io.github.carrotly-ai/disclosures
NPM · DISCLOSURES · SCANNED AUG 13
Corporate-disclosure research across 12 official sources behind ten intent-based tools.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to carrotly-ai/disclosures). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability62
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4237 tokens (~423/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · disclosures
claude mcp add carrotly-ai-disclosures -- npx -y disclosures
codex mcp add carrotly-ai-disclosures -- npx -y disclosures
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"carrotly-ai-disclosures": {
"type": "local",
"command": [
"npx",
"-y",
"disclosures"
],
"enabled": true
}
}
} openclaw mcp add carrotly-ai-disclosures --command npx --arg -y --arg disclosures
mcp_servers:
carrotly-ai-disclosures:
command: "npx"
args: ["-y", "disclosures"] {
"mcpServers": {
"carrotly-ai-disclosures": {
"command": "npx",
"args": [
"-y",
"disclosures"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 13 Aug 26 0
- Security disclosure: unverified → fail ▼ functional
- 12 Aug 26 0
- Security disclosure: fail → unverified ▼ functional
- 11 Aug 26 +3
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 7 Aug 26 74
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 13 Aug 2026 · Analysed npm/disclosures@0.1.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | carrotly-ai/disclosures |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/carrotly-ai/disclosures/.github/workflows/release.yml@refs/tags/v0.1.1 |
| Rekor log index | 2368207197 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:0622775fd1ea6da4098030148ca9cbef2351bebdaab57346cd3fa783c44296cc59f7f071e46fa757eb08024e52546bb64b4c046f8157f203e4913b342 |
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
CompanyCharges ~159
Registered charges (mortgages) filed against a UK company at Companies House. Without charge_id it lists the charge register with the register's own total/satisfied/part-satisfied counts; filter with status ("outstanding" is the common case). With charge_id it returns one charge's full detail: status and dates, persons entitled, particulars (fixed/floating charge, whether it covers all property, negative-pledge and bare-trustee flags), classification, and the linked filing transactions. Companies-House-specific (no jurisdiction parameter).
| Name | Type | Req | Description |
|---|---|---|---|
| charge_id | string | – | A specific charge id for full detail |
| company | string | yes | Company name or number |
| status | string | – | Filter the charge list by status (default "all") |
No output schema declared.
No examples provided.
CompanyDocument ~449
Fetch a document from a company's filing. jurisdiction "GB" (default) reads UK Companies House by transaction id (from CompanyFilings) or document id; "US" reads SEC EDGAR by accession number; "JP" reads EDINET by docID; "KR" reads OpenDART by receipt number (rcept_no) — all as the transaction_id from CompanyFilings. Mode "metadata" (default) returns the filing's metadata and the documents/renditions available with their sizes. Mode "xhtml" returns the primary machine-readable document's extracted plain text (GB iXBRL/XHTML rendition; US inline HTML/XBRL primary document; KR main DART XML); filings with no machine-readable document (GB image-only/scanned accounts, pre-2001 US .txt-only submissions, JP — whose machine-readable form is a bundled XBRL archive) are reported honestly. Mode "pdf" downloads a PDF and saves it to a local file, returning the path, byte size, and page count — it never inlines document bytes (JP always has a PDF; US rarely does; KR has none — it serves DART XML). Downloads are capped at 25 MB.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name/number (GB), ticker/CIK (US), or name (JP/KR) |
| document_id | string | – | GB Companies House document id (alternative to transaction_id), or US document filename within the filing (defaults to the primary document); unused for JP/KR |
| jurisdiction | string | – | "GB" (Companies House, default), "US" (SEC EDGAR), "JP" (EDINET), or "KR" (OpenDART) |
| mode | string | – | "metadata" (default), "xhtml" text, or "pdf" download |
| output_path | string | – | Where to save the PDF (mode=pdf); defaults to a temp file |
| transaction_id | string | – | GB Companies House filing-history transaction id, US SEC accession number, JP EDINET docID, or KR OpenDART receipt number (rcept_no) — all from CompanyFilings |
No output schema declared.
No examples provided.
CompanyFilings ~638
Search regulatory filings from US SEC EDGAR (default/US), UK Companies House (explicit GB), or Korean DART (explicit KR). Filters match SEC form types, Companies House filing type/category/description, or DART report names. Latest annual mode returns the latest SEC annual report, UK accounts filing, or DART 사업보고서; latest quarterly returns the latest SEC 10-Q or DART 분기·반기보고서, and is unsupported for GB because Companies House has no equivalent normalized quarterly report mode. Explicit JP scans EDINET's date-indexed document index (docTypeCode 120=annual, 140/160=quarterly/semi-annual). Explicit TW returns TWSE daily material-information announcements (重大訊息); latest annual/quarterly modes are unsupported for TW. GB mode "insolvency" returns the company's insolvency-case history. Note for GB dissolutions: a voluntary strike-off is gazetted as a first/final Gazette notice under the Companies Act (the company applied to be struck off), whereas a compulsory strike-off or winding-up is gazetted by the Registrar or a court/creditor — the filing history and Gazette notice type distinguish the two. Returns public filing/document links, never document text.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… |
| end_date | string | – | Latest filing date (YYYY-MM-DD); default is today |
| forms | array | – | Form-type filter, e.g. ["10-K"] or ["8-K", "DEF 14A"] |
| jurisdiction | string | – | Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… |
| limit | integer | – | Maximum filings to return (default 20) |
| mode | string | – | "search" (default), latest annual/quarterly report metadata, or "insolvency" (GB only) for insolvency-case history |
| start_date | string | – | Earliest filing date (YYYY-MM-DD); default is six years ago |
No output schema declared.
No examples provided.
CompanyFinancials ~477
Annual as-filed financial figures from XBRL-tagged US SEC annual reports (10-K/20-F/40-F): revenue, net_income, gross_profit, operating_income, total_assets, total_liabilities, stockholders_equity, cash, eps_basic, eps_diluted, operating_cash_flow, rnd_expense. Explicit KR returns Korean DART major-account figures (total_assets, total_liabilities, stockholders_equity, revenue, operating_income, net_income), showing consolidated and separate bases where both are filed. Explicit GB or EU returns normalized annual IFRS figures parsed from ESEF/UKSEF reports indexed by filings.xbrl.org (FY2020+, LEI-indexed; pass a legal name or LEI). Explicit JP directs callers to the EDINET annual securities report, and explicit TW to MOPS, because this release does not parse their XBRL.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… |
| concepts | array | – | Concepts to fetch (default: all) |
| jurisdiction | string | – | Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… |
| periods | integer | – | Fiscal years per concept (default 5) |
No output schema declared.
No examples provided.
CompanyInsiders ~444
Return recent US SEC Section 16 filing insiders (default/US), the UK Companies House officer register (explicit GB), or Korean executive/major-shareholder ownership reports from DART (explicit KR). GB output includes role, occupation, appointment/resignation dates, and active/former status, but does not surface correspondence addresses, nationality, or partial birth dates. Explicit JP is unsupported: EDINET has no Section 16-style insider-dealing feed; officer data lives inside the annual securities report (有価証券報告書). Explicit TW returns the TWSE monthly director/supervisor shareholding-balance register (董監事持股餘額): current holdings, holdings at election, and pledged shares. Explicit DE returns BaFin directors'-dealings notifications (Art.19 MAR): each managers'-transaction filing with board role, instrument, transaction type, and trade date.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… |
| jurisdiction | string | – | Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… |
No output schema declared.
No examples provided.
CompanyOwners ~662
Return US Schedule 13D/13G beneficial-ownership filers (default/US), UK Companies House persons with significant control (explicit GB), or Korean 5% mass-holding reports from DART (explicit KR). GB rows include individual/corporate/legal/super-secure kinds, statutory natures of control, percentage bands where derivable, ceased entries, and PSC statements when no ordinary PSC record exists. The GB view also adds a UK equity/voting-rights (DTR5/TR-1 major-holdings) section from the FCA National Storage Mechanism; the NSM has no public read API, so that section is populated only when NSM access is supplied via an injected fetchFn, and otherwise explains how to enable it. Each row states its threshold/control regime. No source is guaranteed-complete UBO/KYC evidence. Explicit JP returns EDINET large-volume holding reports (大量保有報告書, the 5% rule) reverse-mapped to the subject issuer — each row is a ≥5% holder — though EDINET's metadata carries no exact percentage; start_date/end_date bound the (default ~1 year) scan window and are ignored by other jurisdictions. Explicit TW returns the TWSE list of shareholders holding more than 10% (持股逾 10% 大股東); a company with no such holder returns no rows. Explicit DE returns BaFin major-holding voting-rights notifications (Stimmrechtsmitteilungen, §§33 ff. WpHG) with the disclosed percentage per WpHG limb (§§33/34, §38, §39).
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… |
| end_date | string | – | Latest date for the JP EDINET large-holding scan (YYYY-MM-DD); default today. Ignored by other jurisdictions. |
| jurisdiction | string | – | Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… |
| start_date | string | – | Earliest date for the JP EDINET large-holding scan (YYYY-MM-DD); default ~1 year ago. Ignored by other jurisdictions. |
No output schema declared.
No examples provided.
CompanyResolve ~395
Resolve a company name or identifier to canonical candidates. US/default combines SEC ticker/CIK/title resolution with GLEIF legal-name search, and resolves a bare LEI or ISIN to its issuer's GLEIF record; explicit GB uses Companies House company numbers and legal-name search. Returns compact identifier sets and match reasons without silently merging ambiguous entities. Explicit KR uses OpenDART corp/stock codes and legal-name search; explicit JP uses the EDINET code list (EDINET code, securities code, 法人番号, and legal name); explicit TW uses the TWSE listed-company basic-data list (4-digit listing code and legal name).
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… |
| jurisdiction | string | – | Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… |
No output schema declared.
No examples provided.
OwnershipChain ~217
GLEIF Level 2 relationship data for an entity (global): direct and ultimate accounting-consolidating parents and known direct children, resolved from an LEI or legal name. Reporting exceptions (e.g. natural-person owners, non-consolidating structures) are stated explicitly. Consolidation parents are not market-disclosure ownership and not UBO tracing.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… |
No output schema declared.
No examples provided.
PersonAppointments ~434
Look up a person's cross-company roles and disqualifications. Accepts a jurisdiction of "GB" (UK Companies House, default), "US" (SEC EDGAR reporting owners), or "DE" (BaFin Directors' Dealings persons). Mode "search" (default) finds people by name (query): GB returns officer ids + appointment counts; US returns reporting-owner CIKs + address hints; DE returns BaFin meldepflichtigerIds + board position. Mode "appointments" lists a person's roles for one officer_id: GB = every company appointment (role, dates); US = every issuer the person has reported Section 16 ownership to (officer_id is the person's SEC CIK — surfaces private issuers e.g. SpaceX too); DE = every issuer the person has reported Art.19 MAR managers' transactions to, with board position (officer_id is the BaFin meldepflichtigerId). Mode "disqualifications": GB searches the disqualified-officers register (query, or officer_id +officer_type for detail); US has no register, so it returns a safe SALI (SEC Action Lookup for Individuals) public-search link for the name only — no scraping; DE has no free per-individual register, reported honestly. One human holds several ids/CIKs and homonyms are common, so match by name and context, not a single id.
| Name | Type | Req | Description |
|---|---|---|---|
| jurisdiction | string | – | "GB" (Companies House, default), "US" (SEC EDGAR reporting owners), or "DE" (BaFin Directors' Dealings persons) |
| limit | integer | – | Max results (default 35, cap 100) |
| mode | string | – | "search" (default), "appointments", or "disqualifications" |
| officer_id | string | – | Person id for appointments: a GB officer id, or (US) the person's SEC CIK |
| officer_type | string | – | GB only: disqualified-officer type for officer_id detail (default natural) |
| query | string | – | Person name (for search / disqualifications search) |
No output schema declared.
No examples provided.
PrivateRaises ~362
US Form D (Regulation D) exempt-offering filings for a company: amounts offered and sold, investor counts, industry, date of first sale, and named related persons. This capability is US-only; explicit GB, KR, JP, CN, IN, TW, and BR return an unsupported-jurisdiction explanation because none of Companies House, DART, EDINET, cninfo, BSE, TWSE, or CVM provides an equivalent private-raise filing dataset.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… |
| jurisdiction | string | – | Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… |
No output schema declared.
No examples provided.