Diario Oficial de la Federación (unofficial)

dof-mcp

[CI] [Contract] [OpenSSF Scorecard] [OpenSSF Best Practices] [npm]

MCP server and typed TypeScript client for Mexico's Diario Oficial de la Federación (DOF), built on the public SIDOF JSON API, so AI agents (Claude Code, Claude Desktop, Cursor, etc.) can read official publications and financial indicators.

Why

The DOF is where federal laws, decrees, tax and customs rules, and official indicators are published. Its JSON API is public, with only sparse official documentation (https://sidof.segob.gob.mx/datos_abiertos), and there is no typed client or MCP server for it on npm. This project wraps it with validation, provenance and a stable, normalized shape.

MCP server

Three read-only tools:

Every result includes:

• officialUrl: the publication on dof.gob.mx, so a person can check the official text
• provenance: the SIDOF URL the data came from, when it was fetched (UTC) and a SHA-256 of the raw response

Install

Requires Node.js 22 or later. The server runs over stdio; add it to your MCP client:

{  "mcpServers": {    "dof": { "command": "npx", "args": ["-y", "dof-mcp"] }  }}

• Claude Desktop: Settings → Developer → Edit Config, which opens claude_desktop_config.json (%APPDATA%\Claude\ on Windows, ~/Library/Application Support/Claude/ on macOS).
• Cursor: .cursor/mcp.json in your project, or ~/.cursor/mcp.json for every project.
• Claude Code: claude mcp add dof -- npx -y dof-mcp
• Windows: if your client cannot start npx directly, use "command": "cmd", "args": ["/c", "npx", "-y", "dof-mcp"].

Hosted endpoint (no install)

A public instance runs at https://mcp.aldomatias.com/mcp (Streamable HTTP, no authentication, rate limited). Use it from clients that accept remote MCP servers, such as custom connectors in Claude, or:

claude mcp add --transport http dof https://mcp.aldomatias.com/mcp

It serves the same tools and the same release as the npm package. It is a free, best-effort service with no SLA; for heavy use, run the package yourself.

Privacy. The endpoint does not store IP addresses, tool arguments or results. For each request it logs the HTTP method and path, status, duration, the JSON-RPC method, the tool name, and the name and version your MCP client reports about itself (for example claude-ai). Those logs are kept for 7 days in AWS CloudWatch and are used only to count usage and detect failures. Traffic passes through Cloudflare, which processes IP addresses to apply rate limiting and DDoS protection under its own privacy policy. Questions: [email protected].

Streamable HTTP

npx dof-mcp --http --port 3000   # endpoint http://127.0.0.1:3000/mcp, probe /healthz

The HTTP transport is stateless, binds to 127.0.0.1 and validates the Host and Origin headers (--allowed-host <name> adds hostnames). It has no authentication or rate limiting: to expose it beyond localhost, put it behind a reverse proxy that adds them. See SECURITY.md.

Client

The package is ESM. import works everywhere; require("dof-mcp") works on Node.js 22.12 and later (require(esm)).

import { DofClient } from "dof-mcp";
const dof = new DofClient();
const notes = await dof.getNotes("2026-10-16");// [{ id: 5801377, title: "Acuerdo por el que se crea ...", date: "2026-10-16",//    edition: "matutina", branch: "PODER EJECUTIVO",//    organization: "SECRETARIA DE SEGURIDAD Y PROTECCION CIUDADANA", page: 4,//    hasPdf: true, hasHtml: true,//    officialUrl: "https://dof.gob.mx/nota_detalle.php?codigo=5801377&fecha=16/10/2026" }, ...]
const note = await dof.getNote(5801457); // full text as plain textconst fix = await dof.getIndicatorSeries("fix", "2026-10-01", "2026-10-16");
const { data, source } = await dof.getNotesWithSource("2026-10-16");// source: { sourceUrl, fetchedAt, sha256, bytes }

Options (all optional):

Design notes

• Validation at the boundary. Every response is parsed with Zod; an unexpected shape fails loudly instead of leaking undefined into callers.
• Normalization. SIDOF mixes section headers and publications in one list and writes some missing values as the string "null"; the client returns titled publications only, with ISO dates, booleans and plain-text content.
• Polite to the source. Identifying User-Agent, concurrency limit, cache, no redirects. SIDOF answers 406 to a bare Accept: application/json, so the client sends a header with a fallback.
• Recorded fixtures. Tests run against real recorded responses; a nightly contract test checks the live API still matches.

Roadmap

• Typed client for daily publications, note detail and indicators (FIX, UDIS, TIIE)
• MCP server (stdio + Streamable HTTP) with dof_daily_summary, dof_get_note, dof_get_indicators
• Hardening: size limits, backoff with jitter, cache, provenance; nightly contract test
• Release pipeline: npm trusted publishing with provenance, MCP Registry
• Optional: hosted endpoint, local search index (dof_search_notes; SIDOF's own search is broken)

Development

See CONTRIBUTING.md and RELEASING.md.

npm installnpm run lint && npm run typecheck && npm test && npm run buildnpm run test:live   # contract tests against the live API

Disclaimer

Unofficial project, not affiliated with the Secretaría de Gobernación. Data comes from the public SIDOF API and may change without notice. The text this package returns is a plain-text conversion, not the official edition: the official DOF is the signed PDF on dof.gob.mx, so always confirm against it.

The MIT license covers this code, not DOF content. SIDOF's legal notice allows reproducing its content for non-commercial purposes when the source is cited; commercial use requires written consent from the Secretaría de Gobernación. If you republish content obtained with this package, cite the Diario Oficial de la Federación as the source.

License

MIT