcpServers": {
"kabrawala-pubsec-sales-mcp": {
"type": "http",
"url": "https://pubsec-sales-mcp.kabrawala.workers.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 +1
- Stability: 0.97 → pass security
- 23 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 0
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://pubsec-sales-mcp.kabrawala.workers.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=kabrawala.workers.dev | CN=WE1,O=Google Trust Services,C=US | 1 Sept 2026 | 30 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | d2ba420754f00ce30e776af366ab0fc6 |
| SANs: kabrawala.workers.dev, *.kabrawala.workers.dev | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of pubsec-sales-mcp.kabrawala.workers.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| workers.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://pubsec-sales-mcp.kabrawala.workers.dev/mcp | Verified | 200 | |
| http (plaintext) | http://pubsec-sales-mcp.kabrawala.workers.dev/mcp | Inconclusive | 406 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
agency_spend_profile Profile a federal agency's contract spending ~156
Use this to answer "what does this agency actually buy, and from whom?" before a first call: total contract obligations, 3-year trend, top 10 vendors, and top 10 NAICS categories for one fiscal year. Good queries name one agency, e.g. agency="HHS". Figures come from a daily snapshot of USAspending covering the current fiscal year plus a 3-year trend; freshness is stated in the response. Federal only. Read the coverage caveats — current-FY totals are partial-year and intel-agency spend is never published.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | yes | Federal agency name, acronym, or code — e.g. "HHS", "Department of Veterans Affairs", "075". |
No output schema declared.
No examples provided.
find_expiring_contracts Find expiring federal contracts ~244
Use this when prospecting or prepping a federal account and you want sales triggers: contracts at an agency that end soon, with the incumbent vendor, dollar values, and contracting office. Expiring contracts mean upcoming recompetes — the best time to displace an incumbent. Good queries name one agency and optionally a NAICS code, e.g. agency="DHS", naics_code="541512", window_days=90. Federal only (no state/local). Every response includes data-freshness and coverage caveats — read them; no data ≠ no spend.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | yes | Federal agency name, acronym, or code — e.g. "DHS", "Department of Defense", "070". Federal only; SLED is out of scope. |
| limit | integer | – | Max contracts to return (top by obligated amount). Default 15. |
| naics_code | string | – | Optional NAICS code to narrow by category, e.g. "541512" (computer systems design). |
| window_days | integer | – | How far ahead to look for contract end dates, in days from today. Default 90, max 365. |
No output schema declared.
No examples provided.
generate_discovery_questions Generate public-sector discovery questions ~220
Use this when prepping a meeting with a federal agency: it returns discovery questions tuned to public-sector selling (fiscal-year timing, contract vehicles, FedRAMP/ATO, incumbents), grounded in the agency's live spending data where possible — each data-backed question cites the number that motivated it with a source URL. Good queries name the agency, what you sell, and the meeting type, e.g. agency="DHS", product_category="zero-trust network security", meeting_context="first_call". Add naics_code to surface expiring-contract questions.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | yes | Federal agency the meeting is with — name, acronym, or code, e.g. "DHS". |
| meeting_context | string | – | What kind of meeting you are prepping for. |
| naics_code | string | – | Optional NAICS code for your category — adds questions about specific expiring contracts. |
| product_category | string | yes | What you sell, in plain words — e.g. "data analytics platform", "zero-trust network security". |
No output schema declared.
No examples provided.
incumbent_lookup Look up an incumbent vendor's federal contracts ~194
Use this to answer "who am I displacing and when?": a vendor name (plus optional agency scope) returns their current and recent awards with values and end dates, flagging awards that end within 12 months as displacement windows. Good queries use the vendor's registered name or a distinctive fragment, e.g. vendor="Booz Allen", agency="DHS". Federal only. Zero results ≠ no presence — check the caveats for name-matching tips.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | – | Optional federal agency to scope the lookup, e.g. "DHS". Omit to search government-wide. |
| limit | integer | – | Max awards to return (largest first). Default 15. |
| vendor | string | yes | Vendor/incumbent name as registered in federal awards, e.g. "Booz Allen Hamilton", "CACI". FPDS matches it as a phrase — shorter fragments match more. |
No output schema declared.
No examples provided.
qualify_opportunity Qualify a federal opportunity (public-sector MEDDPICC) ~245
Use this to pressure-test a federal deal: pass what you know per MEDDPICC dimension (leave unknowns empty) and get back an evidence-scored scorecard adapted for public sector — budget authority instead of generic economic buyer, procurement vehicle as the paper process — with gap-closing questions and public-record evidence pulled automatically (name the incumbent_vendor and their real awards/end dates at the agency get attached). Scores measure evidence specificity, not truth; the response says what verified evidence looks like for each dimension.
| Name | Type | Req | Description |
|---|---|---|---|
| agency | string | yes | Federal agency the deal is at — name, acronym, or code, e.g. "DHS". |
| deal_facts | object | – | What you know so far, one field per MEDDPICC dimension. Omit entirely (or leave fields empty) for pure-discovery scoring — gaps are the output. |
| estimated_value_usd | number | – | Rough deal size in USD, if known. |
| incumbent_vendor | string | – | Competitor/incumbent vendor name if known — their real awards at this agency get pulled as evidence. |
| product_category | string | yes | What you are selling, e.g. "SIEM platform". |
No output schema declared.
No examples provided.
What is the PubSec Radar MCP server?
PubSec Radar is an MCP server listed in the public MCP registry as io.github.Kabrawala/pubsec-sales-mcp. Federal sales intelligence: expiring-contract triggers, agency spend intel, deal qualification. This page covers its hosted endpoint (https://pubsec-sales-mcp.kabrawala.workers.dev/mcp).
Is the PubSec Radar MCP server safe to use?
PubSec Radar scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the PubSec Radar MCP server expose?
PubSec Radar exposes 5 tools: find_expiring_contracts, agency_spend_profile, incumbent_lookup, generate_discovery_questions, qualify_opportunity. Their descriptions and schemas cost roughly 1,059 tokens of context every time the server is loaded.
Does the PubSec Radar MCP server require authentication?
No. We connected to PubSec Radar without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the PubSec Radar MCP server still maintained?
PubSec Radar is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.