fishnet-company-cve

# Company filing and CVE evidence snapshots

Free experimental capability surface. Availability is bounded by conservative cost and source-health controls; honor Retry-After and explicit coverage gaps.

Free Phase A JSON API for two narrow public-world lookups:

- **Returns the current company filing-event evidence packet for a ticker.** Includes SEC issuer identity, latest filing metadata, recent filing events, dates and source links. `GET /v1/company/{ticker}`. The latest filing can be an insider filing; it is not necessarily an earnings release. No licensed transcripts or extracted financial statements.
- **Returns the current CVE evidence packet for a canonical CVE ID.** Includes NVD status/dates, CISA KEV membership, FIRST EPSS and public advisory links. `GET /v1/cve/{cve}`. No vendor-page extraction, asset applicability or patch validation.

Base URL: [Fishnet](https://agent-research-fishnet.walsh-datascience.workers.dev)

[OpenAPI](https://agent-research-fishnet.walsh-datascience.workers.dev/openapi.json) · [MCP tool descriptions](https://agent-research-fishnet.walsh-datascience.workers.dev/mcp-tools.json) · [Machine-readable overview](https://agent-research-fishnet.walsh-datascience.workers.dev/.well-known/fishnet.json)

Examples for normal use:

```sh
curl 'https://agent-research-fishnet.walsh-datascience.workers.dev/v1/company/AAPL?via=github'
curl 'https://agent-research-fishnet.walsh-datascience.workers.dev/v1/cve/CVE-2024-3094?view=status&via=github'
```

Use `view=status` for compact selected facts. Save `facts.state_hash`; submit it later as `changed_since=sha256:...` with `view=status` to compare the selected state. This is a hash comparison, not a historical timestamp query. A methodology change also changes the state hash. Read coverage and source timestamps; unavailable evidence returns an unknown comparison. Packet lifetimes are at most 15 minutes for company and 60 minutes for CVE, and can be shorter. `max_age_seconds` declares a freshness tolerance without forcing a source refresh.

Packets include `packet_key`, generation/as-of/expiry timestamps, source versions, coverage gaps and data/methodology/result/terms hashes. Compact responses also include a baseline-independent `packet_version`. These are shallow metadata observations, not an independent second-opinion service or guaranteed complete research.

No payment, wallet, API key or personal identifier is required. Optional opaque `X-Fishnet-Operator`, `X-Fishnet-Client` or `X-Fishnet-Agent` values produce a daily rotating HMAC signal. Request key/time, cache status, coarse framework/channel, status, latency and cost units are logged. Application telemetry does not retain IPs, raw user agents, raw referrers or raw caller IDs. Signals never establish independent operators. Raw event retention is 14 days with cleanup on active traffic; Cloudflare has its own infrastructure data policies.

Use `X-Fishnet-Test: true` during integration testing. This is a free experiment with a daily build budget and availability limits; 409/429/503 responses state freshness, budget or availability gaps. Honor `Retry-After`. Some large SEC submission responses exceed the 4 MiB source limit and remain unavailable. Aggregate safety accounting adds request counts, conservative CPU reservations and available D1 row/storage metrics without personal identifiers. Safety-rejected requests are not successful demand evidence. Availability is experimental. SAM, FDA and payments are disabled.

Optional demand cues: `desired_fields` accepts the field names listed in OpenAPI, `history_days` accepts 0/1/7/30/90/365/3650, `max_age` accepts 60/300/900/3600/86400 seconds, and `compare_sources` accepts true/false. These declare what you need; they do not create new data. Unsupported controlled history/fields/comparison return HTTP 422 `unsupported_capability` with the available current-state capability and optional feedback action. Arbitrary routes/query values are never retained; recognizable unsupported attempts are reduced to coarse categories.

Optional feedback: **What additional data or capability would have reduced your next tool call?** Successful packets provide `feedback_request` with an expiring packet-bound token, required packet key/version/endpoint and a `research_candidate` menu of possible future capabilities. These candidates are not available products. Send schema 2.0 to `POST /v1/feedback`, or explicitly call the optional `submit_fishnet_feedback` MCP tool. Include `feedback_type` and optional `next_action_without_fishnet`, `usage_reason`, desired capabilities/fields/history/freshness, importance or stated frequency/price. V1 HTTP clients remain supported. Use the supplied packet version, not a reconstructed hash. A token proves packet association only, not caller independence or freshness of the underlying data.

Maximum 2,048 JSON UTF-8 bytes and 240 UTF-8 text bytes; no personal data, URLs, secrets or full prompts. Unsafe text is rejected; accepted free text is categorized and discarded rather than stored. Controlled feedback fields are stored separately for 14 days with active cleanup; caller signals use the same daily HMAC. Duplicate submissions consume budget. Limits: 100/day total, 10 per optional signal, 20 shared anonymous. Feedback and stated frequency/price are self-reports, not purchases or verified demand. Optional feedback never triggers automatically or causes capability builds. Core packets remain usable without feedback.

MCP: [version 0.2.0 MCPB release](https://github.com/Stavros65/fishnet-company-cve/releases/tag/v0.2.0), Node.js 22+, stdio transport. Two snapshot tools plus optional feedback submission; the local bundle is optional alongside the remote URL below. The feedback tool writes bounded telemetry and is explicitly annotated accordingly. The previous 0.1.0 release remains available.

## Remote MCP — no local Fishnet installation

Connect to **https://agent-research-fishnet.walsh-datascience.workers.dev/mcp** using Streamable HTTP. Anonymous free Phase A access; no API key or wallet. A compatible client still needs to know or discover the URL and authorize/configure access. Registry publication does not promise automatic discovery or tool selection.

Tools: `company_snapshot`, `cve_snapshot`, and explicitly optional `submit_fishnet_feedback`. Snapshot arguments and packet semantics are identical to the REST API. Feedback writes telemetry, is not read-only or idempotent, and never runs automatically.

Protocol 2026-07-28 uses per-request metadata (`io.modelcontextprotocol/protocolVersion`, clientInfo, clientCapabilities) plus matching `MCP-Protocol-Version`, `Mcp-Method` and, for tools/call, `Mcp-Name` headers. `server/discover` is optional; `tools/list` or a known-schema `tools/call` can be invoked directly. Stateless legacy 2025-11-25 and 2025-06-18 support initialize → notifications/initialized → tools/list → tools/call. Requests use `Content-Type: application/json` and `Accept: application/json, text/event-stream`; results are JSON.

No sessions are minted; GET/DELETE streams, resources, prompts, subscriptions, batching, sampling and extension methods are unsupported. Origin-less server clients work. Browser Origin must exactly match the service origin; there is no wildcard CORS. Maximum RPC body 4,096 UTF-8 bytes, nesting depth 12, body read 5 seconds; feedback retains its smaller limits. Rejections perform no source build.

One MCP HTTP request is one accounted interaction. Coarse route, protocol family, stage, tool and outcome are retained in the existing 14-day event stream. No RPC IDs, clientInfo, Origin, raw body/path/query or prompts are stored. HTTP 200 with `isError: true` is an application error, not useful packet use. Underlying coverage/source gaps remain explicit. Honor errors and backoff; global safety limits can suspend service. A transport-specific fault disables remote MCP while REST remains available when accounting is healthy.

The official Registry release 0.3.0 adds the remote address and retains the unchanged [0.2.0 stdio MCPB](https://github.com/Stavros65/fishnet-company-cve/releases/tag/v0.2.0). No existing release is overwritten.