Read-only MCP server for the public SEC EDGAR API (filings, Form 4 insider trades, full-text search, 6 tools).
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 10 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
get_13f_holdings
-
get_8k_with_items
-
get_company_filings
-
get_filing_text
-
get_form4_insider_trades
-
get_institutional_holders
-
get_proxy_statement
-
get_server_info
-
health_check
-
search_filings_full_text
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 3983914 · analyzer v33 · 3w ago
danger signals5
- suspicious endpoint 169.254.169.254 (cloud metadata) kevinkda-sec-edgar-mcp-3983914/tests/test_owasp_2017.py :39
"http://169.254.169.254/latest/meta-data/", - suspicious endpoint 169.254.169.254 (cloud metadata) kevinkda-sec-edgar-mcp-3983914/tests/test_owasp_2021.py :33
"http://169.254.169.254/latest/meta-data/", - suspicious endpoint 169.254.169.254 (cloud metadata) kevinkda-sec-edgar-mcp-3983914/tests/test_owasp_2025.py :166
GetForm4InsiderTradesInput(cik_or_ticker="http://169.254.169.254/") - suspicious endpoint 169.254.169.254 (cloud metadata) kevinkda-sec-edgar-mcp-3983914/tests/test_pentest.py :28
"http://169.254.169.254/latest/meta-data/iam/security-credentials/", - suspicious endpoint 169.254.169.254 (cloud metadata) kevinkda-sec-edgar-mcp-3983914/tests/test_security_thirteenf_proxy.py :34
"http://169.254.169.254/latest/meta-data/",
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 51
filesystem 16
- fs (weak) kevinkda-sec-edgar-mcp-3983914/scripts/fetch_form4_corpus.py :19
from pathlib import Path - fs kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/_platform.py :28
from pathlib import Path - fs kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :23
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/conftest.py :9
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_coverage_completion.py :25
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_owasp_2017.py :26
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_owasp_2021.py :22
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_owasp_2025.py :26
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_platform.py :14
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_proxy_parser.py :13
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_server_integration.py :13
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_thirteenf_parser.py :14
from pathlib import Path
show 4 more
- fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_tools_unit.py :6
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_xbrl.py :19
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_xbrl_fuzz.py :25
from pathlib import Path - fs (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_xbrl_real_corpus.py :17
from pathlib import Path
shell / exec 1
- shell kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/_platform.py :201
import subprocess
network 6
- net (weak) kevinkda-sec-edgar-mcp-3983914/scripts/fetch_form4_corpus.py :21
import httpx - net kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/_ua_probe.py :48
import httpx - net kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/client.py :35
import httpx - net (weak) kevinkda-sec-edgar-mcp-3983914/tests/conftest.py :11
import httpx - net (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_client.py :8
import httpx - net (weak) kevinkda-sec-edgar-mcp-3983914/tests/test_ua_probe.py :12
import httpx
tool registrations 10
- get_company_filings kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :183
- get_form4_insider_trades kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :204
- get_filing_text kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :219
- search_filings_full_text kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :234
- get_8k_with_items kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :251
- get_13f_holdings kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :270
- get_institutional_holders kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :292
- get_proxy_statement kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :314
- health_check kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :328
- get_server_info kevinkda-sec-edgar-mcp-3983914/src/sec_edgar_mcp/server.py :333
declared dependencies 18
- mcp@>=1.6,<2.0
- httpx@>=0.28.1,<0.29
- pydantic@>=2.6,<3
- python-dotenv@>=1.0,<2
- defusedxml@>=0.7.1,<0.8
- clickhouse-connect@>=0.7,<1
- pytest@>=9.0.3,<10
- pytest-asyncio@>=0.23,<2
- pytest-cov@>=5.0,<8
- respx@>=0.22.0,<0.24
- ruff@>=0.6,<1
- mypy@>=1.10,<2
show 6 more
- bandit@>=1.7,<2
- pip@>=26.1.2
- pip-audit@>=2.7,<3
- pre-commit@>=3.7,<5
- detect-secrets@>=1.5,<2
- hypothesis@>=6.130,<7