Skip to content

FedTally — US Federal Contract Intelligence

by woodydaniel · remote · no sign-in to list tools · v1.1.0 · published by GitHub user woodydaniel

US federal contract recompetes with the incumbent named, awards by company, agency spend.

Read only
CompareRegistry entry

3 tools: 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http fedtally https://fedtally.com/api/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

3 tools

Only reads 3Claude Code: allow
  • get_agency_spendWhere one federal agency's contract dollars went in a fiscal year: its top vendors and its top NAICS industries, both ranked by obligated amount.Reads text others writeNo findings

    Why it is in this group

    • The name "get_agency_spend" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Where one federal agency's contract dollars went in a fiscal year: its top vendors and its top NAICS industries, both ranked by obligated amount. Use it to answer who sells to an agency and what that agency buys. The agency argument must resolve to a single toptier agency — use the full name ("Department of Veterans Affairs") or the official abbreviation ("VA"); an ambiguous fragment matching several agencies returns no match rather than a guess. Fiscal years run 1 October to 30 September and are named for the ending calendar year, so FY2026 starts 2025-10-01; omit fiscalYear for the current one. Source: USAspending.gov prime contract awards (public domain, no login). Civilian agency awards are roughly 4 days fresh; Department of Defense awards are withheld about 90 days, so recent defense activity looks sparser than it is. Amounts are obligated dollars in USD.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_expiring_contractsFederal contracts whose period of performance ends inside a chosen window for one NAICS industry — the recompete pipeline, useful for finding work about to be rebid and identifying…Reads text others writeNo findings

    Why it is in this group

    • The name "get_expiring_contracts" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Federal contracts whose period of performance ends inside a chosen window for one NAICS industry — the recompete pipeline, useful for finding work about to be rebid and identifying the incumbent to displace. Rows come back soonest expiry first with the end date, days remaining, contract PIID and parent IDV, incumbent vendor name and UEI, contracting department, obligated dollars, total contract value including options, place of performance, and description. Two fields matter most to small contractors: setAside, the socioeconomic set-aside the work was competed under (SDVOSBC service-disabled veteran-owned, WOSB women-owned, 8AN 8(a) sole source, SBA total small business, HZC HUBZone), which is null when the work was competed full and open; and isSmallBusiness, the contracting officer's size determination for the incumbent — together they show whether a small firm is eligible to bid and whether the incumbent is a small business or a large one. Rows are served from nightly SAM.gov snapshots. Coverage is partial and rotating: the sync refreshes the stalest few of the 20 seeded industries each night, so only some are readable at any moment and the set grows over a few nights. The syncedAt field gives the timestamp of the sync that produced the rows, and an industry with no snapshot yet returns a short notice naming the codes that are currently synced, instead of data. Source: SAM.gov Contract Awards v1, public domain US Government data. Vendor street addresses are never returned.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • search_awards_by_companyTop US federal prime contract awards won by a company, largest award amount first.Reads text others writeNo findings

    Why it is in this group

    • The name "search_awards_by_company" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Top US federal prime contract awards won by a company, largest award amount first. Use it to size a contractor's federal business, see which agencies buy from it, or pull its biggest named contracts. Matching is full-text on the recipient name, so pass the company's common or legal name ("Booz Allen", "Lockheed Martin") rather than a ticker or internal abbreviation; a name that is too specific returns nothing. Returns up to 25 awards per page with award ID, recipient, awarding agency, amount, period of performance, NAICS code, and description; page through with the page argument while hasNext is true. Source: USAspending.gov prime contract awards (public domain, no login). Civilian agency awards are roughly 4 days fresh; Department of Defense awards are withheld about 90 days, so recent defense activity looks sparser than it is. Amounts are obligated dollars in USD.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http fedtally https://fedtally.com/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__fedtally__search_awards_by_company",
      "mcp__fedtally__get_agency_spend",
      "mcp__fedtally__get_expiring_contracts"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as fedtally. Review it before you use it.

Capability tags behind 3 rules
  • mcp__fedtally__search_awards_by_company untrusted-input
  • mcp__fedtally__get_agency_spend untrusted-input
  • mcp__fedtally__get_expiring_contracts untrusted-input