sam-gov-mcp
An MCP server that lets AI assistants (Claude Desktop, Cursor, and other MCP clients) search SAM.gov contract opportunities through the public SAM.gov Get Opportunities API.
- Read-only. It only searches and reads public notices.
- Bring your own key. You supply a free SAM.gov API key in
SAM_API_KEY. The key is never logged and is redacted from errors and returned links.
- No ranking or scoring. It returns what SAM.gov returns, summarized.
Quickstart
-
Get a free API key: sign in at sam.gov → Account Details → API Key.
-
Install. Claude Code:
claude mcp add sam-gov -e SAM_API_KEY=your-key-here -- npx -y @itcustomsolution/sam-gov-mcp
Or run it directly: SAM_API_KEY=your-key-here npx -y @itcustomsolution/sam-gov-mcp
-
Add it to your MCP client. Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"sam-gov": {
"command": "npx",
"args": ["-y", "@itcustomsolution/sam-gov-mcp"],
"env": { "SAM_API_KEY": "your-key-here" }
}
}
}
-
Ask: "Find small-business set-aside opportunities for NAICS 541512 posted in the last 30 days in Maryland."
| Tool | What it does | Inputs |
|---|
search_opportunities | Search notices | posted_from, posted_to (optional, default last 30 days; YYYY-MM-DD or MM/DD/YYYY, max 1-year range), keywords (title), naics, set_aside, state, limit (1–100, default 10), offset |
get_opportunity | Full JSON for one notice | notice_id (looks back 1 year) |
list_set_aside_codes | Set-aside codes and meanings | none |
Search results are summarized to: noticeId, title, solicitationNumber, agency, postedDate, responseDeadline, type, setAside, naics, state, uiLink.
Scope and limits
- SAM.gov requires a posted-date range of 1 year or less on every search; the server validates this before calling the API.
- Public API keys have daily rate limits set by GSA. Errors from SAM.gov are passed back as tool errors (with the key redacted).
- Out of scope: entity/UEI lookup, award data, attachments download, bid/no-bid scoring.
Security notes
- SAM.gov requires the key as an
api_key query parameter, so it travels in the request URL to api.sam.gov over HTTPS. The server redacts it from errors, links, and returned JSON, but anything that logs full URLs (an HTTP proxy, for example) would see it.
- Notice titles and descriptions are third-party text. Treat them as data, not instructions (prompt injection).
- Responses over 5 MB are refused and requests time out after 30 s.
Development
npm install
npm test
npm run build
Never commit a real key. .env is git-ignored.
License
MIT © IT Custom Solution