OSF Data Marketplace

Provenance stamped US government and scientific data for AI agents. Over 8.1 million records across 80 official sources, sold per call with x402 USDC micropayments on Base.

The screen most sanctions APIs cannot do. OSF holds 259,803 federal debarment and exclusion records and screens them in the same call as sanctions: 168,106 SAM.gov federal contracting exclusions, 83,600 HHS OIG LEIE healthcare exclusions, plus World Bank debarment and Federal Reserve enforcement, alongside OFAC SDN and Consolidated, EU, UK, UN, Trade.gov CSL and FBI Wanted. Eleven authorities, one call. If your agent needs to know whether a vendor is barred from federal contracting or a provider is excluded from Medicare and Medicaid, that is a question a sanctions list cannot answer and this one can. Try it with no wallet and no signup: npx osf-data-marketplace, or curl "https://api.osf-master-server.com/x402/free/screen/sanctions/Acme%20Medical%20Supply%20LLC".

Install in one paste: https://api.osf-master-server.com/mcp — remote MCP, no key, no account, and 15 of the 21 tools are free, including a sanctions and debarment screen. Jump to your client.

OSF (Open Source Filings) is a live remote MCP server plus an x402 HTTP API. There is nothing to install and nothing to sign up for: an agent with a funded wallet can discover the catalog, get a price quote, pay in USDC, and receive records with full provenance in a single round trip.

• MCP endpoint (streamable HTTP): https://api.osf-master-server.com/mcp

• MCP Registry: io.github.onefreeman1337/osf-data-marketplace

• x402 manifest: https://api.osf-master-server.com/.well-known/x402

• llms.txt: https://api.osf-master-server.com/llms.txt

• Website: https://osf-master-server.com

Install

OSF is a remote MCP server over streamable HTTP. Nothing to download, nothing to run, no API key, no account.

https://api.osf-master-server.com/mcp

15 of the 21 tools are free, including screen_entity_free, a real sanctions and debarment screen 5 times a day with no signup and no key. Install it, ask it real questions, and decide whether it is worth funding a wallet. Every block below is the complete config for that client. Pick yours, paste it, done.

One command, any client

There is also a stdio bridge for clients that take a command instead of a URL. Zero dependencies, 19 kB, no config and no wallet:

npx -y osf-data-marketplace

Same JSON in every client that uses mcpServers — Claude Desktop, Cursor, Cline, Windsurf, LibreChat:

{
  "mcpServers": {
    "osf": {
      "command": "npx",
      "args": ["-y", "osf-data-marketplace"]
    }
  }
}

Claude Code: claude mcp add osf -- npx -y osf-data-marketplace. VS Code uses servers with "type": "stdio" and the same command and args.

Use this when the remote URL will not go in. Claude Desktop's claude_desktop_config.json takes local commands only, so a remote MCP URL pasted into it silently does nothing — a command line works everywhere a config file does. Source for the bridge is bin/cli.js in this repo.

Claude Code

claude mcp add --transport http osf https://api.osf-master-server.com/mcp

Confirm with claude mcp list. You should see osf: https://api.osf-master-server.com/mcp (HTTP) - ✔ Connected.

Claude Desktop and claude.ai

Settings → Connectors → Add → Add custom connector, then paste https://api.osf-master-server.com/mcp.

Remote servers do not go in claude_desktop_config.json. That file is only for local stdio servers, so pasting a URL into it will silently do nothing.

Cursor — ~/.cursor/mcp.json

{
  "mcpServers": {
    "osf": {
      "url": "https://api.osf-master-server.com/mcp"
    }
  }
}

VS Code — .vscode/mcp.json

{
  "servers": {
    "osf": {
      "type": "http",
      "url": "https://api.osf-master-server.com/mcp"
    }
  }
}

Cline — cline_mcp_settings.json

{
  "mcpServers": {
    "osf": {
      "type": "streamableHttp",
      "url": "https://api.osf-master-server.com/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Windsurf — ~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "osf": {
      "serverUrl": "https://api.osf-master-server.com/mcp"
    }
  }
}

Python, no MCP client needed

pip install mcp

import asyncio
from mcp import ClientSession
from mcp.client.streamable_http import streamablehttp_client

async def main():
    async with streamablehttp_client("https://api.osf-master-server.com/mcp") as (r, w, _):
        async with ClientSession(r, w) as s:
            await s.initialize()
            out = await s.call_tool("search_cyber_threats", {"query": "log4j remote code execution"})
            print(out.content[0].text)

asyncio.run(main())

That call is free. Swap search_cyber_threats for any of the other 12 search_* tools, for screen_entity_free when you want a free sanctions and debarment screen, or for screen_entity when you want the same screen with no daily cap.

LangChain and LangGraph

pip install langchain-mcp-adapters "mcp<2"

The mcp<2 pin matters. As of langchain-mcp-adapters 0.3.1 a plain install resolves mcp 2.0.0 and the import fails with ImportError: cannot import name 'RequestContext' from 'mcp.shared.context'. Pinning below 2.0 fixes it.

import asyncio
from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient({
    "osf": {"url": "https://api.osf-master-server.com/mcp", "transport": "streamable_http"}
})

async def main():
    tools = await client.get_tools()      # all 20 OSF tools as LangChain tools
    screen = next(t for t in tools if t.name == "search_cyber_threats")
    print(await screen.ainvoke({"query": "log4j remote code execution"}))

asyncio.run(main())

Bind tools to any LangChain chat model or hand them straight to a LangGraph agent.

Anything else

Any MCP client that speaks streamable HTTP works, because there is no auth handshake to get wrong. If your client only supports SSE, point it at the same URL. If it supports neither, the same data is on a plain HTTP x402 API documented at /llms.txt and /openapi.json.

Related MCP server: ShopGraph

Screen a counterparty in one call

Free, 5 a day, no signup, no API key, no card. Copy and run this, it returns JSON immediately:

curl "https://api.osf-master-server.com/x402/free/screen/sanctions/Wagner%20Group"

Same corpus, same code path, same verdict as the paid route. When the daily allowance is spent it returns HTTP 429 with charged: false and the paid URL; it never charges you.

curl "https://api.osf-master-server.com/x402/screen/sanctions/Gazprombank?format=json"

$0.05, no daily cap. Eleven authorities, 291,000+ listed parties, a provenance URL per match, the complete match list and a retainable sha256 audit receipt. Branch on three outcomes, never two:

Open Source Filings will not certify a negative it cannot prove. NO_MATCH is returned only when the complete candidate set on all 11 authority lists was examined. Every response carries per list candidate_set_complete flags, candidates_examined, records_in_scope, and a sha256 receipt you can retain as evidence of what was checked and when.

Tools (21)

15 of the 21 tools are free. get_catalog, screen_entity_free and all 13 search_* tools take no payment at all: they return record_ids, live per record prices and provenance URLs, so an agent can confirm the data it needs exists before spending anything. Only the 6 tools marked with a price charge.

How payment works

Paid calls follow the x402 protocol: the server answers with a 402 Payment Required quote naming an exact USDC amount on Base mainnet. The agent signs the payment, retries with the payment header, and settlement happens on chain through the Coinbase CDP facilitator. No accounts, no API keys, no subscriptions.

Every record carries a provenance stamp: the originating authority, source URL, and retrieval timestamp, so downstream consumers can verify where the data came from.

Data

80 official sources including SEC EDGAR, CourtListener, arXiv, PubMed, openFDA, CISA, the CVE Program, OFAC, SAM.gov, USAspending, the Senate Lobbying Disclosure Act database, the IRS Exempt Organizations Business Master File, Federal Register, FRED, NOAA and EPA. The warehouse refreshes continuously via a collector fleet with daily missions per source.

Coverage OSF does not have

OSF is United States federal and scientific data. It holds nothing about a European company, a VAT number, or an EU invoice, and an agent should not have to spend a call to discover that. Two independent projects cover ground OSF does not:

• eucompliance.tools — EU VAT rules engine and EN 16931 invoice validation, VIES VAT ID and IBAN checks, EU counterparty checks, on chain transaction preflight. Also x402 v2 on Base with a remote MCP server, no account and no API key, so a wallet that pays OSF pays it too.

• cz-agents — Czech and EU due diligence: ARES company register, ISIR insolvency, ADIS VAT payer reliability, plus business registries for 16 EU countries. MIT licensed MCP servers.

Neither is affiliated with OSF and neither asked to be listed here. Verified live on 2026-08-02.

License

The code and documentation in this repository are MIT licensed. Records served by the API are US public records; each response includes source attribution and any upstream license terms in its provenance block.