{
  "markdown": "# Company filing and CVE evidence snapshots\n\nFree experimental capability surface. Availability is bounded by conservative cost and source-health controls; honor Retry-After and explicit coverage gaps.\n\nFree Phase A JSON API for two narrow public-world lookups:\n\n- **company_snapshot:** Use for current SEC filing-event state for a known ticker. Returns issuer/CIK, filing dates and source links with explicit source timestamps, coverage and expiry. Not financial-statement extraction, earnings transcripts or broad equity research. `GET /v1/company/{ticker}`. The latest filing can be an insider filing; it is not necessarily an earnings release.\n- **cve_snapshot:** Use for current evidence on a known CVE ID. Returns NVD status, CISA KEV membership, FIRST EPSS and advisory links with explicit source timestamps, coverage and expiry. Not asset applicability or validated remediation. `GET /v1/cve/{cve}`.\n\nBase URL: [Fishnet](https://agent-research-fishnet.walsh-datascience.workers.dev)\n\n[OpenAPI](https://agent-research-fishnet.walsh-datascience.workers.dev/openapi.json) · [MCP tool descriptions](https://agent-research-fishnet.walsh-datascience.workers.dev/mcp-tools.json) · [Machine-readable overview](https://agent-research-fishnet.walsh-datascience.workers.dev/.well-known/fishnet.json)\n\nExamples for normal use:\n\n```sh\ncurl 'https://agent-research-fishnet.walsh-datascience.workers.dev/v1/company/AAPL?via=github'\ncurl 'https://agent-research-fishnet.walsh-datascience.workers.dev/v1/cve/CVE-2024-3094?view=status&via=github'\n```\n\nUse `view=status` for compact selected facts. Save `facts.state_hash`; submit it later as `changed_since=sha256:...` with `view=status` to compare the selected state. This is a hash comparison, not a historical timestamp query. A methodology change also changes the state hash. Read coverage and source timestamps; unavailable evidence returns an unknown comparison. Packet lifetimes are at most 15 minutes for company and 60 minutes for CVE, and can be shorter. `max_age_seconds` declares a freshness tolerance without forcing a source refresh.\n\nPackets include `packet_key`, generation/as-of/expiry timestamps, source versions, coverage gaps and data/methodology/result/terms hashes. Compact responses also include a baseline-independent `packet_version`. These are shallow metadata observations, not an independent second-opinion service or guaranteed complete research.\n\nNo payment, wallet, API key or personal identifier is required. Optional opaque `X-Fishnet-Operator`, `X-Fishnet-Client` or `X-Fishnet-Agent` values produce a daily rotating HMAC signal. Request key/time, cache status, coarse framework/channel, status, latency and cost units are logged. Application telemetry does not retain IPs, raw user agents, raw referrers or raw caller IDs. Signals never establish independent operators. Raw event retention is 14 days with cleanup on active traffic; Cloudflare has its own infrastructure data policies.\n\nUse `X-Fishnet-Test: true` during integration testing. This is a free experiment with a daily build budget and availability limits; 409/429/503 responses state freshness, budget or availability gaps. Honor `Retry-After`. Some large SEC submission responses exceed the 4 MiB source limit and remain unavailable. Aggregate safety accounting adds request counts, conservative CPU reservations and available D1 row/storage metrics without personal identifiers. Safety-rejected requests are not successful demand evidence. Availability is experimental. SAM, FDA and payments are disabled.\n\nOptional demand cues: `desired_fields` accepts the field names listed in OpenAPI, `history_days` accepts 0/1/7/30/90/365/3650, `max_age` accepts 60/300/900/3600/86400 seconds, and `compare_sources` accepts true/false. These declare what you need; they do not create new data. Unsupported controlled history/fields/comparison return HTTP 422 `unsupported_capability` with the available current-state capability and optional feedback action. Arbitrary routes/query values are never retained; recognizable unsupported attempts are reduced to coarse categories.\n\nOptional feedback: **What additional data or capability would have reduced your next tool call?** Successful packets provide `feedback_request` with an expiring packet-bound token, required packet key/version/endpoint and a `research_candidate` menu of possible future capabilities. These candidates are not available products. Send schema 2.0 to `POST /v1/feedback`, or explicitly call the optional `submit_fishnet_feedback` MCP tool. Include `feedback_type` and optional `next_action_without_fishnet`, `usage_reason`, desired capabilities/fields/history/freshness, importance or stated frequency/price. V1 HTTP clients remain supported. Use the supplied packet version, not a reconstructed hash. A token proves packet association only, not caller independence or freshness of the underlying data.\n\nMaximum 2,048 JSON UTF-8 bytes and 240 UTF-8 text bytes; no personal data, URLs, secrets or full prompts. Unsafe text is rejected; accepted free text is categorized and discarded rather than stored. Controlled feedback fields are stored separately for 14 days with active cleanup; caller signals use the same daily HMAC. Duplicate submissions consume budget. Limits: 100/day total, 10 per optional signal, 20 shared anonymous. Feedback and stated frequency/price are self-reports, not purchases or verified demand. Optional feedback never triggers automatically or causes capability builds. Core packets remain usable without feedback.\n\nMCP: [version 0.2.0 MCPB release](https://github.com/Stavros65/fishnet-company-cve/releases/tag/v0.2.0), Node.js 22+, stdio transport. Two snapshot tools plus optional feedback submission; the local bundle is optional alongside the remote URL below. The feedback tool writes bounded telemetry and is explicitly annotated accordingly. The previous 0.1.0 release remains available.\n\n## Remote MCP — no local Fishnet installation\n\nConnect to **https://agent-research-fishnet.walsh-datascience.workers.dev/mcp** using Streamable HTTP. Anonymous free Phase A access; no API key or wallet. A compatible client still needs to know or discover the URL and authorize/configure access. Registry publication does not promise automatic discovery or tool selection.\n\nTools: `company_snapshot`, `cve_snapshot`, and explicitly optional `submit_fishnet_feedback`. Snapshot arguments and packet semantics are identical to the REST API. Feedback writes telemetry, is not read-only or idempotent, and never runs automatically.\n\nProtocol 2026-07-28 uses per-request metadata (`io.modelcontextprotocol/protocolVersion`, clientInfo, clientCapabilities) plus matching `MCP-Protocol-Version`, `Mcp-Method` and, for tools/call, `Mcp-Name` headers. `server/discover` is optional; `tools/list` or a known-schema `tools/call` can be invoked directly. Stateless legacy 2025-11-25 and 2025-06-18 support initialize → notifications/initialized → tools/list → tools/call. Requests use `Content-Type: application/json` and `Accept: application/json, text/event-stream`; results are JSON.\n\nNo sessions are minted; GET/DELETE streams, resources, prompts, subscriptions, batching, sampling and extension methods are unsupported. Origin-less server clients work. Browser Origin must exactly match the service origin; there is no wildcard CORS. Maximum RPC body 4,096 UTF-8 bytes, nesting depth 12, body read 5 seconds; feedback retains its smaller limits. Rejections perform no source build.\n\nOne MCP HTTP request is one accounted interaction. Coarse route, protocol family, stage, tool and outcome are retained in the existing 14-day event stream. No RPC IDs, raw clientInfo, Origin, raw body/path/query or prompts are stored. Bounded diagnostics include exact supported protocol version, a coarse self-reported client family, recognized capability flags, trace-context presence only, catalog generation, tool-selection and argument-shape categories. No trace value or client version is retained; these categories do not authenticate a client or link sessions. HTTP 200 with `isError: true` is an application error, not useful packet use. Underlying coverage/source gaps remain explicit. Honor errors and backoff; global safety limits can suspend service. A transport-specific fault disables remote MCP while REST remains available when accounting is healthy.\n\nThe official Registry release 0.3.0 adds the remote address and retains the unchanged [0.2.0 stdio MCPB](https://github.com/Stavros65/fishnet-company-cve/releases/tag/v0.2.0). No existing release is overwritten.\n",
  "bytes": 8580,
  "sha": "1a3fe5902657cf86852d272c58c997cc37295842c21ccdb9d3edd89be02f1e1b",
  "repo_slug": "stavros65/fishnet-company-cve",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_stavros65_fishnet_company_cve_ec486ea6/readme"
}