Back to blog

Engineering · May 29, 2026

MCP Spotlight: DataNexus — 35 Public-Data Tools, Zero API Keys, One MCP Server

DataNexus gives AI agents 35 tools across CVE/SBOM security audits, nonprofit intelligence, federal contract data, patent search, and domain forensics — with no API keys, no Docker, and one 30-second setup.

MCP ServerDataNexusSecurityVulnerability IntelligencePublic DataAI Agents

MCP Spotlight: DataNexus — 35 Public-Data Tools, Zero API Keys, One MCP Server

Server: @datanexusmcp/mcp-server by DataNexus Stars: growing · License: MIT · Tools: 35 · API key required: No MCP Tracker: glama.ai/mcp/servers/datanexusmcp/mcp-server

Most MCP servers do one thing well. DataNexus tries a different approach: 35 tools across six data domains, all powered by public government and open-source datasets, unified under a single MCP endpoint — with zero API keys required.

Connect in 30 seconds:

{
  "mcpServers": {
    "datanexus": {
      "type": "http",
      "url": "https://datanexusmcp.com/mcp"
    }
  }
}

Or via npx for stdio clients like Claude Desktop:

npx -y @datanexusmcp/mcp-server

What It Covers

DataNexus aggregates and normalises 16 public data sources into structured, AI-Ready Markdown. No HTML parsing, no CSV wrangling — your agent gets clean data to reason over.

DomainToolsSources
Security & Vulnerability (T10)10 tools — CVE details with CVSS, EPSS exploit probability, CISA KEV checks, SBOM audits, package vulnerability lookups (npm/PyPI/Go), licence verification, dependency graphsNIST NVD, OSV.dev, CISA KEV, FIRST EPSS, deps.dev
Domain Intelligence (T07)7 tools — DNS records, SPF/DMARC/DKIM validation, RDAP, reverse IP, subdomain enumeration via CT logs, SSL certificate chain, domain historyCloudflare DNS, crt.sh
Nonprofit Intelligence (T04)3 tools — Full IRS 990 filings by EIN, name search across US nonprofits, UK Charity Commission lookupIRS EO BMF/TEOS, UK Charity Commission
Patent & Legal (T11)4 tools — Patent lookup by number, keyword search across EPO/USPTO/WIPO, inventor portfolio, forward/backward citationsEPO, USPTO, WIPO
Government Contracts (T18)3 tools — Vendor contract history, contract award search, open solicitationsUSASpending.gov, SAM.gov
Compliance & Identity (T22)5 tools — SAM exclusion check, NPI provider verification, NPI name search, FINRA BrokerCheckSAM.gov, NPPES NPI Registry, FINRA

Plus 3 meta-tools: search_datanexus_tools (find the right tool for your task), report_feedback (report data quality issues), and validate_tool_output (anomaly detection on responses).

The Time Savings Are Real

DataNexus publishes benchmarks comparing manual lookups against MCP tool calls:

TaskManual SourceManual TimeDataNexus
Nonprofit financialsIRS Tax Exempt Search + CSV12 min2 sec
SAM exclusion checkSAM.gov portal8 min1 sec
CVE detail + CVSSNVD search + JSON parsing10 min1 sec
SBOM audit vs CISA KEVGrype + manual KEV cross-ref60 min3 sec
Federal contract historyUSASpending.gov export25 min2 sec
NPI verificationNPPES NPI Registry8 min1 sec
Patent keyword searchGoogle Patents + USPTO20 min2 sec

The SBOM audit case is particularly compelling: what takes a security engineer an hour of tool-chaining (Grype scan, manual CISA KEV cross-referencing, CVSS enrichment) becomes a single MCP tool call that returns structured, audit-ready output in seconds.

Real-World Use Cases

Compliance analysts run background checks across IRS, SAM.gov, and NPPES — manually 45 minutes, with DataNexus 4 minutes.

Security engineers audit SBOMs against CISA KEV before federal software submissions — manually 2 hours, with DataNexus: security_audit_sbom_vulnerabilities.

M&A teams do due diligence on organizations — SAM exclusion checks, contract history, NPI verification, and patent portfolio, all inside a single Claude conversation.

Researchers follow the money across nonprofits, government contracts, and patent filings without jumping between six different government websites with incompatible export formats.

Facio Integration

DataNexus is a pure HTTP MCP server — no local dependencies, no Docker, no API keys. Add it to your Facio agent config:

{
  "mcpServers": {
    "datanexus": {
      "type": "http",
      "url": "https://datanexusmcp.com/mcp"
    }
  }
}

All 35 tools become available immediately. Facio's built-in audit trail captures every tool call and response, so compliance analysts using DataNexus through Facio get complete traceability — the query, the source, the structured response, and the agent's decision, all in one log.

Quickstart Examples

Once connected to DataNexus, try these in any MCP-compatible agent:

Nonprofit due diligence:

Look up EIN 46-5734087, check if they're excluded from federal contracts, and find any government contracts they've won.

Security audit:

Check lodash 4.17.15 for CVEs, get the EPSS exploit probability for any critical findings, and check if they're on the CISA KEV list.

Healthcare provider verification:

Find NPI records for Dr. Jane Smith in California and verify their FINRA registration.

Patent research:

Search patents by keyword "federated learning privacy" and pull the full record for the most recent filing.

Government contractor check:

Get the federal contract history for Lockheed Martin and check for any open solicitations in AI.

Architecture Note: Why This Approach Works

DataNexus takes a pragmatic stance on MCP server design. Instead of requiring self-hosting with Docker and API keys for every data source, it operates a hosted HTTP endpoint that normalises, caches, and delivers public data as structured Markdown. For clients behind strict firewalls, the npx stdio transport provides the same 35 tools routed through your own process.

This hybrid model — free hosted for instant access, self-hostable for private deployments — is a practical pattern more MCP servers should adopt. The code is MIT-licensed on GitHub, so you can audit the normalisation logic, run your own instance, or contribute additional data sources.

Bottom Line

DataNexus MCP packs 35 tools across six domains into a single 30-second setup with zero API keys. For security engineers doing SBOM audits, compliance teams running background checks, or any agent-driven workflow that touches public data, it replaces half a dozen government website logins with one clean MCP endpoint.

The SBOM-to-CISA KEV audit alone — 60 minutes down to 3 seconds — makes it worth adding to your stack.


MCP Spotlight is a series covering servers that give AI agents real capabilities. Every server is evaluated for tool quality, data freshness, and integration fit with Facio's HITL-first agent runtime.