DoveVannoINostriSoldi: an Italian public spending portal with a read-only MCP server

The gap DoveVannoINostriSoldi tries to close

Italian budget, payment, procurement and debt data already exist in public form. The README's own framing is that they are scattered across different portals, hard to compare and hard to read for anyone who does not work with public data daily. The project is a civic, open source attempt to reduce that distance. It collects official sources and presents them in one place, with each number carrying its source, its period and its limits.

The target reader is not a ministry analyst. It is a journalist checking a claim, a council opposition group comparing two administrations, a researcher who needs a citable figure, or a citizen who wants to see how their Comune spends. The README lists what a visitor can do in two minutes: see spending by Comuni, Stato, health service and public bodies; compare territories, administrations and time series; open the official source behind each number; and understand what a figure measures and what it does not.

The editorial stance is deliberately narrow. The README states that an unusual value indicates where to look more carefully and does not by itself demonstrate waste or wrongdoing. That sentence sets the ceiling on what the tool is for. It is a pointer to sources, not a verdict machine.

How the portal, the catalogue and the MCP server fit together

The repository is a Next.js application in TypeScript, with node >=22.19.0 declared in package.json. Alongside src/ and public/ there are data/, supabase/, scripts/, tests/ and research/ directories, plus two Python requirements files: requirements-etl.txt and requirements-public-spending.txt. That layout points to a split between a TypeScript front end and Python ETL jobs that prepare the datasets.

The site is organised by domain rather than by data provider. There are pages for Imprese (ISTAT), Istruzione (MIM and university data), Povertà (ISTAT absolute and relative poverty), Soldi (SIOPE municipal cash outflows, health, pensions, environment, consultancy), Territori (regional and municipal comparisons, OpenCivitas profiles, CPT and MEF IRPEF), Fondi e progetti (OpenCoesione, PNRR Italia Domani), Opere pubbliche (OpenBDAP MOP, expected versus actual cost), Spese dello Stato (OpenBDAP/RGS payments by function and administration), Debito pubblico (Banca d'Italia and Eurostat), Appalti (ANAC, TED) and Istituzioni.

The machine-readable layer is the interesting part. The README states that the MCP catalogue exposes 93 datasets queryable in read-only mode, and the MCP page documents two tools, list_datasets and query_dataset. The source registry lists 33 official links. A separate assistant page connects a user's own AI to the site's verified data and to documents the user attaches. Nothing in the repository suggests write access through MCP; the README describes it as read-only, and the environment example gates browser origins and hosts for /api/mcp through MCP_ALLOWED_ORIGINS and MCP_ALLOWED_HOSTS.

Installing the project and querying your first dataset

The README does not give a step-by-step local installation. What it does give is a package.json whose scripts define the workflow, and a .env.example that names the variables the server expects. Read the two together and the shape is clear. Node 22.19.0 or newer is required.

Start by installing dependencies and copying the environment template. The .env.example file is the authoritative list of variables; leave the optional ones empty rather than guessing values.

npm install
cp .env.example .env.local
npm run dev

The dev script is next dev, so the app should come up on the default Next.js port. For a production check, the build script is more than a plain next build: it runs a source-health snapshot step with node --experimental-strip-types, then next build, then a runtime trace check.

npm run build
npm start

Before trusting a local run, run the offline test suite. It sets DVNS_OFFLINE_GUARD=1 and loads an offline guard module, which tells you the maintainers intend these tests not to hit the network.

npm test

For the data pipeline rather than the site, the Python side has its own entry points: test:etl runs python3 -m unittest discover -s tests/etl, and test:snapshots validates generated artifacts. If your interest is the MCP endpoint rather than the UI, the README points to the MCP page for connection instructions and the catalogue for the dataset list; the two tools to expect there are list_datasets and query_dataset. Note that the refresh endpoint POST /api/internal/refresh-sources is protected by SOURCE_REFRESH_SECRET, so you cannot trigger a source refresh without configuring that secret.

The Budget Law simulator and what it does not model

The Legge di Bilancio page is the project's most opinionated feature. It takes OpenBDAP stanziamenti and lets a user simulate reallocating them across missions. The README is explicit about the perimeter: competenza, not cassa, and specifically competenza A1. That distinction matters more than the interface. Competenza figures are amounts budgeted or committed in a year; cassa figures are money actually paid out. A reallocation exercise on competenza tells you what the budget document allocates, not what left the treasury.

That is a real limitation, not a footnote. Anyone using the simulator to argue about realised spending is using the wrong number. The same caution applies to the Opere pubbliche page, which compares expected and actual cost from OpenBDAP MOP. A gap between the two is a signal to investigate the project, not an established overrun, and the README's general warning about unusual values applies here too.

Coverage is also uneven by design. Some domains are rich (Eurostat COFOG spending, SIOPE municipal payments, ANAC procurement operators), others are single-indicator pages (povertà, debito pubblico). The README does not claim uniform depth across the 33 official links, and the Fonti page is where link status, catalogue, coverage and calendar are documented. Treat that page as the honest map of what is current and what is not.

Where this is the wrong tool

Three cases stand out. First, anything requiring a system of record. DoveVannoINostriSoldi is a presentation and query layer over other people's data. If a figure is wrong upstream, the portal shows the wrong figure with a correct citation. It does not reconcile against the original accounting systems, and nothing in the repository describes a correction workflow beyond the GitHub issue form behind the «Segnala un problema» button.

Second, anything requiring real-time or near-real-time numbers. The repository has a source-health snapshot step in the build and a protected refresh endpoint, which implies periodic rather than continuous ingestion. The README describes coverage in terms of published periods, not live feeds.

Third, causal or legal conclusions. The README states plainly that an unusual value does not by itself demonstrate waste or an illicit act. A tool built on that premise cannot be used to assert either. If your question is "was this contract corrupt", this project will point you at ANAC and TED data and stop there.

There is also an operational constraint worth naming. The environment example shows that the GitHub App behind the report button needs Issues: Read and write on this repository only, and that a missing variable makes the endpoint return 503 and fall back to a prefilled GitHub composer. Self-hosters who skip that configuration lose the reporting path, not the data.

How it differs from OpenBDAP, OpenCivitas or a spreadsheet

The upstream portals are the alternative, and the difference is integration plus annotation. OpenBDAP publishes the raw stanziamenti and payment data; OpenCivitas publishes municipal finance profiles; SIOPE publishes municipal cash movements; ISTAT and Eurostat publish their own series. Each is authoritative within its scope and none of them tries to sit next to the others. A user comparing health spending with municipal payments normally opens three portals and reconciles units, years and definitions by hand.

DoveVannoINostriSoldi's contribution is that reconciliation layer plus a per-number statement of source, period and limits, and an MCP interface so an AI client can query the same catalogue without scraping pages. That is a different product from a BI dashboard: the catalogue is documented as read-only and dataset-oriented, with list_datasets and query_dataset as the two documented tools.

The trade-off is trust distance. With OpenBDAP you read the primary source. Here you read a secondary presentation that cites the primary source. For a citable academic figure, go upstream. For orientation across domains, or for feeding verified Italian public finance context into an AI assistant, the aggregation is the point.

Licence, maintenance and upgrade cost

The licence situation needs care. package.json declares "license": "AGPL-3.0-or-later", while the repository metadata reports NOASSERTION, and there is a separate COMMERCIAL.md and THIRD_PARTY_NOTICES.md at the top level. AGPL-3.0-or-later is a strong copyleft licence with a network-use clause, which matters for anyone planning to run a modified version as a public service. The presence of COMMERCIAL.md suggests the maintainers have thought about commercial use separately. Read LICENSE, COMMERCIAL.md and THIRD_PARTY_NOTICES.md before building on it; this is a description of what the files say, not legal advice.

On maintenance, the last push to the default branch was on 2026-09-16, so the repository is current. It is not archived. There are no retrieved releases, so versioning appears to be tracked through package.json (currently 0.2.0) rather than tagged releases, which means upgrade cost is measured in commits rather than changelogs.

Upgrade cost is dominated by the toolchain, not the data. Node >=22.19.0, Next.js, ESLint with --max-warnings=0, a typecheck step that runs next typegen before tsc --noEmit, Python for ETL, and Supabase as a dependency. The build itself chains three steps, and ci:static chains lint, typecheck, reports:check, design:check and brand:check. A fork that diverges from any of these will fight the pipeline. There is also a design:check script calling impeccable detect src/, which implies an external tool in the contributor workflow.

Editorial conclusion

Adopt it if you need Italian public finance figures with a visible source, period and stated limit per number, or if you want a read-only MCP endpoint your own AI client can query. Do not adopt it as an accounting system of record, as a real-time feed, or as proof that a specific payment was improper; the README states that an unusual value only indicates where to look. Before relying on it, check the licence file (package.json declares AGPL-3.0-or-later while GitHub reports NOASSERTION), confirm which dataset backs the page you care about in the 93-entry catalogue, and read the limits attached to that dataset rather than the headline figure. The Budget Law simulator is worth opening only if you understand that it works on OpenBDAP competenza A1 stanziamenti, not on cash actually spent.

Frequently asked questions

Official sources

1. Issues
2. Italian-Builders-Org/DoveVannoINostriSoldi on GitHub
3. Project website
4. README