Everything the gateway exposes.
Authentication, endpoints, the full tool catalogue, and what to do when a call fails. Prefer JSON? Start at /api/catalog.
Authentication
Every request carries a bearer key in the Authorization header. Query-string credentials
are not supported: the MCP authorization specification prohibits access tokens in the URI.
Authorization: Bearer YOUR_API_KEY
A missing, malformed, revoked, expired or unknown key returns 401.
Going over your rolling 24 hour quota returns a tool error naming the limit.
Quickstart
Three calls and you know the gateway works. Initialize, verify the key, then ask a real question.
1 · Verify the key harbor_meta_ping
# Initialize first and keep the session id (full handshake in the install tab on the home page).
# Then call harbor_meta_ping on the aggregate endpoint. It must return pong.
curl -s https://port.harborgovcon.com/mcp \
-H "Authorization: Bearer $HARBOR_KEY" \
-H "Mcp-Session-Id: $SID" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"harbor_meta_ping","arguments":{}}}'2 · List the servers harbor_meta_list_servers
curl -s https://port.harborgovcon.com/mcp \
-H "Authorization: Bearer $HARBOR_KEY" \
-H "Mcp-Session-Id: $SID" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"harbor_meta_list_servers","arguments":{}}}'3 · Ask a real question usaspending_naics_market_share
curl -s https://port.harborgovcon.com/mcp \
-H "Authorization: Bearer $HARBOR_KEY" \
-H "Mcp-Session-Id: $SID" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"usaspending_naics_market_share","arguments":{"naics":"541512","fy":2025,"top_n":5}}}'Endpoints
| Endpoint | Tools | Use it for |
|---|---|---|
| https://port.harborgovcon.com/mcp | 142 | Everything, one connection |
| /servers/harbor-meta/mcp | 4 | Account & Service Meta |
| /servers/noaa-cdo/mcp | 8 | NOAA Climate Data |
| /servers/gao-bid-protests/mcp | 8 | GAO Bid Protests |
| /servers/sam-exclusions/mcp | 5 | SAM.gov Exclusions |
| /servers/bea/mcp | 9 | Bureau of Economic Analysis |
| /servers/bls/mcp | 8 | Bureau of Labor Statistics |
| /servers/census/mcp | 12 | US Census |
| /servers/eia/mcp | 10 | Energy Information Administration |
| /servers/usaspending/mcp | 8 | USAspending |
| /servers/sbir-sttr/mcp | 11 | SBIR/STTR |
| /servers/openfda/mcp | 10 | openFDA |
| /servers/sam-contract-awards/mcp | 6 | SAM.gov Contract Awards |
| /servers/sam-entity/mcp | 6 | SAM.gov Entity |
| /servers/sam-federal-hierarchy/mcp | 4 | SAM.gov Agency Hierarchy |
| /servers/sam-opportunities/mcp | 9 | SAM.gov Opportunities |
| /servers/fbi-crime-data/mcp | 8 | FBI Crime Data |
| /servers/federal-register/mcp | 8 | Federal Register |
| /servers/regulations-gov/mcp | 8 | Regulations.gov |
Server catalogue
Prefer a focused endpoint when you know which dataset you need. The aggregate endpoint loads every tool at once, which costs context and hurts tool selection. Search this page for a tool name to find its server.
Account & Service Meta /servers/harbor-meta/mcp
Verify an API key, check remaining quota, and discover servers. Never touches an upstream API.
NOAA Climate Data /servers/noaa-cdo/mcp
Historical climate and weather station data.
GAO Bid Protests /servers/gao-bid-protests/mcp
Bid protest decisions, and how agencies actually get challenged.
SAM.gov Exclusions /servers/sam-exclusions/mcp
Debarment and exclusion records, a compliance gate before any teaming decision.
Bureau of Economic Analysis /servers/bea/mcp
Regional GDP, personal income, and input-output tables.
Bureau of Labor Statistics /servers/bls/mcp
Employment, CPI, wages, and state labor-market panels.
US Census /servers/census/mcp
Market sizing, demographics, business dynamics, and county-level NAICS data.
Energy Information Administration /servers/eia/mcp
Electricity, natural gas, petroleum prices, and generation capacity.
USAspending /servers/usaspending/mcp
Federal spending: agency spend velocity, incumbent discovery, expiring pipeline.
SBIR/STTR /servers/sbir-sttr/mcp
Small-business innovation awards and open topics.
openFDA /servers/openfda/mcp
Drug, device, and recall safety data.
SAM.gov Contract Awards /servers/sam-contract-awards/mcp
Contract award data (CDAS), the FPDS replacement.
SAM.gov Entity /servers/sam-entity/mcp
Entity registration dossiers: the vendor side of the market.
SAM.gov Agency Hierarchy /servers/sam-federal-hierarchy/mcp
Agency and sub-agency codes, the cross-API join key for every other federal dataset.
SAM.gov Opportunities /servers/sam-opportunities/mcp
The federal procurement firehose: pre-solicitations, solicitations, sources sought, awards.
FBI Crime Data /servers/fbi-crime-data/mcp
Crime statistics, clearances, and agency-level trends.
Federal Register /servers/federal-register/mcp
Executive orders, proposed rules, and public-inspection lead-time scanning.
Regulations.gov /servers/regulations-gov/mcp
Rulemaking dockets and comment intelligence.
Errors
| What you see | What it means | What to do |
|---|---|---|
| 401 | Missing, malformed, revoked, expired, or unknown key. | Check the header spelling, then issue a fresh key from the dashboard. |
| 400 · Missing session ID | A request arrived without the MCP session handshake. | Call initialize, keep the Mcp-Session-Id header, send notifications/initialized, then retry. |
| Tool error · quota | The rolling 24 hour or hourly cap for the plan is reached. | Wait for the window to roll, spread calls across keys, or move up a plan. |
| Tool error · upstream | The government source refused, timed out, or rate limited the call. | Retry with backoff. Repeated failures are reported on status. |
Machine readable
/api/catalog, the full catalogue as JSON.
/.well-known/mcp/server-card.json, a static server card for directories.
/healthz, liveness plus server and tool counts.
Fair use
These servers proxy public US government APIs within the rate limits each source sets. Responses are cached where the licence allows, quotas are per account, and abusive traffic is throttled. Do not present this service as an official government data source.