# io.github.carrotly-ai/disclosures (npm · disclosures) Corporate-disclosure research across 12 official sources behind ten intent-based tools. - Trust score: 77/100 (medium) - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-08-13 ## Components - npm · `disclosures`: 77/100 (this document), [markdown](https://verifymcp.io/servers/carrotly-ai-disclosures/disclosures.md), [page](https://verifymcp.io/servers/carrotly-ai-disclosures/disclosures) ## Channel facts - Registry: `npm` - Package: `disclosures` - Version: `0.1.1` - Transport: `stdio` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-08-13. - **Supply Chain Security**: 100/100 - No malware found by supply-chain analysis. - No known CVEs affecting this package version or its production dependencies. - No install/post-install scripts declared. - No production dependencies, so there is no dependency health to assess. - **Provenance & Transparency**: 97/100 - Source repository is publicly reachable at the declared URL. - Cryptographically verified build provenance (signed, bound to carrotly-ai/disclosures). - Clear OSI-approved license (Apache-2.0). - Actively maintained (last published 5 days ago). - Disclosure check failed: no security disclosure policy was found in the source repository. - **Schema Quality & AI Usability**: 62/100 - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 4237 tokens (~423/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 0/100 - Stability not yet verified: not enough scan history yet (needs a 30-day window). - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - **Capabilities**: 100/100 - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28. **Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm. ## Install ### Claude ```bash claude mcp add carrotly-ai-disclosures -- npx -y disclosures ``` ### Codex ```bash codex mcp add carrotly-ai-disclosures -- npx -y disclosures ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "carrotly-ai-disclosures": { "type": "local", "command": [ "npx", "-y", "disclosures" ], "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add carrotly-ai-disclosures --command npx --arg -y --arg disclosures ``` ### Hermes ```yaml mcp_servers: carrotly-ai-disclosures: command: "npx" args: ["-y", "disclosures"] ``` ### Other ```json { "mcpServers": { "carrotly-ai-disclosures": { "command": "npx", "args": [ "-y", "disclosures" ] } } } ``` ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-08-13 (score 77, 0) - [functional regression] Security disclosure: unverified → fail ### 2026-08-12 (score 77, 0) - [functional regression] Security disclosure: fail → unverified ### 2026-08-11 (score 77, +3) - [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server ### 2026-08-07 (score 74) First indexed and scored. ## MCP tools (10) ### `CompanyResolve` (~395 tokens) Resolve a company name or identifier to canonical candidates. US/default combines SEC ticker/CIK/title resolution with GLEIF legal-name search, and resolves a bare LEI or ISIN to its issuer's GLEIF record; explicit GB uses Companies House company numbers and legal-name search. Returns compact identifier sets and match reasons without silently merging ambiguous entities. Explicit KR uses OpenDART corp/stock codes and legal-name search; explicit JP uses the EDINET code list (EDINET code, securities code, 法人番号, and legal name); explicit TW uses the TWSE listed-company basic-data list (4-digit listing code and legal name). Input parameters: - `company` (string, required): Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… - `jurisdiction` (string): Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… ### `CompanyFilings` (~638 tokens) Search regulatory filings from US SEC EDGAR (default/US), UK Companies House (explicit GB), or Korean DART (explicit KR). Filters match SEC form types, Companies House filing type/category/description, or DART report names. Latest annual mode returns the latest SEC annual report, UK accounts filing, or DART 사업보고서; latest quarterly returns the latest SEC 10-Q or DART 분기·반기보고서, and is unsupported for GB because Companies House has no equivalent normalized quarterly report mode. Explicit JP scans EDINET's date-indexed document index (docTypeCode 120=annual, 140/160=quarterly/semi-annual). Explicit TW returns TWSE daily material-information announcements (重大訊息); latest annual/quarterly modes are unsupported for TW. GB mode "insolvency" returns the company's insolvency-case history. Note for GB dissolutions: a voluntary strike-off is gazetted as a first/final Gazette notice under the Companies Act (the company applied to be struck off), whereas a compulsory strike-off or winding-up is gazetted by the Registrar or a court/creditor — the filing history and Gazette notice type distinguish the two. Returns public filing/document links, never document text. Input parameters: - `company` (string, required): Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… - `end_date` (string): Latest filing date (YYYY-MM-DD); default is today - `forms` (array): Form-type filter, e.g. ["10-K"] or ["8-K", "DEF 14A"] - `jurisdiction` (string): Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… - `limit` (integer): Maximum filings to return (default 20) - `mode` (string): "search" (default), latest annual/quarterly report metadata, or "insolvency" (GB only) for insolvency-case history - `start_date` (string): Earliest filing date (YYYY-MM-DD); default is six years ago ### `CompanyInsiders` (~444 tokens) Return recent US SEC Section 16 filing insiders (default/US), the UK Companies House officer register (explicit GB), or Korean executive/major-shareholder ownership reports from DART (explicit KR). GB output includes role, occupation, appointment/resignation dates, and active/former status, but does not surface correspondence addresses, nationality, or partial birth dates. Explicit JP is unsupported: EDINET has no Section 16-style insider-dealing feed; officer data lives inside the annual securities report (有価証券報告書). Explicit TW returns the TWSE monthly director/supervisor shareholding-balance register (董監事持股餘額): current holdings, holdings at election, and pledged shares. Explicit DE returns BaFin directors'-dealings notifications (Art.19 MAR): each managers'-transaction filing with board role, instrument, transaction type, and trade date. Input parameters: - `company` (string, required): Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… - `jurisdiction` (string): Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… ### `CompanyOwners` (~662 tokens) Return US Schedule 13D/13G beneficial-ownership filers (default/US), UK Companies House persons with significant control (explicit GB), or Korean 5% mass-holding reports from DART (explicit KR). GB rows include individual/corporate/legal/super-secure kinds, statutory natures of control, percentage bands where derivable, ceased entries, and PSC statements when no ordinary PSC record exists. The GB view also adds a UK equity/voting-rights (DTR5/TR-1 major-holdings) section from the FCA National Storage Mechanism; the NSM has no public read API, so that section is populated only when NSM access is supplied via an injected fetchFn, and otherwise explains how to enable it. Each row states its threshold/control regime. No source is guaranteed-complete UBO/KYC evidence. Explicit JP returns EDINET large-volume holding reports (大量保有報告書, the 5% rule) reverse-mapped to the subject issuer — each row is a ≥5% holder — though EDINET's metadata carries no exact percentage; start_date/end_date bound the (default ~1 year) scan window and are ignored by other jurisdictions. Explicit TW returns the TWSE list of shareholders holding more than 10% (持股逾 10% 大股東); a company with no such holder returns no rows. Explicit DE returns BaFin major-holding voting-rights notifications (Stimmrechtsmitteilungen, §§33 ff. WpHG) with the disclosed percentage per WpHG limb (§§33/34, §38, §39). Input parameters: - `company` (string, required): Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… - `end_date` (string): Latest date for the JP EDINET large-holding scan (YYYY-MM-DD); default today. Ignored by other jurisdictions. - `jurisdiction` (string): Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… - `start_date` (string): Earliest date for the JP EDINET large-holding scan (YYYY-MM-DD); default ~1 year ago. Ignored by other jurisdictions. ### `CompanyFinancials` (~477 tokens) Annual as-filed financial figures from XBRL-tagged US SEC annual reports (10-K/20-F/40-F): revenue, net_income, gross_profit, operating_income, total_assets, total_liabilities, stockholders_equity, cash, eps_basic, eps_diluted, operating_cash_flow, rnd_expense. Explicit KR returns Korean DART major-account figures (total_assets, total_liabilities, stockholders_equity, revenue, operating_income, net_income), showing consolidated and separate bases where both are filed. Explicit GB or EU returns normalized annual IFRS figures parsed from ESEF/UKSEF reports indexed by filings.xbrl.org (FY2020+, LEI-indexed; pass a legal name or LEI). Explicit JP directs callers to the EDINET annual securities report, and explicit TW to MOPS, because this release does not parse their XBRL. Input parameters: - `company` (string, required): Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… - `concepts` (array): Concepts to fetch (default: all) - `jurisdiction` (string): Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… - `periods` (integer): Fiscal years per concept (default 5) ### `OwnershipChain` (~217 tokens) GLEIF Level 2 relationship data for an entity (global): direct and ultimate accounting-consolidating parents and known direct children, resolved from an LEI or legal name. Reporting exceptions (e.g. natural-person owners, non-consolidating structures) are stated explicitly. Consolidation parents are not market-disclosure ownership and not UBO tracing. Input parameters: - `company` (string, required): Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… ### `PrivateRaises` (~362 tokens) US Form D (Regulation D) exempt-offering filings for a company: amounts offered and sold, investor counts, industry, date of first sale, and named related persons. This capability is US-only; explicit GB, KR, JP, CN, IN, TW, and BR return an unsupported-jurisdiction explanation because none of Companies House, DART, EDINET, cninfo, BSE, TWSE, or CVM provides an equivalent private-raise filing dataset. Input parameters: - `company` (string, required): Company name or jurisdiction-specific identifier: ticker/CIK (US), Companies House company number (GB), OpenDART 8-digit corp code or 6-digit stock code (KR), EDINET code (E + 5 digits), 4/5-digit se… - `jurisdiction` (string): Jurisdiction to search: US (SEC EDGAR), GB (Companies House), EU (pan-European ESEF financials via filings.xbrl.org — CompanyFinancials only), KR (OpenDART/DART), JP (EDINET), CN (cninfo — SSE/SZSE),… ### `CompanyDocument` (~449 tokens) Fetch a document from a company's filing. jurisdiction "GB" (default) reads UK Companies House by transaction id (from CompanyFilings) or document id; "US" reads SEC EDGAR by accession number; "JP" reads EDINET by docID; "KR" reads OpenDART by receipt number (rcept_no) — all as the transaction_id from CompanyFilings. Mode "metadata" (default) returns the filing's metadata and the documents/renditions available with their sizes. Mode "xhtml" returns the primary machine-readable document's extracted plain text (GB iXBRL/XHTML rendition; US inline HTML/XBRL primary document; KR main DART XML); filings with no machine-readable document (GB image-only/scanned accounts, pre-2001 US .txt-only submissions, JP — whose machine-readable form is a bundled XBRL archive) are reported honestly. Mode "pdf" downloads a PDF and saves it to a local file, returning the path, byte size, and page count — it never inlines document bytes (JP always has a PDF; US rarely does; KR has none — it serves DART XML). Downloads are capped at 25 MB. Input parameters: - `company` (string, required): Company name/number (GB), ticker/CIK (US), or name (JP/KR) - `document_id` (string): GB Companies House document id (alternative to transaction_id), or US document filename within the filing (defaults to the primary document); unused for JP/KR - `jurisdiction` (string): "GB" (Companies House, default), "US" (SEC EDGAR), "JP" (EDINET), or "KR" (OpenDART) - `mode` (string): "metadata" (default), "xhtml" text, or "pdf" download - `output_path` (string): Where to save the PDF (mode=pdf); defaults to a temp file - `transaction_id` (string): GB Companies House filing-history transaction id, US SEC accession number, JP EDINET docID, or KR OpenDART receipt number (rcept_no) — all from CompanyFilings ### `CompanyCharges` (~159 tokens) Registered charges (mortgages) filed against a UK company at Companies House. Without charge_id it lists the charge register with the register's own total/satisfied/part-satisfied counts; filter with status ("outstanding" is the common case). With charge_id it returns one charge's full detail: status and dates, persons entitled, particulars (fixed/floating charge, whether it covers all property, negative-pledge and bare-trustee flags), classification, and the linked filing transactions. Companies-House-specific (no jurisdiction parameter). Input parameters: - `charge_id` (string): A specific charge id for full detail - `company` (string, required): Company name or number - `status` (string): Filter the charge list by status (default "all") ### `PersonAppointments` (~434 tokens) Look up a person's cross-company roles and disqualifications. Accepts a jurisdiction of "GB" (UK Companies House, default), "US" (SEC EDGAR reporting owners), or "DE" (BaFin Directors' Dealings persons). Mode "search" (default) finds people by name (query): GB returns officer ids + appointment counts; US returns reporting-owner CIKs + address hints; DE returns BaFin meldepflichtigerIds + board position. Mode "appointments" lists a person's roles for one officer_id: GB = every company appointment (role, dates); US = every issuer the person has reported Section 16 ownership to (officer_id is the person's SEC CIK — surfaces private issuers e.g. SpaceX too); DE = every issuer the person has reported Art.19 MAR managers' transactions to, with board position (officer_id is the BaFin meldepflichtigerId). Mode "disqualifications": GB searches the disqualified-officers register (query, or officer_id +officer_type for detail); US has no register, so it returns a safe SALI (SEC Action Lookup for Individuals) public-search link for the name only — no scraping; DE has no free per-individual register, reported honestly. One human holds several ids/CIKs and homonyms are common, so match by name and context, not a single id. Input parameters: - `jurisdiction` (string): "GB" (Companies House, default), "US" (SEC EDGAR reporting owners), or "DE" (BaFin Directors' Dealings persons) - `limit` (integer): Max results (default 35, cap 100) - `mode` (string): "search" (default), "appointments", or "disqualifications" - `officer_id` (string): Person id for appointments: a GB officer id, or (US) the person's SEC CIK - `officer_type` (string): GB only: disqualified-officer type for officer_id detail (default natural) - `query` (string): Person name (for search / disqualifications search) ## Diagnostics Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/carrotly-ai-disclosures/disclosures#diagnostics ## Score history - 2026-08-13: 77 - 2026-08-12: 77 - 2026-08-11: 77 - 2026-08-10: 74 - 2026-08-09: 74 - 2026-08-08: 74 - 2026-08-07: 74 ## Links - npm package: https://www.npmjs.com/package/disclosures - Socket report: https://socket.dev/npm/package/disclosures - Repository: https://github.com/carrotly-ai/disclosures - Changelog RSS feed: https://verifymcp.io/servers/carrotly-ai-disclosures/disclosures.xml - Changelog JSON feed: https://verifymcp.io/servers/carrotly-ai-disclosures/disclosures.json - HTML version of this page: https://verifymcp.io/servers/carrotly-ai-disclosures/disclosures