Tender Documents MCP

Neutral Model Context Protocol server for safely downloading and extracting public tender documents. It turns PDFs, modern Office files, text formats and bounded ZIP archives into deterministic text plus generic signals such as headings, dates, amounts and email addresses.

It does not decide whether a tender fits a particular company. Solar, AI-platform, software-development and customer-specific rules belong in the calling agent or skill.

MCP tools

Related MCP server: LandingAI ADE MCP Server

Security model

• HTTPS only; credentials in URLs are rejected

• DNS answers are checked against private, loopback, link-local, reserved and documentation networks

• The validated public IP is pinned into the HTTPS request to reduce DNS-rebinding risk

• Every redirect is resolved and validated again

• Download size, archive expansion, archive entry count, nesting depth and time are bounded

• Files are processed in memory and not persisted

• Spreadsheets are read without executing formulas or macros

The MCP extracts public or caller-supplied content. It does not bypass portals, authentication, CAPTCHAs or access controls.

Formats

PDF, DOCX, XLSX, PPTX, ODT, TXT, Markdown, CSV/TSV, JSON, XML, HTML and ZIP are supported. Legacy binary Office formats are not. Image-only PDFs return ocr_recommended: true; this version does not invent OCR output.

Run locally

npm ci
MCP_AUTH_TOKEN=replace-me npm start

• Health: GET http://localhost:3000/status

• MCP: POST http://localhost:3000/mcp

• Auth: Authorization: Bearer <MCP_AUTH_TOKEN>

If MCP_AUTH_TOKEN is empty, auth is disabled.

Deploy to Render

The included render.yaml and Dockerfile deploy the service in Frankfurt. Render generates the bearer token automatically. The free instance type is suitable for demos; document extraction can be memory-intensive, so production workloads should use an appropriately sized service.

Output compatibility

Every tool returns MCP structuredContent and mirrors the complete JSON object in the first text content block for clients that consume only text results.