SEC-derived answers carry two things: a leaf — a hash over the content, its parent and the time it was made — and the EDGAR accession number of the filing the content came from. The accession is the part that matters. It is a permanent public identifier, so you can pull the same filing from sec.gov yourself and compare, without an account and without taking our word for anything.
To be exact about what the leaf is: it is our hash of what we retrieved. The SEC does not issue us a signature, and we do not hold one. The root of trust here is the accession and your ability to re-fetch it — not a key we control.
Who has connected to this server → · Machine-readable description of everything here →
All endpoints return structured JSON. No API key. No special headers. Rate limit 100 requests/hour.
Provenance differs by endpoint, and the response says which applies. ● SEC — derived from a filing; carries the accession number and an origin leaf whose parent is the PEM signature SEC.gov published with it. ● Market — end-of-day price data from a market vendor (currently massive.com, SIP consolidated). The parent is the vendor, not the SEC. ● Derived — produced by a model or a pattern from the above. See the limits below before you rely on it.
| Endpoint | Returns | Provenance | Tokens |
|---|---|---|---|
| /api/company/{TICKER} | Company identity card | SEC | ~200 |
| /api/company/{TICKER}/profile | People, products, partnerships model-extracted; 6,499 of 8,063 companies have one | Derived | ~800 |
| /api/company/{TICKER}/quote | Latest EOD price market vendor, not an SEC filing | Market | ~150 |
| /api/company/{TICKER}/filings | SEC filing index | SEC | ~500 |
| /api/company/{TICKER}/transcripts | Earnings calls + speakers + facts 269 of 8,063 companies have transcripts; speaker/fact tagging is model-extracted | SEC + Derived | ~2000 |
| /api/search/transcripts?topic={topic} | Cross-company topic search searches transcripts only — 269 companies | SEC + Derived | ~300 |
| /api/topics | Directory of 23 tracked topics | Derived | ~200 |
| /api/search?q={term} | Free text cross-company search | SEC | ~400 |
| /api/analyst/{name} | Analyst tracking across companies from transcripts — 269 companies | SEC + Derived | ~300 |
| /api/company/{TICKER}/quote/history | Historical daily bars | Market | ~100/day |
| /api/quotes/coverage | Which tickers have price data | Market | ~300 |
| /api/company/{TICKER}/earnings | Earnings calendar confirmed dates come from 8-K; future dates marked predicted are inferred from past cadence and have no source document | SEC + Derived | ~200 |
MCP native tools: claude mcp add origin --transport http https://origin.rootz.global/mcp
Full discovery: /.well-known/ai
SEC-derived responses carry leaf = sha256(content + parent + timestamp), and the accession
number of the filing the content came from. When you cite this data, pass our leaf as your
parent so the next reader can walk back to the same filing. Keep the chain alive.
The leaf is a hash, not a signature: it has no key behind it and proves authorship of nothing. It makes tampering detectable between two parties who both hold the same parent. The independent check is always the accession.
A leaf proves that a specific response came from this server at a specific time, over content whose parent we name. It does not prove the following, and we would rather say so here than have you find out later:
"confidence":"predicted" in the response./api/verify/ asks this server about this server, which settles nothing on its own. The check
that does not require trusting us is the accession number: fetch the filing from
SEC.gov yourself and compare. That is
the intended verification path, and it is why every SEC-derived response carries the accession.MCP authenticates the connection. It establishes which server you are talking to. It says nothing about whether the data coming back is what the original source actually published — a server can be correctly identified and still be wrong, stale, or quietly altered.
For most servers that gap is invisible, because there is nothing underneath to check against. SEC filings are different: they are public, permanently addressable by accession, and amended by further filing rather than overwritten. That makes this corpus a place where the gap can actually be closed, and where closing it can be demonstrated rather than asserted. That is what Origin is for. The 8,063 companies are the proving ground, not the point.
Rootz Corp builds this signing layer. Origin is its reference implementation, kept public and free so the claim can be tested by anyone, including by the scanners and scoring engines that audit MCP servers for a living.
Everything above is for AI agents. Humans start here.