SignalTender B2B, GovCon & LegalTech MCP Server

Scan FAR / DFARS & CMMC Regulatory Flow-Down Clauses

scan_far_dfars_clauses

Read-onlyIdempotent

Scan solicitation Section I or subcontract flow-down text to identify every FAR (52.2xx) and DFARS (252.2xx) clause, flag mandatory subcontractor flow-downs, and score CMMC 2.0, NIST SP 800-171, and FedRAMP compliance burden. This is a read-only, stateless regulatory audit (requires X-RapidAPI-Key; raw_text accepts 30 to 100,000 characters, and contractor_role adjusts risk severity and flow-down obligations for a 'prime_contractor' [default], 'subcontractor', or 'commercial_item_vendor' under FAR Part 12). Use this tool when performing federal acquisition regulation (FAR/DFARS/CMMC) clause compliance; use audit_contract_risks instead for commercial MSA/NDA legal redlining, or answer_security_questionnaire to draft control-by-control NIST 800-171 / SOC 2 questionnaire responses.

Input Schema

Name	Required	Description	Default
`raw_text`	Yes	Solicitation Section I, contract clause list, or subcontract agreement text containing FAR (`52.2xx`) or DFARS (`252.2xx`) citations (30 to 100,000 characters).
`contractor_role`	No	Bidder's contracting tier: 'prime_contractor' (evaluates full agency compliance and outbound flow-down duties), 'subcontractor' (flags over-broad prime flow-downs), or 'commercial_item_vendor' (filters against FAR 52.212-5 commercial item exemptions).	prime_contractor
`handles_cui_or_cdi`	No	Whether the contractor will store, process, or transmit Controlled Unclassified Information (CUI) or Covered Defense Information (CDI).

Output Schema

Name	Required	Description
`detected_clauses`	No	Detailed breakdown of every FAR/DFARS/supplement clause found, with severity, flow-down status, and remediation advice.
`solicitation_summary`	No	Concise executive summary of the regulatory posture, agency context, and contract vehicle.
`total_clauses_detected`	No	Total number of FAR, DFARS, and agency supplement clauses identified.
`compliance_burden_level`	No	Categorical compliance burden level (LOW, MODERATE, HIGH, EXTREME_DEFENSE_GRADE).
`cyber_compliance_profile`	No	Structured CMMC 2.0, NIST SP 800-171, FedRAMP, and cyber incident reporting requirements.
`mandatory_flowdown_count`	No	Number of detected clauses that carry mandatory subcontractor flow-down obligations.
`contractor_role_evaluated`	No	The contractor role perspective used for the audit.
`ip_and_data_rights_warnings`	No	Specific warnings regarding Government Unlimited Rights, GPR, computer software rights (FAR 52.227 / DFARS 252.227), or patent traps.
`priority_compliance_actions`	No	Ordered checklist of immediate pre-proposal actions (e.g., SPRS score verification, CMMC assessment, IP assertion table in Section K/L).
`overall_compliance_burden_score`	No	Overall regulatory and cybersecurity compliance burden score from 0 (minimal commercial burden) to 100 (extreme defense/CMMC/IP burden).

Schema Changelog

Changes observed during successful MCP inspections.

Changed13 schema fields changedOct 29, 2026

addedInput schema / properties / handles_cui_or_cdi

Added value: +{
+  "default": true,
+  "description": "Whether the contractor will store, process, or transmit Controlled Unclassified Information (CUI) or Covered Defense Information (CDI).",
+  "type": "boolean"
+}

addedOutput schema / properties / compliance_burden_level

Added value: +{
+  "description": "Categorical compliance burden level (LOW, MODERATE, HIGH, EXTREME_DEFENSE_GRADE).",
+  "type": "string"
+}

removedOutput schema / properties / compliance_burden_score

Removed value: -{
-  "description": "Regulatory compliance complexity score from 0 to 100.",
-  "type": "integer"
-}

addedOutput schema / properties / contractor_role_evaluated

Added value: +{
+  "description": "The contractor role perspective used for the audit.",
+  "type": "string"
+}

addedOutput schema / properties / cyber_compliance_profile

Added value: +{
+  "description": "Structured CMMC 2.0, NIST SP 800-171, FedRAMP, and cyber incident reporting requirements.",
+  "type": "object"
+}

removedOutput schema / properties / cybersecurity_posture_summary

Removed value: -{
-  "description": "Required CMMC 2.0, NIST SP 800-171, or FedRAMP authorization posture.",
-  "type": "string"
-}

changedOutput schema / properties / detected_clauses / description

Previous value: -"Parsed FAR/DFARS clauses with mandatory flow-down status, risk level, and remediation guidance."New value: +"Detailed breakdown of every FAR/DFARS/supplement clause found, with severity, flow-down status, and remediation advice."

addedOutput schema / properties / ip_and_data_rights_warnings

Added value: +{
+  "description": "Specific warnings regarding Government Unlimited Rights, GPR, computer software rights (FAR 52.227 / DFARS 252.227), or patent traps.",
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / mandatory_flowdown_count

Added value: +{
+  "description": "Number of detected clauses that carry mandatory subcontractor flow-down obligations.",
+  "type": "integer"
+}

addedOutput schema / properties / overall_compliance_burden_score

Added value: +{
+  "description": "Overall regulatory and cybersecurity compliance burden score from 0 (minimal commercial burden) to 100 (extreme defense/CMMC/IP burden).",
+  "type": "integer"
+}

addedOutput schema / properties / priority_compliance_actions

Added value: +{
+  "description": "Ordered checklist of immediate pre-proposal actions (e.g., SPRS score verification, CMMC assessment, IP assertion table in Section K/L).",
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / solicitation_summary

Added value: +{
+  "description": "Concise executive summary of the regulatory posture, agency context, and contract vehicle.",
+  "type": "string"
+}

addedOutput schema / properties / total_clauses_detected

Added value: +{
+  "description": "Total number of FAR, DFARS, and agency supplement clauses identified.",
+  "type": "integer"
+}

Changed5 schema fields changedOct 21, 2026

addedInput schema / properties / contractor_role / description

Added value: +"Bidder's contracting tier: 'prime_contractor' (evaluates full agency compliance and outbound flow-down duties), 'subcontractor' (flags over-broad prime flow-downs), or 'commercial_item_vendor' (filters against FAR 52.212-5 commercial item exemptions)."

changedInput schema / properties / raw_text / description

Previous value: -"Solicitation Section I or subcontract flow-down text containing FAR/DFARS citations."New value: +"Solicitation Section I, contract clause list, or subcontract agreement text containing FAR (`52.2xx`) or DFARS (`252.2xx`) citations (30 to 100,000 characters)."

addedInput schema / properties / raw_text / maxLength
```
Added value: +100000
```
addedInput schema / properties / raw_text / minLength
```
Added value: +30
```

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "compliance_burden_score": {
+      "description": "Regulatory compliance complexity score from 0 to 100.",
+      "type": "integer"
+    },
+    "cybersecurity_posture_summary": {
+      "description": "Required CMMC 2.0, NIST SP 800-171, or FedRAMP authorization posture.",
+      "type": "string"
+    },
+    "detected_clauses": {
+      "description": "Parsed FAR/DFARS clauses with mandatory flow-down status, risk level, and remediation guidance.",
+      "items": {
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

First observedOct 18, 2026

TDQS

A4.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, non-destructive behavior, but the description adds useful context: it is stateless, requires an X-RapidAPI-Key, accepts 30 to 100,000 characters, and adjusts risk severity and flow-down obligations based on `contractor_role`. It does not discuss output format or rate limits, but the output schema exists and annotations cover the safety profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but front-loaded, starting with the core action and followed by constraints and alternatives. It is appropriately sized for a complex regulatory scanning tool, though the single long paragraph could be split for easier scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the available annotations, full schema coverage, and output schema, the description is complete enough for correct invocation. It covers purpose, prerequisites, input constraints, role-based behavior, and sibling alternatives without needing to explain return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description still adds value by explaining how `contractor_role` affects risk severity and flow-down obligations and by restating the `raw_text` length range, though `handles_cui_or_cdi` is left to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: scan solicitation Section I or subcontract flow-down text to identify FAR/DFARS clauses, flag mandatory flow-downs, and score CMMC/NIST/FedRAMP burden. It clearly distinguishes this from nearby tools by naming `audit_contract_risks` for commercial MSA/NDA redlining and `answer_security_questionnaire` for security questionnaire drafting.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance for federal acquisition clause compliance and names two concrete alternatives with their distinct use cases. This leaves little ambiguity about when an agent should choose this tool versus its siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SignalTender B2B, GovCon & LegalTech MCP Server tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.