@mambalabsdev/mcp-open-tender-rfp-finder 0.0.0-stage → 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mamba Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,120 @@
-# Temporary Holding Version
+# Open Tender and RFP Finder MCP Server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![Glama score](https://glama.ai/mcp/servers/mambalabsdev/mcp-open-tender-rfp-finder/badges/score.svg)](https://glama.ai/mcp/servers/mambalabsdev/mcp-open-tender-rfp-finder) [![MCP Registry](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fregistry.modelcontextprotocol.io%2Fv0%2Fservers%3Fsearch%3Dcom.mambabuilt%252Fmcp-open-tender-rfp-finder%26limit%3D1&query=%24.servers%5B0%5D._meta%5B%22io.modelcontextprotocol.registry%2Fofficial%22%5D.status&label=mcp%20registry&color=blue)](https://registry.modelcontextprotocol.io/v0/servers?search=com.mambabuilt/mcp-open-tender-rfp-finder&limit=1) [![npm version](https://img.shields.io/npm/v/@mambalabsdev/mcp-open-tender-rfp-finder)](https://www.npmjs.com/package/@mambalabsdev/mcp-open-tender-rfp-finder) [![npm downloads](https://img.shields.io/npm/dm/@mambalabsdev/mcp-open-tender-rfp-finder)](https://www.npmjs.com/package/@mambalabsdev/mcp-open-tender-rfp-finder) [![license](https://img.shields.io/github/license/mambalabsdev/mcp-open-tender-rfp-finder)](https://github.com/mambalabsdev/mcp-open-tender-rfp-finder/blob/main/LICENSE) [![mcpservers.org](https://img.shields.io/badge/mcpservers.org-listed-blue)](https://mcpservers.org/servers/mambalabsdev/mcp-open-tender-rfp-finder)
+
+<a href="https://mcprush.com/to/open-tender-rfp-finder-mcp?ref=badge"><img width="380" height="200" src="https://mcprush.com/badge/open-tender-rfp-finder-mcp/card.svg" alt="Open Tender Rfp Finder MCP server" /></a>
+
+An MCP server for the Mamba Labs Open Tender and RFP Finder actor on Apify. Give it keywords, CPV codes, or buyer countries. Each run reads four official public notice portals and returns one row per open tender or RFP notice.
+
+## What's Inside
+
+- [What it does](#what-it-does)
+- [Quick start](#quick-start)
+- [Prerequisites](#prerequisites)
+- [Example prompts](#example-prompts)
+- [Tool](#tool)
+- [Inputs](#inputs)
+- [Pricing](#pricing)
+- [Your keys](#your-keys)
+- [Full actor documentation](#full-actor-documentation)
+- [License](#license)
+
+## What it does
+
+The actor reads UK Contracts Finder, UK Find a Tender, EU TED (Tenders Electronic Daily), and the CanadaBuys open tender file, all official open data with no key. It keeps the notices that match your keywords and filters and returns one flat row per notice: buyer, buyer country, publication day, response deadline, days to deadline, estimated value and currency, CPV or UNSPSC codes, contract type, procedure, the buyer contact email the notice publishes, and a link. Filtered notices are never billed, and when nothing matches one free row says why.
+
+All of the work runs on Apify. This package is a thin client that starts the actor run, waits for it, and hands back the dataset rows.
+
+## Quick start
+
+You need Node.js 18 or newer and an Apify account with an API token.
+
+Add this to your Claude Desktop config (`claude_desktop_config.json`), Cursor, or any MCP client:
+
+```json
+{
+  "mcpServers": {
+    "mamba-open-tender-rfp-finder": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@mambalabsdev/mcp-open-tender-rfp-finder"
+      ],
+      "env": {
+        "APIFY_TOKEN": "your-apify-token"
+      }
+    }
+  }
+}
+```
+
+Restart the client. The `find_open_tenders` tool appears.
+
+## Prerequisites
+
+- Node.js 18 or newer.
+- An Apify API token from [console.apify.com/account/integrations](https://console.apify.com/account/integrations), set as `APIFY_TOKEN`. The server lists its tool without a token; a call needs one.
+
+## Example prompts
+
+- "Find open UK and Irish public tenders for software published this week."
+- "Which German and Dutch public bodies are buying IT services worth more than 100,000 EUR right now?"
+- "List open CanadaBuys RFPs for marketing services with their deadlines."
+
+## Tool
+
+`find_open_tenders`. One tool. Example arguments:
+
+```json
+{
+  "keywords": [
+    "software"
+  ],
+  "countries": [
+    "GB"
+  ],
+  "published_within_days": "7"
+}
+```
+
+## Inputs
+
+Every buyer facing input of the actor, unchanged. Omitted inputs take the actor's own defaults. Numbers and booleans are sent as strings.
+
+| Input | Type | Description |
+|---|---|---|
+| `keywords` | array | Words or phrases to find in the notice title or description, any case. A notice matches any of them. EU TED matches over the full notice text in every language. Empty: every open notice in the window. Up to 25. |
+| `exclude_keywords` | array | Drop a notice whose title or description contains any of these. |
+| `cpv_prefixes` | array | Keep notices with a CPV code that starts with one of these, for example 72 or 48000000. CanadaBuys uses UNSPSC codes, so a CPV filter leaves it out. |
+| `countries` | array | Two letter buyer country codes, for example GB, DE, CA. A portal that covers none of them is skipped. |
+| `portals` | array | Portals to read. Default all four. |
+| `published_within_days` | string | Publication window in days, 1 to 90, today included. Default 14. |
+| `only_open` | string | Drop notices whose deadline has passed. Default true. |
+| `min_value` | string | Drop notices valued below this number, in the notice currency. Notices with no value are kept. |
+| `max_notices` | string | Notice rows per run, newest first, up to 5000. Each notice row is billed. Default 100. |
+| `only_new` | string | Skip notices an earlier run with the same state_key returned. Default false. |
+| `state_key` | string | Names the seen list for only_new. |
+| `max_charge_usd` | string | Optional. The run stops before any row that would take its charges over this amount. |
+
+## Pricing
+
+Pay per event on Apify, billed to your Apify account. Prices in USD.
+
+| Event | Free plan | Bronze | Silver | Gold |
+|---|---|---|---|---|
+| `notice-row`, per notice row | $0.003 | $0.00285 | $0.0027 | $0.00255 |
+| `apify-actor-start`, per run start | $0.002 | $0.002 | $0.002 | $0.002 |
+
+The no results row and notices skipped by `only_new` are free.
+
+## Your keys
+
+The actor needs no key. Every portal is an official open data API or file, read directly, and the actor holds no key of any kind. Mamba Labs pays the platform and proxy costs of the run.
+
+## Full actor documentation
+
+[apify.com/mambalabs/open-tender-rfp-finder](https://apify.com/mambalabs/open-tender-rfp-finder)
+
+## License
+
+MIT. See [LICENSE](LICENSE).

package/SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+## Supported versions
+
+The latest published `1.x` release of
+`@mambalabsdev/mcp-open-tender-rfp-finder` receives security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x     | :white_check_mark: |
+| < 1.0   | :x:                |
+
+## Reporting a vulnerability
+
+Please do not open a public GitHub issue for security reports.
+
+Email security reports to **labs@mambamindsetgrowth.com** with:
+
+- a description of the issue and its impact,
+- steps to reproduce, and
+- any relevant logs or proof of concept.
+
+We aim to acknowledge reports within 3 business days and to provide a remediation
+timeline after triage. Coordinated disclosure is appreciated.
+
+## Handling of credentials
+
+This server reads an `APIFY_TOKEN` from the environment and uses it only to call
+the Apify API on your behalf. The token is never logged or written to disk by this
+package. Treat your `APIFY_TOKEN` as a secret and rotate it at
+https://console.apify.com/account/integrations if you believe it has been exposed.

package/build/index.js

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+const here = dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+// Distinctive UA so Apify run meta.userAgent marks MCP-originated runs.
+const USER_AGENT = `mambalabs-mcp ${pkg.name}@${pkg.version}`;
+// Drop undefined values so optional inputs are not sent to the actor.
+function compact(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (v !== undefined)
+            out[k] = v;
+    }
+    return out;
+}
+// How long the actor run itself is allowed to take, in seconds. The suite's
+// slowest measured run on 2026-09-22 was 152 s on a seven platform search, so
+// 1800 s is roughly twelve times that: headroom for a slow day without letting a
+// hung run bill indefinitely.
+const ACTOR_RUN_TIMEOUT_SECS = 1800;
+// How long this wrapper waits for that run, in milliseconds. The actor's own
+// timeout plus two minutes, so the run's own TIMED-OUT status is what the
+// caller sees rather than the wrapper giving up first and reporting nothing.
+const WRAPPER_WAIT_MS = (ACTOR_RUN_TIMEOUT_SECS + 120) * 1000;
+const POLL_INTERVAL_MS = 3000;
+const TERMINAL = new Set(["SUCCEEDED", "FAILED", "TIMED-OUT", "ABORTED", "ABORTING"]);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+// Shared caller. actorPath is the actor's immutable Apify actor ID (a stable key
+// that survives Store renames). The /v2/acts/{id} endpoint accepts it directly,
+// so a Store rename never breaks these calls.
+//
+// START AND POLL, NOT RUN-SYNC. Apify's synchronous endpoints carry a platform
+// ceiling of 300 seconds on the HTTP wait itself and answer 408 past it whatever
+// the timeout parameter says, so a long run reads as a timeout even though the
+// actor goes on to finish. Starting the run, polling it to a terminal status and
+// then reading the dataset is the only way to wait as long as the actor needs.
+//
+// The token is read here rather than at module load, so the tool registers
+// unconditionally and a server started without APIFY_TOKEN still advertises its
+// capabilities instead of reporting none.
+async function runActor(actorPath, actorLabel, input) {
+    const APIFY_TOKEN = process.env.APIFY_TOKEN;
+    if (!APIFY_TOKEN) {
+        return { isError: true, content: [{ type: "text", text: "APIFY_TOKEN is not set. Create a token at https://console.apify.com/account/integrations and set it as the APIFY_TOKEN environment variable." }] };
+    }
+    const headers = {
+        Authorization: `Bearer ${APIFY_TOKEN}`,
+        "Content-Type": "application/json",
+        "User-Agent": USER_AGENT,
+    };
+    const httpError = async (response) => {
+        let detail = "";
+        try {
+            const body = (await response.json());
+            if (body?.error?.message)
+                detail = ` ${body.error.message}`;
+        }
+        catch {
+            detail = "";
+        }
+        switch (response.status) {
+            case 400:
+                return `The ${actorLabel} run was rejected as invalid input.${detail}`;
+            case 401:
+                return "Invalid Apify token. Check your APIFY_TOKEN environment variable.";
+            case 402:
+                return "Insufficient Apify credits. Check your account balance at https://console.apify.com/billing";
+            default:
+                return `Apify request to ${actorLabel} failed with status ${response.status}.${detail}`;
+        }
+    };
+    // 1. Start the run.
+    let started;
+    try {
+        started = await fetch(`https://api.apify.com/v2/acts/${actorPath}/runs?timeout=${ACTOR_RUN_TIMEOUT_SECS}`, { method: "POST", headers, body: JSON.stringify(input) });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { isError: true, content: [{ type: "text", text: `Could not reach the Apify API: ${message}` }] };
+    }
+    if (!started.ok) {
+        return { isError: true, content: [{ type: "text", text: await httpError(started) }] };
+    }
+    let run;
+    try {
+        run = (await started.json()).data ?? {};
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { isError: true, content: [{ type: "text", text: `The ${actorLabel} run start returned a response that could not be parsed: ${message}` }] };
+    }
+    const runId = run.id;
+    if (!runId) {
+        return { isError: true, content: [{ type: "text", text: `The ${actorLabel} run start returned no run id, so there is nothing to wait for.` }] };
+    }
+    // 2. Poll to a terminal status.
+    const deadline = Date.now() + WRAPPER_WAIT_MS;
+    let status = run.status ?? "READY";
+    let datasetId = run.defaultDatasetId;
+    while (!TERMINAL.has(status)) {
+        if (Date.now() >= deadline) {
+            return {
+                isError: true,
+                content: [{ type: "text", text: `The ${actorLabel} run ${runId} was still ${status} after ${Math.round(WRAPPER_WAIT_MS / 1000)} seconds and this call stopped waiting. The run itself is still on Apify: read it at https://console.apify.com/actors/runs/${runId}` }],
+            };
+        }
+        await sleep(POLL_INTERVAL_MS);
+        let poll;
+        try {
+            poll = await fetch(`https://api.apify.com/v2/actor-runs/${runId}`, { headers });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { isError: true, content: [{ type: "text", text: `Lost contact with the Apify API while waiting for ${actorLabel} run ${runId}: ${message}` }] };
+        }
+        if (!poll.ok) {
+            return { isError: true, content: [{ type: "text", text: await httpError(poll) }] };
+        }
+        const body = (await poll.json());
+        status = body.data?.status ?? status;
+        datasetId = body.data?.defaultDatasetId ?? datasetId;
+    }
+    // 3. A run that did not succeed is a failure the caller must see, never an
+    // empty success. Surfacing it here is what keeps a crashed run from reading
+    // as "no results found".
+    if (status !== "SUCCEEDED") {
+        return {
+            isError: true,
+            content: [{ type: "text", text: `The ${actorLabel} run did not succeed (run ID: ${runId}, status: ${status}).` }],
+        };
+    }
+    if (!datasetId) {
+        return { isError: true, content: [{ type: "text", text: `The ${actorLabel} run ${runId} succeeded but reported no dataset, so there is nothing to return.` }] };
+    }
+    // 4. Read the dataset.
+    let ds;
+    try {
+        ds = await fetch(`https://api.apify.com/v2/datasets/${datasetId}/items?format=json`, { headers });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { isError: true, content: [{ type: "text", text: `Could not read the ${actorLabel} dataset: ${message}` }] };
+    }
+    if (!ds.ok) {
+        return { isError: true, content: [{ type: "text", text: await httpError(ds) }] };
+    }
+    let items;
+    try {
+        items = await ds.json();
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { isError: true, content: [{ type: "text", text: `The ${actorLabel} run returned a response that could not be parsed: ${message}` }] };
+    }
+    if (!Array.isArray(items)) {
+        const asObj = items;
+        const detail = asObj?.error?.message
+            ? `${asObj.error.message}`
+            : JSON.stringify(items);
+        return { isError: true, content: [{ type: "text", text: `The ${actorLabel} run did not return a dataset. ${detail}` }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(items, null, 2) }] };
+}
+const server = new McpServer({
+    name: "mamba-open-tender-rfp-finder",
+    version: pkg.version,
+});
+// Open Tender and RFP Finder (immutable actor ID kPTGz6t6TFoUUyfaO). Every buyer facing input of the actor
+// is exposed. The actor takes numbers and booleans as strings, so those inputs are strings here too.
+const bool = () => z.enum(["true", "false"]).optional();
+server.registerTool("find_open_tenders", {
+    title: "Find open tenders and RFPs",
+    description: "Find open public tender and RFP notices that match keywords, CPV codes, and buyer countries, read from four official portals with no key: UK Contracts Finder, UK Find a Tender, EU TED (Tenders Electronic Daily), and CanadaBuys. Returns one row per notice with portal, notice_id, notice_url, title, description_excerpt, buyer_name, buyer_country, published_at, deadline_at, days_to_deadline, estimated_value, currency, category_codes (CPV or UNSPSC), contract_type, procedure, sme_suitable (UK), buyer_contact_email, matched_keywords, and match_source. Filters run before billing. When nothing matches, one free no_results row says why. A run that does not succeed is returned as an error with its run ID. Read-only; requires an APIFY_TOKEN; Apify charges per notice row returned plus a run start.",
+    annotations: {
+        title: "Find open tenders and RFPs",
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: true,
+    },
+    inputSchema: {
+        keywords: z.array(z.string()).optional().describe("Words or phrases to find in the notice title or description, any case. A notice matches any of them. EU TED matches over the full notice text in every language. Empty: every open notice in the window. Up to 25."),
+        exclude_keywords: z.array(z.string()).optional().describe("Drop a notice whose title or description contains any of these."),
+        cpv_prefixes: z.array(z.string()).optional().describe("Keep notices with a CPV code that starts with one of these, for example 72 or 48000000. CanadaBuys uses UNSPSC codes, so a CPV filter leaves it out."),
+        countries: z.array(z.string()).optional().describe("Two letter buyer country codes, for example GB, DE, CA. A portal that covers none of them is skipped."),
+        portals: z.array(z.enum(["uk_contracts_finder", "uk_find_a_tender", "eu_ted", "canada_buys"])).optional().describe("Portals to read. Default all four."),
+        published_within_days: z.string().optional().describe("Publication window in days, 1 to 90, today included. Default 14."),
+        only_open: bool().describe("Drop notices whose deadline has passed. Default true."),
+        min_value: z.string().optional().describe("Drop notices valued below this number, in the notice currency. Notices with no value are kept."),
+        max_notices: z.string().optional().describe("Notice rows per run, newest first, up to 5000. Each notice row is billed. Default 100."),
+        only_new: bool().describe("Skip notices an earlier run with the same state_key returned. Default false."),
+        state_key: z.string().optional().describe("Names the seen list for only_new."),
+        max_charge_usd: z.string().optional().describe("Optional. The run stops before any row that would take its charges over this amount."),
+    },
+}, async (args) => runActor("kPTGz6t6TFoUUyfaO", "Open Tender and RFP Finder", compact(args)));
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@mambalabsdev/mcp-open-tender-rfp-finder",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "MCP server for Open Tender and RFP Finder. Find open public tenders and RFPs by keyword, CPV code, and country from UK Contracts Finder, UK Find a Tender, EU TED, and CanadaBuys: one row per notice with buyer, deadline, value, codes, and link. Runs on Apify. Clay-ready output.",
+  "type": "module",
+  "bin": {
+    "mcp-open-tender-rfp-finder": "./build/index.js"
+  },
+  "files": [
+    "build",
+    "README.md",
+    "LICENSE",
+    "SECURITY.md"
+  ],
+  "scripts": {
+    "build": "tsc && chmod +x build/index.js",
+    "test": "npm run build && node --test test/*.test.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "tenders",
+    "rfp",
+    "public-procurement",
+    "government-contracts",
+    "ted",
+    "contracts-finder",
+    "lead-generation",
+    "apify",
+    "clay"
+  ],
+  "author": "Mamba Labs <labs@mambamindsetgrowth.com>",
+  "license": "MIT",
+  "homepage": "https://apify.com/mambalabs/open-tender-rfp-finder",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mambalabsdev/mcp-open-tender-rfp-finder"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "typescript": "5.9.3"
+  },
+  "mcpName": "com.mambabuilt/mcp-open-tender-rfp-finder",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.0",
+    "zod": "^4.4.3"
+  }
+}