Edgaralert Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Edgaralert Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Connect Claude Desktop (or any MCP-compatible client) directly to your EDGAR Alert account. Ask live questions about SEC insider trading signals, Form 4 activity, 8-K officer/director changes, and company research context — without leaving your conversation.
Works on any paid EDGAR Alert plan. Most tools (latest alerts, search, company profiles, fundamentals, price windows) work on STARTER and PRO. One tool — edgaralert_get_company_agent_context, the bundled AI research-context payload — requires Enterprise; on a lower plan it returns a clear upgrade message instead of failing silently. See Tools below for the full breakdown, and edgaralert.com/pricing to upgrade.https://api.edgaralert.com/api/v1 REST API. Every tool maps to exactly one v1 endpoint.
here — all of that lives in the API, same as it does for every other v1 API consumer.
place orders, change your subscription, or alter account settings.
edgaralert_add_ticker_to_list and edgaralert_remove_ticker_from_list POST and DELETE against /ticker-lists. Everything else is a GET.
api.edgaralert.com as the X-API-Key header, and this server never writes it to disk or logs it.
(get one here) — STARTER and PRO both work for most tools; Enterprise unlocks all 8.
.mcpb (recommended for most users)edgaralert-mcp.mcpb from theInstall Extension, and select the downloaded file (or just drag the file onto the Claude Desktop window).
securely in your OS keychain — this project never sees or stores it outside that prompt.
claude_desktop_config.jsonmcp-server/) somewhere on your machine. cd mcp-server
npm install
npm run build~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonmcpServers (see example below).cd mcp-server
npm install
EDGARALERT_API_KEY=EA_your_key_here npm run devThis runs the server on stdio using tsx, without a build step. Useful when iterating on tool definitions.
{
"mcpServers": {
"edgaralert": {
"command": "node",
"args": ["/absolute/path/to/mcp-server/dist/index.js"],
"env": {
"EDGARALERT_API_KEY": "EA_your_key_here"
}
}
}
}Replace /absolute/path/to/mcp-server/dist/index.js with the real path on your machine, and EA_your_key_here with your actual EDGAR Alert API key. Never commit this file with a real key in it.
| Variable | Required | Default | Description |
|---|---|---|---|
EDGARALERT_API_KEY | Yes | — | Your EDGAR Alert v1 API key. Sent as X-API-Key on every request. |
EDGARALERT_BASE_URL | No | https://api.edgaralert.com/api/v1 | Override for staging/local development. Most users should not set this. |
Ten of the twelve tools are read-only; the two watchlist mutations are marked write below. See docs/tools.md for full input schemas, endpoint mappings, and error behavior.
| Tool | Endpoint | Min. plan |
|---|---|---|
edgaralert_get_latest_alerts | GET /alerts/latest | STARTER |
edgaralert_search_alerts | GET /alerts | PRO |
edgaralert_get_alert_price_window | GET /alerts/{id}/price-window | PRO |
edgaralert_search_companies | GET /companies/search | PRO |
edgaralert_get_company_profile | GET /companies/{tickerOrCik}/profile | All paid |
edgaralert_get_company_fundamentals | GET /companies/{tickerOrCik}/fundamentals | PRO |
edgaralert_get_company_agent_context | GET /companies/{tickerOrCik}/agent-context | ENTERPRISE |
edgaralert_get_weekly_insights | GET /insights/weekly (public) | None |
edgaralert_get_industry_capital_flow | GET /insights/capital-flow (public) | None |
edgaralert_get_ticker_lists | GET /ticker-lists | STARTER |
edgaralert_add_ticker_to_list | POST /ticker-lists/{listId}/items (write) | STARTER |
edgaralert_remove_ticker_from_list | DELETE /ticker-lists/{listId}/items/{ticker} (write) | STARTER |
"Min. plan" reflects what the underlying API enforces today — STARTER and PRO keys can use 11 of 12 tools. Only edgaralert_get_company_agent_context requires Enterprise; on a lower-tier key it returns a clean 403 with an upgrade message (see below) rather than failing silently or crashing. The two /insights/* tools are public and need no plan at all.
EDGARALERT_API_KEYis set and correct.
edgaralert_get_company_agent_context for STARTER/PRO keys; every other tool should work normally on those plans. If you see this on a different tool, double check your plan tier in the EDGAR Alert dashboard.
Wait, or check usage in your EDGAR Alert dashboard.
not an account issue. Run node -e "fetch('https://api.edgaralert.com/api/v1/alerts/latest').then(r=>r.text()).then(console.log)" — you should see a JSON error like {"message":"Missing X-API-Key header."} (that's expected and means the API is reachable). If you get a DNS error (ENOTFOUND/ENODATA) or no response, the problem is local network/DNS, not this server or your account.
server, but got back an HTML page instead of API data. This happens if EDGARALERT_BASE_URL is ever pointed at edgaralert.com or www.edgaralert.com instead of api.edgaralert.com — the bare and www hosts serve the marketing website (an Azure Static Web App), not the API. The default in this package is already set to api.edgaralert.com; if you see this error, check whether EDGARALERT_BASE_URL has been overridden somewhere in your config.
kind — those endpoints are not implemented here, by design.
used is the one you supply via environment variable / Claude Desktop config.
EDGARALERT_BASE_URL (defaults toapi.edgaralert.com) — no other outbound calls are made.
npm run typecheck # type-check without emitting
npm run build # compile to dist/
npm run dev # run with tsx, no build stepTo add a new tool: copy the pattern in src/tools/getWeeklyInsights.ts (for a no-input tool) or src/tools/searchAlerts.ts (for a filtered tool), register it in src/tools/index.ts, and only ever call api/v1/* or other already-public endpoints. Do not add database clients, Stripe/order clients, or any write-capable tool to this package.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.