Dol Whd MCP server

@pipeworx/dol-whd — DOL Wage & Hour enforcement

Concluded US Department of Labor Wage & Hour Division compliance actions since FY2005 — wage theft, back wages, minimum-wage and overtime findings, child labour, H-1B and H-2A violations. osha already covers the OSHA slice of DOL enforcement; this is the sibling nobody could query.

Part of Pipeworx — an MCP gateway connecting AI agents to 1576+ live data sources.

Promoted out of _incubator on 2026-09-01 (fleet #1052) once Bruce supplied the key. Built originally against a 10-row catalog preview under fleet #651, because until that key existed every row request answered 401.

Tools

Auth

Platform key (PLATFORMDOLKEY, set on gateway and registry-api) with BYO override via apiKey. A free key from covers every DOL dataset and works on issue — there is no approval step. apiKey is not in any tool's required list, because the gateway injects the platform key.

This is not the data.gov umbrella key ([[reference-datagov-key-universal]] does not apply); the DOL Open Data Portal issues its own.

The catalog is open and the rows are not, which is a trap. GET /v4/datasets and GET /v4/datasets/10362 both answer 200 with no key, so the source looks open until you ask for data — at which point a keyless row request returns 401 "The API key is either incorrect or missing from your query."

Worse, auth differs by endpoint. /v4/datasets accepts an X-API-KEY: request header; /v4/get/... rejects it with 401 and needs the key as a query parameter**. Standardise on the header because the catalog call worked and every data call 401s, which reads as a bad key rather than a wrong place to put it. The pack always uses the query parameter.

The upstream throttles per SOURCE IP, not per key. Roughly 20 calls in a few minutes returns HTTP 429 with x-amzn-errortype: ForbiddenException and no Retry-After, for about ten minutes. Measured: a bogus key from a throttled IP also gets 429 while omitting the key entirely still gets 401, which is what pins it to the IP. So this is a shared-egress hazard for us rather than a per-key quota. The pack backs off twice and then returns { found: false, reason: "upstreamratelimited" } rather than throwing, so a throttle stays distinguishable from an employer with no cases.

Data sources

• — case rows (key required)
• — dataset metadata + 10-row preview (open)
• — key registration and the API Query Builder

Query grammar (documented, not guessed)

data.dol.gov is a React SPA whose bundle /static/js/main.1788ccf8.js carries DOL's own API documentation. Parameters: limit, offset, sort (asc/desc), sortby (field name), fields, filterobject, X-API-KEY — all as query parameters. Operators, quoted from that documentation: eq, neq, gt, lt, in, notin, like**. Nothing outside that list is assumed to work.

filter_object is a JSON string of nested and / or groups over {field, operator, value}, per DOL's worked example:

filter_object={"and":[{"or":[{"field":"industry","operator":"eq","value":"A"},
                             {"field":"industry","operator":"eq","value":"C"}]},
                      {"field":"year","operator":"eq","value":"2021"}]}

Traps this pack already handles

Shortened. The full README is on GitHub.