# `dev.pages.scrapemole/companies` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/dev.pages.scrapemole/companies
- JSON: https://anlyon.dev/api/v1/servers/dev.pages.scrapemole/companies
- Version: 1.0.0 (active)
- Publisher: dev.pages.scrapemole (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-21T18:12:03.125Z

Title and description, as the publisher wrote them:

```untrusted-server-text
ScrapeMole Companies
Pay-per-call x402 SEC EDGAR data: company search, profiles, XBRL financials, filings.
```

Scanned 2026-10-21T18:59:13.226Z over streamable-http.

**4 tools: 3 change things and 1 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 3 | ask |
| Only reads | read | 1 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data or outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__companies__company` `mcp__companies__filings` `mcp__companies__financials` `mcp__companies__search` |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

No check matched anything in these tool definitions.


## Changes things (3)

Creates or changes something that can be changed back. Claude Code: ask.

### `company`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Use when you need the official facts about a US-listed or SEC-registered company: resolves a ticker or CIK and returns the EDGAR profile (legal name, all tickers and exchanges, SIC code and industry, entity type, filer category such as Large Accelerated Filer, state/country of incorporation, fiscal year end, business and mailing address, company phone, website if filed, former names) plus its 10 most recent company filings with links. Insider and beneficial-owner forms (3/4/5/144/13D/13G) are excluded. Paid tool: x402 USDC on Base, $0.002 per successful call; call without payment to receive the PaymentRequired object.
```

### `filings`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Use when you need to find a company's annual report, latest quarterly report, recent 8-K events or registration statements: lists the company's recent EDGAR filings (newest first, up to the last ~1000), filtered by form type and date, each with filing date, period of report, accession number, 8-K item codes, size and direct URLs to the primary document and filing index. Insider and beneficial-owner forms (3/4/5/144/13D/13G) are excluded. Paid tool: x402 USDC on Base, $0.002 per successful call; call without payment to receive the PaymentRequired object.
```

### `financials`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Use when you need a public company's reported numbers without scraping filings: pulls the company's XBRL facts from SEC EDGAR and returns 13 standard metrics (US GAAP), each with the source concept, unit, the last 5 fiscal-year values and last 4 quarterly (3-month or point-in-time) values, with period dates, form, filing date and accession number for audit. Plus latest shares outstanding. Values are as filed (not adjusted). Paid tool: x402 USDC on Base, $0.004 per successful call; call without payment to receive the PaymentRequired object.
```

## Only reads (1)

Looks things up and changes nothing. Claude Code: allow.

### `search`

- The name "search" says "search": a word for reading.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Use when you have a company name (or partial ticker) and need its exact ticker and SEC CIK before looking up financials or filings: matches against SEC's official ticker list (NYSE, Nasdaq, OTC, CBOE; about 10,000 SEC-registered companies), exact ticker first, then ticker prefix and name words. Up to 25 results. Paid tool: x402 USDC on Base, $0.001 per successful call; call without payment to receive the PaymentRequired object.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `companies`:

```json
{
  "permissions": {
    "allow": [
      "mcp__companies__search"
    ],
    "ask": [
      "mcp__companies__company",
      "mcp__companies__financials",
      "mcp__companies__filings"
    ],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__companies__search`: untrusted-input
- `mcp__companies__company`: untrusted-input
- `mcp__companies__financials`: untrusted-input
- `mcp__companies__filings`: untrusted-input