EDGAR + Entity: US Company Research
io.github.pgeneralpl/edgar-entity-mcppgeneralplstreamable-httpv0.2.0Scanned
SEC EDGAR filings, XBRL financials, Form 4 insider trades + state business-entity registry lookups
10 tools: 10 only read.
- Reads private data · 2
- Reads text others write · 10
- Can send data out · 1
- 1 finding
Tools listed without sign-in. Remote posture
Anlyon alternative
Run the operations that matter as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
10 tools
Only reads 10Show 10 read-only tools
compare_companiesCompare one financial metric or XBRL concept across ALL reporting companies for a CALENDAR period (SEC frames API), e.g.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "compare_companies" says "compare": a word for reading.
What it can reach
- private-dataThe description's first sentence says "compare" and "calendar": it reads calendars.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Compare one financial metric or XBRL concept across ALL reporting companies for a CALENDAR period (SEC frames API), e.g. rank by revenue for CY2024, or compare specific companies. Pass metric (revenue, gross_profit, operating_income, net_income, eps_basic, eps_diluted, operating_cash_flow, capex, total_assets, total_liabilities, stockholders_equity, cash, long_term_debt; aliases like sales, eps, assets) to fall back across the common tags for it (revenue: Revenues > RevenueFromContractWithCustomerExcludingAssessedTax > SalesRevenueNet), with the tag used per company; or pass tag for one exact concept. Period: CY2024 (annual duration), CY2024Q2 (quarter), CY2024Q4I (instant, for balance-sheet items; added automatically for balance-sheet metrics). Calendar basis: each filer's ~1-year (or ~3-month) period that best fits the calendar period, so CY2024 for Microsoft is its fiscal year ending 2024-06-30 (flagged fiscal_period_differs); use get_financials for fiscal years. accn is the latest filing reporting the value. Pass companies to filter to specific tickers/CIKs (exact or prefix names also work, without typo correction; unresolved items are listed in `unresolved`); otherwise returns the top `limit` by value.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: Cross-company comparison (XBRL frames)
get_company_profileCompany profile from SEC EDGAR submissions: legal name, tickers, exchanges, SIC code + industry, state of incorporation, fiscal year end, EIN, filer category, business/mailing addr…Reads text others writeNo findings
Why it is in this group
- The name "get_company_profile" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Company profile from SEC EDGAR submissions: legal name, tickers, exchanges, SIC code + industry, state of incorporation, fiscal year end, EIN, filer category, business/mailing addresses, former names, latest 10-K/10-Q. Use it to orient before deeper research.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: Company profile (EDGAR)
get_filing_documentFetch an SEC filing's primary document (HTML converted to clean text, tables preserved as aligned rows).Reads private dataReads text others writeCan send data outNo findings
Why it is in this group
- The name "get_filing_document" says "get": a word for reading.
What it can reach
- private-dataThe name "get_filing_document" says "get" and "document": it reads documents.
- private-dataThe description's first sentence says "fetch" and "document": it reads documents.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "fetch" and "html": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it Fetch an SEC filing's primary document (HTML converted to clean text, tables preserved as aligned rows). The text is untrusted filer-authored content, returned between BEGIN/END markers. Identify it by `url` (any www.sec.gov/Archives document URL from list_filings) or by `company` + `accession` (one of the two is required). Start with mode 'outline' for a long 10-K/10-Q: it returns no text, only the detected items (id, title, offset, chars) and total_chars, so you can then read just what you need. Extract one 10-K/10-Q item via `section` (e.g. '1' Business, '1A' Risk Factors, '7' MD&A, '7A' Market Risk, '8' Financial Statements; for 10-Q: '1' Financial Statements, '2' MD&A, '1A' Risk Factors). Text is paged: max_chars (default 10,000) per call, then pass the returned next_offset as offset (offsets are relative to the section when `section` is set, else to the whole document).
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: Read a filing document
get_financialsKey financial metrics normalized from SEC XBRL companyfacts, one row per FISCAL period (fy/fp are the company's fiscal year and quarter, e.g.Reads text others writeNo findings
Why it is in this group
- The name "get_financials" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Key financial metrics normalized from SEC XBRL companyfacts, one row per FISCAL period (fy/fp are the company's fiscal year and quarter, e.g. Microsoft FY2024 = 2023-07-01..2024-06-30; fiscal_year_end gives the MM-DD; deduped; as-filed values from the filing that reported the period). Metrics: revenue, gross_profit, operating_income, net_income, eps_basic, eps_diluted, operating_cash_flow, capex, total_assets, total_liabilities, stockholders_equity, cash, long_term_debt, shares_outstanding, free_cash_flow (derived); aliases accepted in metrics: revenues→revenue, sales→revenue, net_sales→revenue, total_revenue→revenue, turnover→revenue, net_profit→net_income, profit→net_income, earnings→net_income, net_earnings→net_income, eps→eps_diluted, diluted_eps→eps_diluted, basic_eps→eps_basic, operating_profit→operating_income, cfo→operating_cash_flow, cash_from_operations→operating_cash_flow, capital_expenditures→capex, fcf→free_cash_flow, assets→total_assets, liabilities→total_liabilities, equity→stockholders_equity, shareholders_equity→stockholders_equity, cash_and_equivalents→cash, debt→long_term_debt, shares→shares_outstanding. Each metric tries common tags in order (revenue: Revenues, RevenueFromContractWithCustomerExcludingAssessedTax, SalesRevenueNet, ...) and tags_used reports which was used. period_type 'quarterly' returns 3-month values (cash-flow quarters derived from YTD; Q4 derived as FY minus 9M). If a company has only 10-Q data (e.g. a recent IPO), annual results are empty and hint says to use 'quarterly'. Values are raw (e.g. 391035000000 = $391.0B).
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: Normalized financials (XBRL)
get_insider_tradesRecent insider transactions for a company (issuer) from SEC Form 4 / 4/A XML: reporter name, role and officer title, transaction date, code with plain-English meaning (P=open-marke…Reads text others writeNo findings
Why it is in this group
- The name "get_insider_trades" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Recent insider transactions for a company (issuer) from SEC Form 4 / 4/A XML: reporter name, role and officer title, transaction date, code with plain-English meaning (P=open-market buy, S=sale, A=grant, M=option exercise, F=tax withholding, G=gift...), shares, price, value, acquired/disposed, shares owned after, direct/indirect, plus a summary of open-market buys vs sales. `limit` counts filings (each filing can hold several transactions).
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: Insider trades (Form 4)
get_xbrl_conceptAll reported values of one XBRL concept for one company (SEC companyconcept API), newest first, deduped by period.Reads text others writeNo findings
Why it is in this group
- The name "get_xbrl_concept" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it All reported values of one XBRL concept for one company (SEC companyconcept API), newest first, deduped by period. Use for any tag not in get_financials, e.g. us-gaap:ResearchAndDevelopmentExpense, us-gaap:LongTermDebt, dei:EntityCommonStockSharesOutstanding. Tag case is corrected automatically (tag_corrected_from); an unknown tag returns NOT_FOUND with did_you_mean (tags this company reports). 10-Q facts mix 3-month and year-to-date values: pass duration ('annual', 'quarterly', 'ytd', 'instant') for one series; each fact carries its duration. fy/fp are the filing's fiscal year/period. framed_only=true keeps only SEC's one-fact-per-calendar-period values.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: XBRL concept history
list_filingsList a company's EDGAR filings newest-first, filtered by form type and filing-date range.Reads text others writeNo findings
Why it is in this group
- The name "list_filings" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List a company's EDGAR filings newest-first, filtered by form type and filing-date range. Each row has form, accession, filed date, report period, primary document URL and filing index URL. Amendments (e.g. 10-K/A) are included when filtering by the base form unless include_amendments=false. Older history pages are fetched automatically when needed. Common forms: 10-K, 10-Q, 8-K, DEF 14A, S-1, 4, 13D/G (SC 13D), 20-F, 6-K.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: List SEC filings
list_supported_statesList the state business-entity registries supported by lookup_business_entity, with dataset ids, coverage caveats, update frequency, and license/commercial-use terms.Reads text others writeNo findings
Why it is in this group
- The name "list_supported_states" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List the state business-entity registries supported by lookup_business_entity, with dataset ids, coverage caveats, update frequency, and license/commercial-use terms.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: Supported state registries & licenses
lookup_business_entitySearch Secretary of State business-entity registries (official open data) by entity name and/or state entity id.Reads text others writeNo findings
Why it is in this group
- The name "lookup_business_entity" says "lookup": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search Secretary of State business-entity registries (official open data) by entity name and/or state entity id. Supported: NY, CO, OR, CT, PA (NY, OR and PA list active entities only; CO and CT include dissolved entities with status). Name matching ignores case, punctuation, '&' vs 'and' and legal-suffix spelling (Inc/Inc./Incorporated, Co/Company, LLC/L.L.C.); results are ranked exact > prefix > other matches, active entities first within each tier. Paginate per state with limit/offset (has_more, next_offset; total when include_total=true or on the last page). Returns normalized name, entity id, status, type, formation date, jurisdiction, principal/mailing address, registered agent where available (organizational agents only; individual/natural-person agents are withheld on the hosted endpoint; automated classification), and source URLs. Use for private companies, subsidiaries, LLCs, and verifying legal entity names; for SEC-listed companies use search_company. Call list_supported_states for coverage and licenses.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: State business-entity registry lookup
search_companyFind SEC-registered public companies by ticker or name.Reads text others write1 finding
Why it is in this group
- The name "search_company" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The description contains "every other tool", wording about other tools or servers.
What this check looks forMatched text
description: "...forms). Returns CIK (the SEC id used by every other tool), name, tickers, exchange and a match s..."
Description, as the server wrote it Find SEC-registered public companies by ticker or name. Matching ignores case, punctuation, '&' vs 'and' and legal suffixes (Inc/Inc./Corp/Corporation/Co/Company/LLC/Ltd...), tolerates typos ('Microsfot' -> Microsoft) and knows well-known former names (matched_former_name, e.g. 'Facebook' -> Meta Platforms). Returns CIK (the SEC id used by every other tool), name, tickers, exchange and a match score (100 = exact ticker, 97 = exact name, < 80 = fuzzy). With no match it returns did_you_mean suggestions. Source: SEC company_tickers_exchange.json (companies with a listed ticker only); private or non-SEC companies: use lookup_business_entity.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
- destructiveHint: false
- title: Search SEC registrants
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
20 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write10
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out1
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__edgar-entity__get_filing_document"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 29, 2026, 22:06 UTC, unchanged since Oct 29, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 0
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- not observed
- RFC 9728 protected resource metadata
- not observed
- Authorization servers
- not observed
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
Posture changes
- Oct 29, 2026
- HTTP status of an anonymous initialize: 503 to 200
- tools/list served without credentials: no to yes
- Protocol version: none to 2025-06-18
Findings
Matches of fixed checks, with the text they matched.
- Warnsearch_company
The description contains "every other tool", wording about other tools or servers.
What this check looks forMatched text
description: "...forms). Returns CIK (the SEC id used by every other tool), name, tickers, exchange and a match s..."
History
Changes to its tool definitions and to its remote endpoint, newest first.
PostureRemote posture changed. HTTP status of an anonymous initialize: 503 -> 200; tools/list served without credentials: no -> yes; Protocol version: none -> 2025-06-18.View diff
- HTTP status of an anonymous initialize: 503 to 200
- tools/list served without credentials: no to yes
- Protocol version: none to 2025-06-18
Install
Pinned to version 0.2.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http edgar-entity https://edgar-entity-mcp.vercel.app/mcpclaude mcp add --transport http edgar-entity https://edgar-entity-mcp.vercel.app/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__edgar-entity__search_company",
"mcp__edgar-entity__get_company_profile",
"mcp__edgar-entity__list_filings",
"mcp__edgar-entity__get_financials",
"mcp__edgar-entity__get_xbrl_concept",
"mcp__edgar-entity__compare_companies",
"mcp__edgar-entity__get_insider_trades",
"mcp__edgar-entity__lookup_business_entity",
"mcp__edgar-entity__list_supported_states"
],
"ask": [
"mcp__edgar-entity__get_filing_document"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as edgar-entity. Review it before you use it.
Capability tags behind 10 rules
- mcp__edgar-entity__search_company untrusted-input
- mcp__edgar-entity__get_company_profile untrusted-input
- mcp__edgar-entity__list_filings untrusted-input
- mcp__edgar-entity__get_filing_document private-data, untrusted-input, outbound
- mcp__edgar-entity__get_financials untrusted-input
- mcp__edgar-entity__get_xbrl_concept untrusted-input
- mcp__edgar-entity__compare_companies private-data, untrusted-input
- mcp__edgar-entity__get_insider_trades untrusted-input
- mcp__edgar-entity__lookup_business_entity untrusted-input
- mcp__edgar-entity__list_supported_states untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.github.pgeneralpl/edgar-entity-mcp/verify?hash=75f2113fa21ca61b60db1e721838b5e8c66a121bf7726bac7bf9197cdf8c808f" | jq -e '.changed == false'Pinned hash 75f2113fa21c, from Oct 30, 2026, 10:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.github.pgeneralpl/edgar-entity-mcp/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.github.pgeneralpl/edgar-entity-mcp)Source: MCP Registry · repository. Synced Oct 30, 2026, 10:17 UTC.