MCP server
The Fedwright MCP server lets an AI assistant that supports the Model Context Protocol (MCP) search and read Fedwright data for the person using it. The assistant calls Fedwright’s tools, such as a search of federal notices or the details of one opportunity, and answers from the results. Every tool only reads. None changes anything in Fedwright.
The tools call the same operations as the API, as the signed-in person, so an assistant sees what that person may see. The tool reference lists every tool.
This environment
Section titled “This environment”| Setting | Value |
|---|---|
| Server URL | https://mcp-staging.fedwright.com/mcp |
| Sign-in (authorization server) | https://auth-staging.fedwright.com |
| Web app (where access is approved) | https://staging.fedwright.com |
The server speaks MCP over Streamable HTTP. It keeps no session between requests, so a client needs nothing more than the URL. Clients that only support the older HTTP+SSE transport can’t connect.
Connect a client
Section titled “Connect a client”- Add the server’s URL to your client. Claude Desktop and Claude Code are tested. Any other client that can use a pre-registered OAuth client may work, but isn’t tested.
- Sign in to Fedwright in the browser window the client opens.
- Ask the assistant for something that needs Fedwright data. The first call asks you to approve the client’s access to one organization, as described below.
How sign-in works
Section titled “How sign-in works”The MCP server doesn’t hold passwords. It relies on Fedwright’s sign-in service, an OpenID Connect provider, as the API does.
- The client asks the server for a tool and is refused with a
401that points to the server’s OAuth discovery document. - The document names the authorization server. The client opens it in your browser, and you sign in with your Fedwright account. The client uses the authorization code flow with PKCE and holds no client secret.
- The client gets an access token for the MCP server and sends it with every request. The server exchanges it for a token that is good for the API only on your behalf, so the client never holds a token for the API.
Only clients that Fedwright has registered can sign in. Each is given a fixed client ID, which you enter once when you add the server. A client that registers itself, and an application of your own that acts for users, aren’t supported yet. A program that runs by itself uses the API with a machine client.
Approving a client’s access
Section titled “Approving a client’s access”Signing in proves who you are. It doesn’t yet let the client read an organization’s data. The first tool call that needs data returns an approval link instead of a result.
- The assistant shows you the link. Some clients show it as part of the tool’s error text. Open it.
- The approval page in the web app asks you to sign in there if you aren’t, then shows the client’s name and the access it asks for. Owners and administrators may be asked to confirm with their second factor.
- You approve the access for one organization, the one you are working in on the web app.
- Ask the assistant again. The call now succeeds.
The link works for about 10 minutes. An approval is for a single client and a single organization. To use the same client for another organization, approve it again from that organization: the new approval replaces the old one.
Review or revoke approvals at Account, MCP grants in the web app. A revoked client is refused within a minute, and asks for approval again on its next call.
What counts against your plan
Section titled “What counts against your plan”MCP use is counted in prompts per organization, not in tool calls, and your plan sets how many an organization has each day and month. Limits and errors explains what a prompt is and what a refused call looks like.