Disclosures

disclosures

Corporate-disclosure research for AI agents and TypeScript — filings, insiders, owners, financials, and ownership chains from 26 official sources across 21 jurisdiction routes (20 national routes plus the EU aggregate).

disclosures is a free, open-source Model Context Protocol server and a TypeScript library. It answers questions like *"who are NVIDIA's directors?"*, *"who owns 5% of Samsung Electronics?"*, or *"show me Vale's last three annual results"* — with every answer linked back to the official source document.

• 10 stable tools, 21 jurisdiction routes — six core tools dispatch via jurisdiction; OwnershipChain is global; three specialized tools cover filed documents, secured charges, and person-level lookups. Tool names stay stable as coverage grows.
• Official sources only — SEC EDGAR, GLEIF, Companies House, FCA NSM, filings.xbrl.org, OpenDART, EDINET, cninfo, SZSE, BSE, TWSE, CVM, BaFin, info-financiere, recherche-entreprises, HKEXnews, ACRA, DBD, AFM, IDX, Bursa Malaysia, KAP, DFM, PSE EDGE, ASX, and ASIC.
• Honest by design — real source links only, explicit "unsupported here" answers instead of empty or fabricated results, and clear caveats ("absence of a filing is not proof").
• Bundled runtime — one JavaScript file for Node 18+. MCP SDK and Zod are declared package dependencies so TypeScript consumers receive the types used by the public API.

Quick start

Requires Node 18+. SEC-backed US calls require a descriptive User-Agent under EDGAR's fair-access policy; keyless non-US routes can run without it.

npx -y disclosures

Claude Code

claude mcp add --transport stdio disclosures \

--env DISCLOSURES_USER_AGENT="Your Organization your-email@example.com" \ -- npx -y disclosures

Claude Desktop

Add to claude_desktop_config.json (Settings → Developer → Edit Config):

{

"mcpServers": { "disclosures": { "command": "npx", "args": ["-y", "disclosures"], "env": { "DISCLOSURES_USER_AGENT": "Your Organization your-email@example.com" } } } }

Cursor

Add the same mcpServers block as Claude Desktop to ~/.cursor/mcp.json (or per-project .cursor/mcp.json).

VS Code (Copilot / MCP)

Add to .vscode/mcp.json:

{

"servers": { "disclosures": { "type": "stdio", "command": "npx", "args": ["-y", "disclosures"], "env": { "DISCLOSURES_USER_AGENT": "Your Organization your-email@example.com" } } } }

Other clients — Windsurf, Codex CLI, Gemini CLI, and any stdio MCP client

Windsurf (~/.codeium/windsurf/mcp_config.json) uses the same mcpServers JSON as Claude Desktop.

Codex CLI (~/.codex/config.toml):

[mcp_servers.disclosures]

command = "npx" args = ["-y", "disclosures"] env = { DISCLOSURES_USER_AGENT = "Your Organization your-email@example.com" }

Gemini CLI (~/.gemini/settings.json) uses the same mcpServers JSON as Claude Desktop.

Any other client: run npx -y disclosures as a stdio command with the DISCLOSURES_USER_AGENT environment variable set. The server speaks newline-delimited JSON-RPC on stdout. It is also listed on the official MCP registry as io.github.carrotly-ai/disclosures.

HTTP mode

The same server also speaks the MCP streamable-HTTP transport, for hosted or networked deployments. Pass --http (stdio remains the default with no flag):

disclosures --http --port 8080          # or: node dist/server.mjs --http

• Binds 127.0.0.1 by default. Port comes from --port, else the PORT env var, else 8080. Host and supplied Origin headers must match the server allowlists. Non-loopback binds require a bearer token and explicit allowed hosts.
• MCP endpoint: POST /mcp (the transport also answers the streamable-HTTP GET/DELETE handshake). Runs stateless — no session id, a fresh server instance per request.
• Health check: GET /healthz → 200 {"name","version","tools"}.
• Diagnostics go to stderr only, as in stdio mode.

Connect any streamable-HTTP MCP client at http://127.0.0.1:8080/mcp.

For a hosted service, supply DISCLOSURES_HTTP_TOKEN through your deployment's secret configuration, then set:

DISCLOSURES_HTTP_ALLOWED_HOSTS="disclosures.example.com" \

DISCLOSURES_HTTP_ALLOWED_ORIGINS="https://disclosures.example.com" \ DISCLOSURES_DOWNLOAD_DIR="/var/lib/disclosures/downloads" \ disclosures --http --host 0.0.0.0 --port 8080

Terminate TLS at your reverse proxy, preserve the configured Host header, and have clients send Authorization: Bearer . Allowed hosts are exact authorities, including a port when clients send one; comma-separated values are supported. Origins default to http:// origins for the allowed hosts; set HTTPS origins explicitly behind TLS termination. Requests without Origin are supported for non-browser clients. The health endpoint checks Host/Origin but does not require the token.

Library deployments use runHttpServer({ bearerToken, allowedHosts, allowedOrigins, downloadDirectory }) for the same policy. HTTP downloads always stay in a server-controlled directory (a private temporary directory by default); output_path accepts a filename only. Stdio/library downloads may use an explicit local path. All modes refuse to overwrite existing files or symlinks; omitted paths produce unique private temporary files.

Restart the client after changing its configuration, then try:

*"Use disclosures to list Apple's board of directors and their latest Form 4 activity."*

*"Who holds 5% or more of NVIDIA? Link the filings."*

*"Resolve Samsung Electronics in Korea and show its latest annual financials."*

*"What's the GLEIF ownership chain above Apple Operations India?"*

The ten tools

Six core tools dispatch across all jurisdiction routes via jurisdiction; OwnershipChain is global and jurisdiction-independent. CompanyDocument accepts US, GB (default), JP, KR, FR, HK, CN, IN, TR, AE, PH, and AU; PersonAppointments accepts US, GB (default), DE, FR, and AU; CompanyCharges is Companies House-specific and takes no jurisdiction.

Every company input accepts a name or a local identifier — ticker, CIK, LEI, or ISIN (US/global), Companies House number (GB — incl. SC/NI prefixes for Scotland and Northern Ireland), OpenDART corp/stock code (KR), EDINET/securities/corporate code (JP), A-share or HK code (CN), BSE scrip (IN), TWSE listing code (TW), CVM registration code (BR), BaFin-Id or ISIN (DE), SIREN/ISIN/LEI (FR), 4/5-digit HKEX stock code (HK), Singapore UEN (SG), 13-digit juristic-person registration number (TH), AFM-register issuer name or LEI (NL), 4-letter IDX ticker / kode emiten (ID), 4-digit Bursa stock code or issuer name (MY), BIST stock code (TR), DFM issuer symbol (AE), PSE ticker symbol or numeric PSE company id (PH). Pass jurisdiction: "US" | "GB" | "EU" | "KR" | "JP" | "CN" | "IN" | "TW" | "BR" | "DE" | "FR" | "HK" | "SG" | "TH" | "NL" | "ID" | "MY" | "TR" | "AE" | "PH" | "AU" (default US).

Coverage matrix

✅ supported · ⚠️ partial (FR CompanyOwners: threshold-crossing notifications with a best-effort structured extraction — holder, direction, threshold(s) and resulting % parsed from the notification PDF's text layer for the newest few; scanned/non-standard PDFs and older notifications stay a link-only list · HK CompanyOwners: the keyless CCASS shareholding search returns participant/custodian-level holdings (custodian banks, brokers, HKSCC Nominees, CSDC) — not beneficial owners; the SFO Part XV Disclosure of Interests register is captcha-walled and linked for manual lookup · HK CompanyFinancials: headline figures extracted from the issuer's latest results-announcement PDF, latest announcement only — standard issuers extract cleanly, complex segment-split/multi-column statements parse partially, and a page shortfall or missing statement degrades to the PDF link · CN CompanyFinancials: headline figures extracted from the 主要会计数据 key-data table of the issuer's latest periodic-report PDF, normalized to whole RMB from the report's stated unit (元/千元/万元/百万元), latest report on