Cdgmcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Cdgmcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that exposes a Congress.gov-style legislative GraphQL API to MCP clients (such as VS Code, Claude Desktop, or other agents). It provides high-level tools for querying bills, actions, committee activities and cosponsors, plus a raw GraphQL escape hatch for advanced queries.
| Tool | Description |
|---|---|
search_bills | Search/list bills with filters (congress, chamber, type, title, latest action, dates, sponsor). |
get_bill | Fetch a single bill's full details, with optional actions, cosponsors, committee activities, titles and text versions. |
search_committee_activities | Find committee referrals/activities and their related bills. |
search_actions | Search the legislative action history (e.g. "Passed House", "Became Public Law"). |
search_cosponsors | Search cosponsorship records across bills. |
get_node | Fetch any object directly by its Relay global id. |
graphql_query | Run an arbitrary read-only GraphQL query (mutations rejected). |
The API is built with Hot Chocolate 16.2.0 and follows Relay conventions. The search tools are connection-based: each returns pageInfo.endCursor, which you can pass back as the after argument to fetch the next page.
| URI | Description |
|---|---|
cdg://schema | The live GraphQL schema (SDL). |
cdg://guide | Data model and usage guide. |
cdg://endpoint | The configured GraphQL endpoint. |
across them?
The GraphQL endpoint defaults to http://dotnet10-dev:5208/graphql/. Override it with the CDG_GRAPHQL_ENDPOINT environment variable.
npm install
npm run build
npm start # or: node dist/index.jsFor development (no build step) use:
npm run dev # runs src/index.ts via tsxAdd to your .vscode/mcp.json (or user mcp.json):
{
"servers": {
"cdgmcp": {
"command": "node",
"args": ["${workspaceFolder}/cdgmcp/dist/index.js"],
"env": {
"CDG_GRAPHQL_ENDPOINT": "http://dotnet10-dev:5208/graphql/"
}
}
}
}The server communicates over stdio.
This is supposed to be a standalone testing something, but I haven't seen it work.
HOST=0.0.0.0 npx @modelcontextprotocol/inspector node dist/index.js~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.