Power your agent
Yayıncının kendi komutu. PlugMCP uç noktası değildir.
Host a copy with our keys and logs.
npx -y [email protected]Claude Code'un yerel komutlar için kurulum bağlantısı yok. Aşağıdaki komutu kopyalayın ve bir terminalde çalıştırın.
claude mcp add mtender-mcp-server -- npx -y mtender-mcp-server@3.3.0Bir terminalde çalıştırın.
{ "mcpServers": { "mtender-mcp-server": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
Uzak URL mi, yoksa makinenizde bir komut mu? İki kurulum arasındaki fark
PlugMCP’de çalıştır
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
BaşlatProduction-grade Model Context Protocol server for Moldova's MTender public procurement data, modeled on Open Contracting Data Standard 1.1.5.
Lets an AI agent (Claude Desktop, Cursor, Continue, custom MCP clients, etc.)
read, search, audit, and summarize every public procurement in the
Republic of Moldova from public.mtender.gov.md. Tiered document extraction
delegates scanned-PDF OCR to the host's vision LLM — language-agnostic
(Romanian / Russian / English / mixed) without local OCR infrastructure.
From npm (recommended for MCP host configs — no clone, no build):
# one-shot, no install
npx -y mtender-mcp-server
# or globally
npm install -g mtender-mcp-server
mtender-mcp # stdio
MCP_TRANSPORT=http mtender-mcp # Streamable HTTP
From source (for contributing):
git clone [email protected]:nalyk/mtender-mcp-server.git
cd mtender-mcp-server
npm install
npm run build
npm test
Add to your MCP config (~/Library/Application Support/Claude/claude_desktop_config.json
on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):
{
"mcpServers": {
"mtender": {
"command": "npx",
"args": ["-y", "mtender-mcp-server"]
}
}
}
Same shape — most MCP-aware editors support stdio servers via the same
command + args JSON config.
Run it once as a service, point the host at the URL:
MCP_TRANSPORT=http PORT=8787 HOST=127.0.0.1 npx -y mtender-mcp-server
# host config: { "url": "http://127.0.0.1:8787/mcp" }
When MCP_AUTH_MODE=bearer is on, the server also publishes RFC 9728
Protected Resource Metadata at /.well-known/oauth-protected-resource{path}
so unauthenticated clients can discover the AS to obtain a token from. The
/healthz endpoint stays public (liveness probes have no credentials).
Refusing without bearer while bound to a non-localhost interface emits a
warning — defense in depth for accidental public exposure.
All {ocid} templates support typeahead completion from the live latest list.
All read tools annotate readOnlyHint: true, idempotentHint: true, openWorldHint: true. Slow tools emit notifications/progress. Every fetch
honors AbortSignal for cancellation.
OCID arguments are autocompleted from the live mtender://tenders/latest list.
fetch_tender_document is tiered for the realities of Moldovan procurement
docs (most are scanned by Canon multi-functions):
Detection combines: char-per-byte density (< 0.005 is almost certainly
scanned), scanner-producer keywords in PDF metadata (canon, hp scan,
scanjet, scansnap, epson, xerox, kyocera, ricoh, brother,
konica, lexmark, gimp, imagemagick, tiff, kodak), and absent
Romanian diacritics in long extracted text. The mode: auto | text | image
argument lets callers force a strategy. Page-image cap: 20 pages per call.
Document size cap: 25 MiB.
src/
├── index.ts entry: dual-transport (stdio | streamable HTTP)
├── server.ts McpServer + capabilities + instructions
├── tools.ts 17 tools with structured I/O + progress
├── resources.ts 5 static + 4 templated resources, all completable
├── prompts.ts 8 procurement-investigation workflows
├── api/mtender.ts undici keep-alive client, retry, multi-package
│ compile, TTL+LRU caches, listing endpoints
├── ssrf.ts URL parse + DNS lookup + private-IP block
├── document.ts unpdf + mammoth + sharp tiered extraction
├── cache.ts tiny TTL+LRU
├── concurrency.ts bounded fan-out helper
├── schemas.ts OCDS-aligned Zod types
└── logger.ts pino → fd 2 (stderr)
@modelcontextprotocol/[email protected]express for the HTTP transport. Distroless multi-stage
Docker image (gcr.io/distroless/nodejs22-debian12:nonroot)packages[] URIs
and merging by id-union — compiledRelease from MTender is sparse, so
awards/items/parties have to be reassembled127.0.0.1 by default and refuses requests
whose Host header isn't in the allow-list (DNS-rebinding mitigation per
the MCP 2025-11-25 security best practices)new URL(), asserts
hostname === "storage.mtender.gov.md", then resolves DNS and rejects
any RFC1918 / loopback / link-local / 169.254.169.254 (AWS/GCP IMDS) /
IPv6 ULA result before issuing the actual requestsessionIdGenerator: undefined) — no session ID
to hijack. Per spec: "MCP servers MUST NOT use sessions for authentication."security-and-quality query suite) runs on every push and PR.env* in .gitignoreFor vulnerability reports see SECURITY.md. Use GitHub's private advisory form, not public issues.
This package is published to npm via trusted publishers
— GitHub Actions authenticates to the npm registry directly via OIDC, no
static NPM_TOKEN secret. Every release after the v3.1.0 bootstrap is
attested with Sigstore provenance
proving the tarball was built in this GitHub workflow from this commit.
Verify the chain locally:
npm view mtender-mcp-server versions --json
npm view mtender-mcp-server@latest dist.attestations
npm audit signatures # in any project that depends on it
Release flow (one command):
npm version patch -m "Release v%s" # bumps + commits + tags
git push origin main --follow-tags # triggers OIDC publish + GitHub release
The publish workflow has built-in guards: tag↔version drift fails the run; re-running on an already-published version skips the publish + release-create steps idempotently.
npm test
20 tests against the live MTender API (resource read + tool calls +
completion + aggregation + listings + lots/enquiries + scanned-PDF detection
regression) plus the SSRF guard, using the SDK's InMemoryTransport for
in-process client/server pairing. Runs in ~30 seconds.
docker build -t mtender-mcp .
docker run --rm -p 8787:8787 mtender-mcp
Distroless gcr.io/distroless/nodejs22-debian12:nonroot, runs
MCP_TRANSPORT=http by default. The CI pipeline rebuilds the image on
every push to confirm it still bakes cleanly.
These are out of our control — MTender publishes what MTender publishes:
/tenders/ accepts only offset.
search_tenders_deep does client-side filter after fetching the latest
page — the only viable approach.offset≈now, which this server does by default.TenderSummary.Upstream Spring Boot version + status is surfaced at
mtender://upstream/health for ops visibility.
ISC © Ion (Nalyk) Calmîș.
Built on:
Modern MCP server for Moldova's MTender public procurement data (OCDS 1.1.5). Protocol revision 2025-11-25. Tools, resources, prompts, vision-OCR for scanned PDFs, SSRF-hardened.
{ "mcpServers": { "mtender-mcp-server": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}Araçlar
Henüz araç listesi yok. Uzak sunucular ilk sağlık kontrolünden sonra bir liste alır.
SSS
Bu sayfadan Cursor, Claude Desktop, Claude Code veya VS Code için stdio yapılandırmasını kopyalayın. PlugMCP proxy'sini değil, yayıncının kurulumunu kullanır.
Bu kayıtta gerekli bir ortam değişkeni listelenmiyor.
Mtender yerel olarak stdio üzerinden çalışır.
Son kontrol: 2026-11-14. Modern MCP server for Moldova's MTender public procurement data (OCDS 1.1.5). Protocol revision 2025-11-25. Tools, resources, prompts, vision-OCR for scanned PDFs, SSRF-hardened.