Tender Documents MCP

Neutral Model Context Protocol server for safely downloading and extracting public tender documents. It turns PDFs, modern Office files, text formats and bounded ZIP archives into deterministic text plus generic signals such as headings, dates, amounts and email addresses.

It does not decide whether a tender fits a particular company. Solar, AI-platform, software-development and customer-specific rules belong in the calling agent or skill.

MCP tools

Tool	Purpose
list_supported_formats	Show supported formats and limitations
extract_document	Safely download and extract one public HTTPS document
extract_base64_document	Extract a file already obtained by an authenticated caller
compare_documents	Deterministically compare two public document versions

Security model

• HTTPS only; credentials in URLs are rejected
• DNS answers are checked against private, loopback, link-local, reserved and documentation networks
• The validated public IP is pinned into the HTTPS request to reduce DNS-rebinding risk
• Every redirect is resolved and validated again
• Download size, archive expansion, archive entry count, nesting depth and time are bounded
• Files are processed in memory and not persisted
• Spreadsheets are read without executing formulas or macros

The MCP extracts public or caller-supplied content. It does not bypass portals, authentication, CAPTCHAs or access controls.

Formats

PDF, DOCX, XLSX, PPTX, ODT, TXT, Markdown, CSV/TSV, JSON, XML, HTML and ZIP are supported. Legacy binary Office formats are not. Image-only PDFs return ocr_recommended: true; this version does not invent OCR output.

Run locally

npm ci
MCP_AUTH_TOKEN=replace-me npm start

• Health: GET http://localhost:3000/status
• MCP: POST http://localhost:3000/mcp
• Auth: Authorization: Bearer <MCP_AUTH_TOKEN>

If MCP_AUTH_TOKEN is empty, auth is disabled.

Deploy to Render

The included render.yaml and Dockerfile deploy the service in Frankfurt. Render generates the bearer token automatically. The free instance type is suitable for demos; document extraction can be memory-intensive, so production workloads should use an appropriately sized service.

Output compatibility

Every tool returns MCP structuredContent and mirrors the complete JSON object in the first text content block for clients that consume only text results.