Deterministic MCP access to Acquisition.gov FAR Overhaul model text, guidance, and posted agency deviations.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http
verified
reported
listed in the official MCP registry counts 5 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
get_rfo_agency_deviation
-
get_rfo_guidance
-
get_rfo_part
-
list_rfo_agency_deviations
-
list_rfo_parts
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v1.0.8 · analyzer v33 · 5d ago
danger signals4
- suspicious endpoint 169.254.169.254 (cloud metadata) acquisition_gov_mcp-1.0.8/tests/test_boundaries.py :17
'https://169.254.169.254/latest/meta-data','https://www.acquisition.gov.evil.test/', - suspicious endpoint 169.254.169.254 (cloud metadata) acquisition_gov_mcp-1.0.8/tests/test_per_tool.py :56
return httpx.Response(302,headers={'Location':'https://169.254.169.254/'}) - suspicious endpoint 169.254.169.254 (cloud metadata) acquisition_gov_mcp-1.0.8/tests/test_server.py :69
"https://169.254.169.254/latest/meta-data", - suspicious endpoint 169.254.169.254 (cloud metadata) acquisition_gov_mcp-1.0.8/tests/test_tool_paths.py :63
('get_rfo_agency_deviation',{'source_id':'https://169.254.169.254/'}),
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 22
filesystem 9
- fs acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/_pacing.py :21
from pathlib import Path - fs acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/server.py :9
import shutil - fs (weak) acquisition_gov_mcp-1.0.8/tests/conftest.py :1
from pathlib import Path - fs (weak) acquisition_gov_mcp-1.0.8/tests/inventory.py :2
from pathlib import Path - fs (weak) acquisition_gov_mcp-1.0.8/tests/live_hosted_probe.py :4
from pathlib import Path - fs (weak) acquisition_gov_mcp-1.0.8/tests/test_boundaries.py :4
from pathlib import Path - fs (weak) acquisition_gov_mcp-1.0.8/tests/test_fable_regressions.py :309
from pathlib import Path - fs (weak) acquisition_gov_mcp-1.0.8/tests/test_live_hardening.py :6
from pathlib import Path - fs (weak) acquisition_gov_mcp-1.0.8/tests/test_smoke.py :18
with open(os.devnull,'w') as errors:
shell / exec 1
- shell (weak) acquisition_gov_mcp-1.0.8/tests/live_hosted_probe.py :15
p=subprocess.run(cmd,text=True,capture_output=True)
network 7
- net acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/_html.py :7
from urllib.parse import urljoin, urlsplit, urlunsplit - net acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/server.py :17
from urllib.parse import urljoin, urlsplit, urlunsplit - net (weak) acquisition_gov_mcp-1.0.8/tests/test_boundaries.py :6
import httpx - net (weak) acquisition_gov_mcp-1.0.8/tests/test_fable_regressions.py :99
async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app),base_url='http://localhost:8080',headers={'Accept':'application/json, text/event-stream'}) as client: - net (weak) acquisition_gov_mcp-1.0.8/tests/test_hardening.py :6
import httpx - net (weak) acquisition_gov_mcp-1.0.8/tests/test_per_tool.py :7
import httpx - net (weak) acquisition_gov_mcp-1.0.8/tests/test_server.py :6
import httpx
tool registrations 5
- list_rfo_parts acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/server.py :340
- get_rfo_part acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/server.py :389
- list_rfo_agency_deviations acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/server.py :426
- get_rfo_agency_deviation acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/server.py :473
- get_rfo_guidance acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/server.py :534
declared dependencies 6
- mcp@>=2,<3
- beautifulsoup4@>=4.12,<5
- filelock@>=3.13
- httpx@>=0.27
- platformdirs@>=4
- pypdf@>=5,<7
transport_posture 1
- network-listening, binds all interfaces, no auth detected acquisition_gov_mcp-1.0.8/src/acquisition_gov_mcp/http.py :129
uvicorn.run(create_app(), host="0.0.0.0", port=int(os.environ.get("PORT", "8080")), access_log=False, log_level="critical")