signaltender-mcp

Audit Supply Chain Risk (NIST 800-161 C-SCRM, NDAA 889, FASCSA, TAA, BAA) & Generate SBOM Attestation

audit_supply_chain_scrm

Read-onlyIdempotent

Audit hardware Bills of Materials (BOMs), sub-tier suppliers, and software components (SBOM) against NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management (C-SCRM), FAR 52.204-25 (NDAA Section 889 Part A/B prohibition on Huawei, ZTE, Hytera, Hikvision, Dahua and their affiliates), FAR 52.204-30 (FASCSA exclusion orders), the Buy American Act (FAR Part 25 domestic content), and the Trade Agreements Act (FAR 52.225-5 designated countries), returning JSON with a Supply Chain Risk Score (0-100), an overall SCRM verdict, per-line NDAA 889 and TAA determinations, a BAA domestic-content percentage, NIST 800-161 SR-family control gaps, an NTIA minimum-elements SBOM and CISA Secure Software Self-Attestation readiness review, paste-ready C-SCRM Plan sections, a SCRM POA&M remediation roadmap, and a proposal-ready SCRM narrative. This is a read-only, stateless, non-destructive compliance auditor (requires X-RapidAPI-Key; nothing is stored, filed, or submitted to SAM.gov, and FASCSA results must still be verified in SAM.gov; solicitation_or_contract_context accepts 20 to 45,000 characters, bom_line_items accepts 1 to 200 lines, and software_components accepts up to 500 SBOM components). Use this tool when vetting a BOM, reseller quote, or SBOM for NDAA 889 / FASCSA / TAA / BAA award eligibility or drafting a C-SCRM Plan and SBOM attestation; use audit_section_508_vpat instead for Section 508 / WCAG 2.2 accessibility and VPAT conformance, scan_far_dfars_clauses for general Section I FAR/DFARS clause flow-down risk scanning, answer_security_questionnaire for SOC 2 / FedRAMP / NIST 800-171 questionnaires, or generate_ato_rmf_package for NIST 800-53 SSP / RMF / cATO authorization packages.

Input Schema

Name	Required	Description	Default
`sbom_format`	No	Format of the offeror's SBOM deliverable: 'CycloneDX_1_6' (default), 'SPDX_2_3', 'SPDX_3_0', 'Proprietary_Or_Spreadsheet', or 'None_Available'.	CycloneDX_1_6
`offeror_name`	No	Legal name of the prime offeror / reseller submitting the BOM and supply chain representations (2 to 300 characters).	Offeror (Prime Contractor)
`bom_line_items`	Yes	Hardware / COTS Bill of Materials line items to screen (1 to 200 lines).
`contracting_agency`	No	Contracting agency or SLED buyer, e.g. 'U.S. Army PEO C3T', 'GSA FAS', or 'Arizona ADOA-ASET' (2 to 300 characters).	Department of Defense (DoD)
`software_components`	No	Software Bill of Materials (SBOM) components for NTIA minimum-elements and CISA secure software attestation review (0 to 500 components).
`target_compliance_regime`	No	Target supply chain regulatory regime: 'Auto_Detect_From_Clauses' (default), 'Federal_DoD_Full_C_SCRM_NDAA_889_TAA_BAA', 'Federal_Civilian_FASCSA_And_CISA_Secure_Software', or 'State_SLED_Prohibited_Vendor_And_Domestic_Preference'.	Auto_Detect_From_Clauses
`additional_supplier_notes`	No	Optional sub-tier supplier attestations, SAM.gov FAR 52.204-24/26 representations, ownership/affiliation notes, or existing C-SCRM program documentation (0 to 20,000 characters).
`applicable_contract_clauses`	No	Supply chain clauses and standards in the solicitation, e.g. 'FAR 52.204-25', 'FAR 52.204-30', 'FAR 52.225-5', 'DFARS 252.225-7001', 'DFARS 252.204-7012', 'DFARS 252.246-7008', 'NIST SP 800-161 Rev. 1', 'OMB M-22-18' (0 to 40 entries).
`solicitation_or_contract_context`	Yes	Solicitation / contract scope, Section H/I supply chain clauses, delivery location, end-use, and any agency C-SCRM, NDAA 889, TAA, BAA, or SBOM requirements (20 to 45,000 characters).

Output Schema

Name	Required	Description
`sbom_attestation`	No	NTIA SBOM minimum-elements review and CISA Secure Software Self-Attestation readiness.
`ndaa_889_findings`	No	Per-line FAR 52.204-25 (NDAA Section 889 Part A/B) prohibited-vendor screening findings.
`remediation_roadmap`	No	Prioritized SCRM Plan of Action & Milestones (POA&M) remediation roadmap.
`baa_domestic_content`	No	Buy American Act (FAR Part 25) domestic content analysis.
`c_scrm_plan_sections`	No	Paste-ready Cybersecurity Supply Chain Risk Management (C-SCRM) Plan sections aligned to NIST SP 800-161 Rev. 1.
`overall_scrm_verdict`	No	Overall C-SCRM / NDAA 889 / FASCSA / TAA / BAA award-eligibility verdict.
`executive_scrm_summary`	No	Executive supply chain risk summary for the Contracting Officer and offeror leadership.
`fascsa_exclusion_check`	No	FAR 52.204-30 FASCSA exclusion/removal order screening.
`taa_compliance_by_line`	No	Per-line Trade Agreements Act (FAR 52.225-5) designated-country determinations.
`supply_chain_risk_score`	No	Quantitative supply chain risk score from 0 (no material risk) to 100 (prohibited / award-blocking).
`nist_800_161_control_gaps`	No	NIST SP 800-161 Rev. 1 C-SCRM control gaps with severity and implementation guidance.
`ready_to_submit_scrm_narrative`	No	Paste-ready proposal Supply Chain Risk Management volume narrative with NDAA 889 / FASCSA representations, TAA/BAA certification language, and SBOM attestation statement.

Schema Changelog

Changes observed during successful MCP inspections.

Changed7 schema fields changedOct 31, 2026

removedInput schema / properties / additional_supplier_notes / minLength
```
Removed value: -1
```

addedInput schema / properties / bom_line_items / default

Added value: +[
+  {
+    "country_of_origin": "US",
+    "description": "48-Port PoE+ Enterprise Network Switch",
+    "line_item_id": "CLIN-0001",
+    "manufacturer": "Cisco Systems, Inc.",
+    "part_number": "C9300-48P-E"
+  }
+]

addedInput schema / properties / bom_line_items / items / properties

Added value: +{
+  "country_of_origin": {
+    "description": "Country of origin / substantial transformation (e.g., 'US', 'Taiwan').",
+    "type": "string"
+  },
+  "description": {
+    "description": "Short item description.",
+    "type": "string"
+  },
+  "line_item_id": {
+    "description": "Unique BOM / CLIN line identifier (e.g., 'CLIN 0001').",
+    "type": "string"
+  },
+  "manufacturer": {
+    "description": "Original Equipment Manufacturer (OEM) legal entity.",
+    "type": "string"
+  },
+  "part_number": {
+    "description": "Manufacturer part number (MPN), SKU, or NSN.",
+    "type": "string"
+  }
+}

addedInput schema / properties / bom_line_items / items / required

Added value: +[
+  "line_item_id",
+  "part_number",
+  "manufacturer",
+  "country_of_origin"
+]

addedInput schema / properties / software_components / default

Added value: +[
+  {
+    "license": "Apache-2.0",
+    "name": "openssl",
+    "supplier": "OpenSSL Software Foundation",
+    "version": "3.0.13"
+  }
+]

addedInput schema / properties / software_components / items / properties

Added value: +{
+  "license": {
+    "description": "SPDX license identifier (e.g., 'Apache-2.0').",
+    "type": "string"
+  },
+  "name": {
+    "description": "Software component / package name (e.g., 'openssl').",
+    "type": "string"
+  },
+  "supplier": {
+    "description": "Component supplier or maintainer organization.",
+    "type": "string"
+  },
+  "version": {
+    "description": "Component version string (e.g., '3.0.13').",
+    "type": "string"
+  }
+}

addedInput schema / properties / software_components / items / required
```
Added value: +[
+  "name"
+]
```

Changed22 schema fields changedOct 29, 2026

addedInput schema / properties / additional_supplier_notes / minLength
```
Added value: +1
```

removedInput schema / properties / applicable_contract_clauses / default

Removed value: -[
-  "FAR 52.204-25 (NDAA Section 889 Covered Telecommunications Prohibition)",
-  "FAR 52.204-30 (FASCSA Orders Prohibition)",
-  "FAR 52.225-5 (Trade Agreements Act)",
-  "FAR 52.225-1 (Buy American - Supplies)",
-  "NIST SP 800-161 Rev. 1 (C-SCRM)"
-]

removedInput schema / properties / applicable_contract_clauses / items / description
```
Removed value: -"One clause or standard citation, e.g. 'FAR 52.204-25'."
```
removedInput schema / properties / applicable_contract_clauses / items / maxLength
```
Removed value: -200
```
removedInput schema / properties / applicable_contract_clauses / items / minLength
```
Removed value: -1
```

removedInput schema / properties / bom_line_items / items / properties

Removed value: -{
-  "country_of_origin": {
-    "description": "Country of origin or substantial transformation (ISO 3166 alpha-2 code or country name, e.g. 'US', 'Mexico', 'China').",
-    "maxLength": 80,
-    "minLength": 2,
-    "type": "string"
-  },
-  "description": {
-    "default": "",
-    "description": "Short item description, e.g. '4MP IP Dome Camera'.",
-    "maxLength": 500,
-    "type": "string"
-  },
-  "domestic_component_cost_pct": {
-    "default": null,
-    "description": "Optional known US-domestic component cost percentage (0-100) for this line; null if unknown.",
-    "maximum": 100,
-    "minimum": 0,
-    "type": [
-      "number",
-      "null"
-    ]
-  },
-  "item_category": {
-    "default": "IT_Hardware_Or_Network_Equipment",
-    "description": "Item category used to route NDAA 889, FASCSA, TAA, BAA (COTS IT exception), and counterfeit-parts logic.",
-    "enum": [
-      "Telecommunications_Or_Video_Surveillance",
-      "IT_Hardware_Or_Network_Equipment",
-      "Software_Or_SaaS",
-      "Microelectronics_Or_Semiconductor",
-      "Commercial_Off_The_Shelf_COTS_Item",
-      "Construction_Material_Or_Manufactured_Product",
-      "Other"
-    ],
-    "type": "string"
-  },
-  "line_item_id": {
-    "description": "Unique BOM / CLIN / quote line identifier, e.g. 'BOM-001' or 'CLIN 0001'.",
-    "maxLength": 60,
-    "minLength": 1,
-    "type": "string"
-  },
-  "manufacturer": {
-    "description": "OEM brand / legal entity, screened against NDAA 889 covered entities and known affiliates or white-label OEMs.",
-    "maxLength": 200,
-    "minLength": 1,
-    "type": "string"
-  },
-  "part_number": {
-    "description": "Manufacturer part number (MPN), SKU, or NSN, e.g. 'C9300-48P-E'.",
-    "maxLength": 120,
-    "minLength": 1,
-    "type": "string"
-  },
-  "quantity": {
-    "default": 1,
-    "description": "Quantity of units on this line.",
-    "maximum": 10000000,
-    "minimum": 1,
-    "type": "integer"
-  },
-  "supplier_name": {
-    "default": "",
-    "description": "Reseller, distributor, or sub-tier supplier furnishing the item (blank if bought direct from the OEM).",
-    "maxLength": 200,
-    "type": "string"
-  },
-  "supplier_tier": {
-    "default": "Tier_1_Direct_OEM",
-    "description": "Supply chain tier of the furnishing supplier relative to the prime offeror.",
-    "enum": [
-      "Tier_1_Direct_OEM",
-      "Tier_2_Sub_Assembly_Or_Integrator",
-      "Tier_3_Component_Supplier",
-      "Tier_4_Distributor_Or_Raw_Material",
-      "Unknown"
-    ],
-    "type": "string"
-  },
-  "unit_cost_usd": {
-    "default": 0,
-    "description": "Unit price in USD, used for TAA thresholds and BAA domestic-content weighting.",
-    "maximum": 1000000000,
-    "minimum": 0,
-    "type": "number"
-  }
-}

removedInput schema / properties / bom_line_items / items / required

Removed value: -[
-  "line_item_id",
-  "part_number",
-  "manufacturer",
-  "country_of_origin"
-]

removedInput schema / properties / software_components / default
```
Removed value: -[]
```

removedInput schema / properties / software_components / items / properties

Removed value: -{
-  "known_vulnerabilities": {
-    "default": [],
-    "description": "Known CVE / GHSA identifiers or CISA KEV entries affecting this version (0 to 50).",
-    "items": {
-      "description": "CVE / GHSA identifier, e.g. 'CVE-2021-44228'.",
-      "maxLength": 60,
-      "type": "string"
-    },
-    "maxItems": 50,
-    "type": "array"
-  },
-  "license": {
-    "default": "",
-    "description": "SPDX license identifier, e.g. 'Apache-2.0' or 'GPL-3.0-only'.",
-    "maxLength": 120,
-    "type": "string"
-  },
-  "name": {
-    "description": "Software component / package name, e.g. 'log4j-core'.",
-    "maxLength": 200,
-    "minLength": 1,
-    "type": "string"
-  },
-  "purl": {
-    "default": "",
-    "description": "Package URL (purl), e.g. 'pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1'.",
-    "maxLength": 500,
-    "type": "string"
-  },
-  "supplier": {
-    "default": "",
-    "description": "Component supplier / author organization (NTIA 'Supplier Name' element).",
-    "maxLength": 200,
-    "type": "string"
-  },
-  "version": {
-    "default": "unspecified",
-    "description": "Component version string, e.g. '2.17.1'.",
-    "maxLength": 80,
-    "minLength": 1,
-    "type": "string"
-  }
-}

removedInput schema / properties / software_components / items / required
```
Removed value: -[
-  "name"
-]
```

changedOutput schema / properties / baa_domestic_content / description

Previous value: -"Buy American Act domestic content percentage, applicable threshold, and status."New value: +"Buy American Act (FAR Part 25) domestic content analysis."

changedOutput schema / properties / c_scrm_plan_sections / description

Previous value: -"Paste-ready C-SCRM Plan sections aligned to NIST SP 800-161 Rev. 1."New value: +"Paste-ready Cybersecurity Supply Chain Risk Management (C-SCRM) Plan sections aligned to NIST SP 800-161 Rev. 1."

changedOutput schema / properties / executive_scrm_summary / description

Previous value: -"Executive supply chain risk summary for the Contracting Officer."New value: +"Executive supply chain risk summary for the Contracting Officer and offeror leadership."

changedOutput schema / properties / fascsa_exclusion_check / description

Previous value: -"FAR 52.204-30 FASCSA exclusion order screening status and SAM.gov sources to verify."New value: +"FAR 52.204-30 FASCSA exclusion/removal order screening."

changedOutput schema / properties / ndaa_889_findings / description

Previous value: -"Per-line FAR 52.204-25 Section 889 Part A/B prohibited-vendor findings."New value: +"Per-line FAR 52.204-25 (NDAA Section 889 Part A/B) prohibited-vendor screening findings."

changedOutput schema / properties / nist_800_161_control_gaps / description

Previous value: -"NIST SP 800-161 Rev. 1 SR-family control gaps with severity and implementation guidance."New value: +"NIST SP 800-161 Rev. 1 C-SCRM control gaps with severity and implementation guidance."

changedOutput schema / properties / overall_scrm_verdict / description

Previous value: -"Overall verdict (LOW_RISK_AWARD_ELIGIBLE, MODERATE_RISK_MITIGATION_PLAN_REQUIRED, HIGH_RISK_REMEDIATION_BEFORE_SUBMISSION, PROHIBITED_NDAA_889_OR_FASCSA_BLOCKING_AWARD)."New value: +"Overall C-SCRM / NDAA 889 / FASCSA / TAA / BAA award-eligibility verdict."

changedOutput schema / properties / ready_to_submit_scrm_narrative / description

Previous value: -"Paste-ready proposal SCRM volume narrative with NDAA 889 / FASCSA representations, TAA/BAA certification, and SBOM attestation."New value: +"Paste-ready proposal Supply Chain Risk Management volume narrative with NDAA 889 / FASCSA representations, TAA/BAA certification language, and SBOM attestation statement."

changedOutput schema / properties / remediation_roadmap / description

Previous value: -"Prioritized SCRM POA&M remediation milestones."New value: +"Prioritized SCRM Plan of Action & Milestones (POA&M) remediation roadmap."

changedOutput schema / properties / sbom_attestation / description

Previous value: -"NTIA minimum-elements SBOM review and CISA Secure Software Self-Attestation readiness."New value: +"NTIA SBOM minimum-elements review and CISA Secure Software Self-Attestation readiness."

changedOutput schema / properties / supply_chain_risk_score / description

Previous value: -"Supply chain risk score from 0 (no material risk) to 100 (prohibited / award-blocking)."New value: +"Quantitative supply chain risk score from 0 (no material risk) to 100 (prohibited / award-blocking)."

changedOutput schema / properties / taa_compliance_by_line / description

Previous value: -"Per-line Trade Agreements Act designated-country determinations."New value: +"Per-line Trade Agreements Act (FAR 52.225-5) designated-country determinations."

AddedOct 28, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real context beyond the annotations: it requires an X-RapidAPI-Key, nothing is stored/filed/submitted to SAM.gov, and FASCSA hits must still be independently verified — a material caveat for a compliance verdict. It restates the read-only/non-destructive profile already in annotations, and says nothing about latency, cost, or confidence/basis for the score, so it falls short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Everything stated is substantive, and the purpose and usage triggers are front-loaded. However, it is delivered as one very long run-on paragraph that fuses purpose, output inventory, operational caveats, input limits, and sibling routing — an agent has to parse a dense wall of text rather than scan discrete sections.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, nine-parameter compliance auditor, the description covers inputs, outputs, auth, and failure caveats (SAM.gov verification) with no gaps an agent would need to fill. The enumerated return values are partly redundant given an output schema exists, which trims a point but does not leave the definition incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description adds hard operating bounds the schema only partly conveys in prose: 20–45,000 characters of solicitation context, 1–200 BOM lines, and up to 500 SBOM components. It does not hint at which parameters drive the Auto_Detect_From_Clauses regime selection, which would have made it a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (audit/screen) plus specific resources (hardware BOM lines, sub-tier suppliers, SBOM components) and the exact regulatory regimes applied. It also enumerates the concrete deliverable outputs (risk score, 889/TAA determinations, BAA percentage, SR-family gaps, POA&M), which lets an agent tell it apart from any sibling without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit 'Use this tool when…' trigger (vetting a BOM, reseller quote, or SBOM for award eligibility; drafting a C-SCRM Plan / SBOM attestation) and then routes four named siblings — audit_section_508_vpat, scan_far_dfars_clauses, answer_security_questionnaire, generate_ato_rmf_package — each with the condition that selects it. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All signaltender-mcp tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?