← Back to search

io.github.cyanheads/federal-regulations-mcp-server

cyanheads streamable_http Scanned 22d ago

Search and trace US federal rules across the Federal Register, eCFR, and Regulations.gov.

B
82.9 / 100

Versions

0.1.0latest
first seen Jun 30, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 7

regulations_search_rules
annotations: verified low

Search the Federal Register — the daily journal of US proposed rules, final rules, notices, and presidential documents (1994–present) — filtering by full-text query, document type, agency slug, and publication date range. The primary discovery entry point: results carry the document number (open with regulations_get_document), each issuing agency with its filterable slug, docket IDs, RINs, and affected CFR parts that chain into the comment and codified-text tools. A query ranks by relevance unless order says otherwise; filter-only browsing lists newest first. The Federal Register caps navigation at 50 pages and the match count at 10,000; when a result set is larger, narrow with published_after/published_before rather than paging deeper.

input object
readOnlyHint true openWorldHint true
regulations_browse_cfr
annotations: verified low

Explore the codified Code of Federal Regulations via eCFR in two modes. "structure" lists all 50 titles; with a title, that title\'s top-level divisions (its chapters, or subtitles); and with a title and part, every section and appendix in the part, flattened and paged, each naming the subpart and subject group it sits under — the way to enumerate a part\'s sections without reading its text. "search" runs a full-text query across the codified CFR and returns matching sections with their hierarchy path and a snippet, one result per section, paged. Both modes accept title and part to narrow the scope. Both feed regulations_get_cfr_section. Every search result reports which corpus answered it — the synced local mirror or the live eCFR index — and what that corpus covers, in `source` and `sourceScope`.

input object
readOnlyHint true openWorldHint true
regulations_list_open_comments
annotations: verified low

List Federal Register documents currently open for public comment, sorted by closing date (soonest first) across the whole open window, filterable by document type, agency slug, and topic. "What can I still weigh in on?" Covers proposed rules and the final rules that take comment (direct final and interim final rules) by default; add NOTICE for the much larger set of notices with comment periods. Runs on the Federal Register\'s open-comment window and is fully functional without a key. When REGULATIONS_GOV_API_KEY is configured, each row is enriched with the comment count from the Federal Register document\'s embedded Regulations.gov info (no extra rate-limited call). Open one row with regulations_get_document for the full document, or pull the comments with regulations_find_comments.

input object
readOnlyHint true openWorldHint true
regulations_get_document
annotations: verified low

Fetch one Federal Register document by its FR document number — full metadata (title, type, agencies, abstract, action, effective/comment dates, RINs) plus the cross-source handles that make this a workflow server. The output carries the docket ID (chain into regulations_get_docket or regulations_find_comments) and the affected CFR parts (chain into regulations_get_cfr_section). Set include_full_text only when the rule body itself is needed: it returns the plain-text body as a window of up to 64,000 characters (max_chars raises it to 200,000), with the body's total length and, when text remains, the offset to resume from. Short documents return whole; major final rules run past a million characters, so page through with offset rather than reading them in one call.

type string dates string input object action string output object abstract string documentNumber string
readOnlyHint true idempotentHint true
regulations_get_docket
annotations: verified low

Pull a rulemaking docket from Regulations.gov by docket ID (e.g. "EPA-HQ-OAR-2025-0194") — the docket\'s metadata (title, agency, RIN, abstract) and the documents filed in it (NPRM, final rule, supporting materials). The docket is the folder holding a rule\'s whole paper trail; each returned document\'s objectId feeds regulations_find_comments. A docket often contains hundreds of supporting materials — filter document_types to "Proposed Rule"/"Rule" to find the rule documents themselves. Requires REGULATIONS_GOV_API_KEY (free at https://api.data.gov/signup/); the Federal Register and eCFR tools work without it.

input object output object abstract string agencyId string docketId string docketType string modifyDate string
readOnlyHint true idempotentHint true
regulations_find_comments
annotations: verified low

Fetch public comments on a Federal Register document or a Regulations.gov docket — the unique corpus of what citizens and organizations actually submitted. Provide exactly one targeting parameter: docket_id (all comments in a docket, broadest), document_object_id (comments on one document, from regulations_get_docket), fr_document_number (convenience — resolves the FR number to its Regulations.gov document internally), or comment_id (one comment's full detail and attachments). The list endpoint returns no body text or attachment info — call with comment_id to read a comment's body. When a comment's real content is a PDF/DOCX attachment, the body is a stub and attachmentOnly is true; the attachment download URLs are returned. Requires REGULATIONS_GOV_API_KEY (free at https://api.data.gov/signup/).

input object
readOnlyHint true openWorldHint true
regulations_get_cfr_section
annotations: verified low

Read the codified text at a CFR location via eCFR — current or as of a past date. Answers "what does 40 CFR 50.1 say today?" and "...as of 2019-01-01?". Three locations: title + part + section for one section; title + part alone for the whole part, with an index of its sections and the names of its appendices; title + appendix for one appendix, passing the identifier exactly as regulations_browse_cfr emits it. A section can be written as people cite it — "61", "§ 141.61", or "141.61(c)" in part 141 all read 40 CFR 141.61, and the response names the identifier it read. Text comes back as a window of up to 64,000 characters (max_chars raises it to 200,000) with the total length and, when text remains, the offset to resume from; whole parts run to millions of characters, so page with offset or read a single section. eCFR retains historical versions from 2017 through the title\'s up-to-date date; a date outside that window is rejected with the window named. Current single-section reads are served from a synced local mirror when available; the source is reported.

input object
readOnlyHint true idempotentHint true

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 26

info
Tool 'regulations_search_rules' annotations are consistent annotation_checker · 80%
info
Tool 'regulations_browse_cfr' annotations are consistent annotation_checker · 80%
info
Tool 'regulations_list_open_comments' annotations are consistent annotation_checker · 80%
info
Tool 'regulations_get_document' annotations are consistent annotation_checker · 80%
info
Tool 'regulations_get_docket' annotations are consistent annotation_checker · 80%
info
Tool 'regulations_find_comments' annotations are consistent annotation_checker · 80%
info
Tool 'regulations_get_cfr_section' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Hex string literal (>50 chars) in cyanheads-federal-regulations-mcp-server-2272cc5/tests/tools/get-cfr-section.contract.test.ts:221 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: regulations_search_rules manifest_parser · 75%
info
Tool: regulations_browse_cfr manifest_parser · 75%
info
Tool: regulations_list_open_comments manifest_parser · 75%
info
Tool: regulations_get_document manifest_parser · 75%
info
Tool: regulations_get_docket manifest_parser · 75%
info
Tool: regulations_find_comments manifest_parser · 75%
info
Tool: regulations_get_cfr_section manifest_parser · 75%
info
Required env vars (4) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 13 components sbom_generator · 100%
high
Generic API Key Assignment found in cyanheads-federal-regulations-mcp-server-2272cc5/src/config/server-config.ts secret_scanner · 75%
high
Hardcoded Password found in cyanheads-federal-regulations-mcp-server-2272cc5/framework-skills/api-utils/references/security.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%