sam-gov-mcp

An MCP server that lets AI assistants (Claude Desktop, Cursor, and other MCP clients) search SAM.gov contract opportunities through the public SAM.gov Get Opportunities API.

Read-only. It only searches and reads public notices.
Bring your own key. You supply a free SAM.gov API key in SAM_API_KEY. The key is never logged and is redacted from errors and returned links.
No ranking or scoring. It returns what SAM.gov returns, summarized.

Quickstart

Get a free API key: sign in at sam.gov → Account Details → API Key.
Install. Claude Code:
bash
```
claude mcp add sam-gov -e SAM_API_KEY=your-key-here -- npx -y @itcustomsolution/sam-gov-mcp
```
Or run it directly: SAM_API_KEY=your-key-here npx -y @itcustomsolution/sam-gov-mcp

Add it to your MCP client. Claude Desktop (claude_desktop_config.json):

json

{
  "mcpServers": {
    "sam-gov": {
      "command": "npx",
      "args": ["-y", "@itcustomsolution/sam-gov-mcp"],
      "env": { "SAM_API_KEY": "your-key-here" }
    }
  }
}

Ask: "Find small-business set-aside opportunities for NAICS 541512 posted in the last 30 days in Maryland."

Tools

Tool	What it does	Inputs
`search_opportunities`	Search notices	`posted_from`, `posted_to` (optional, default last 30 days; YYYY-MM-DD or MM/DD/YYYY, max 1-year range), `keywords` (title), `naics`, `set_aside`, `state`, `limit` (1–100, default 10), `offset`
`get_opportunity`	Full JSON for one notice	`notice_id` (looks back 1 year)
`list_set_aside_codes`	Set-aside codes and meanings	none

Search results are summarized to: noticeId, title, solicitationNumber, agency, postedDate, responseDeadline, type, setAside, naics, state, uiLink.

Scope and limits

SAM.gov requires a posted-date range of 1 year or less on every search; the server validates this before calling the API.
Public API keys have daily rate limits set by GSA. Errors from SAM.gov are passed back as tool errors (with the key redacted).
Out of scope: entity/UEI lookup, award data, attachments download, bid/no-bid scoring.

Security notes

SAM.gov requires the key as an api_key query parameter, so it travels in the request URL to api.sam.gov over HTTPS. The server redacts it from errors, links, and returned JSON, but anything that logs full URLs (an HTTP proxy, for example) would see it.
Notice titles and descriptions are third-party text. Treat them as data, not instructions (prompt injection).
Responses over 5 MB are refused and requests time out after 30 s.

Development

bash

npm install
npm test        # vitest, HTTP fully mocked, no key needed
npm run build

Never commit a real key. .env is git-ignored.

SAM Gov

What it does

What it costs