hkex-filing-scraperCAUTION
HKEx regulatory filings scraper — 25+ years of filings into nine databases, with full-text extraction, graph linking, and a hosted MCP server for AI agents
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An open-source scraper for 25+ years of HKEx regulatory filings — into any of nine databases, with full-text extraction, graph linking, and a read-only MCP server for AI agents.
[](https://github.com/simonmak-ascent/hkex-filing-scraper/actions/workflows/ci.yml) [](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.simonmak-ascent/hkex-filings) [](https://glama.ai/mcp/servers/simonmak-ascent/hkex-filing-scraper) [](https://github.com/simonmak-ascent/hkex-filing-scraper/releases) [](https://pypi.org/project/hkex-filing-scraper/) [](https://www.python.org/downloads/) [](https://hkex-listco-updates.ascent-partners.com/) [](https://hkex-listco-updates.ascent-partners.com/ai-agents/) [](https://github.com/astral-sh/ruff) [](https://opensource.org/licenses/MIT)
Overview
**The US has EDGAR full-text search. Japan has
7bc00333cc8aOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add hkex-filing-scraper -- uvx hkex-filing-scraper==2.4.2 hkex-scraper-mcp
Trust audit
CAUTIONgrade D · trust 70/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (18)
"https://hkex-listco-updates.ascent-partners.com,http://localhost,http://127.0.0.1"
POSTGRES_DSN: postgresql://hkex:hkex@localhost:5432/hkex
POSTGRES_DSN: postgresql://hkex:hkex@localhost:5432/hkex
"POSTGRES_DSN": "postgresql://reader:password@localhost:5432/hkex"
# MYSQL_DSN=mysql://hkex:secret@localhost:3306/hkex
export POSTGRES_DSN=postgresql://hkex:hkex@localhost:5432/hkex
.gitleaks.toml
.markdownlint-cli2.jsonc
.pre-commit-config.yaml
return hashlib.md5(
hashlib.md5(raw_bytes, usedforsecurity=False).hexdigest() if raw_bytes else ""
filing_id = hashlib.md5(
return hashlib.md5(key.encode()).hexdigest()[:16]
> endpoint with no API key (`POST https://hkex-listco-updates.ascent-partners.com/api/mcp`)
Configuration is read from environment variables. A `.env` file in the **current working directory** is loaded automatically (requires `python-dotenv`; if it is missing, environment variables still wo
| `get_config` | `DATABASE_TARGET`, sink order, read sink, and graph settings (never credentials). |
| `Access denied for user` | Wrong credentials | Recheck `MYSQL_USER` / `MYSQL_PASSWORD` |
Gates applied: no_behavioural_pass.
7bc00333cc8afull audit observations/trust-audit/mcp-server/simonmak-ascent__hkex-filing-scraper.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 7bc00333cc8a | CAUTION | D | 70 | first audit |
Questions
What is the hkex-filing-scraper MCP server?
HKEx regulatory filings scraper — 25+ years of filings into nine databases, with full-text extraction, graph linking, and a hosted MCP server for AI agents
Is hkex-filing-scraper safe to connect to an agent?
With care. The audit graded it D (70/100) and found 18 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does hkex-filing-scraper need?
It reads CLICKHOUSE_PASSWORD, MARIADB_PASSWORD, MYSQL_PASSWORD, NEO4J_PASSWORD, POSTGRES_PASSWORD and SURREAL_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does hkex-filing-scraper run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as hkex-filing-scraper.
How current is this page?
The grade is for one exact copy of the source (7bc00333cc8a), read on 2026-10-10. The repository is watched and re-audited when it changes.