43
/ 100
11 hours ago
glama

13flow

MCP server that reconstructs hedge-fund/superinvestor portfolios from SEC EDGAR 13F filings, offering tools to query fund holdings, consensus activity, and quarter-over-quarter changes through a read-only API.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 5 credentials: OPENFIGI_APIKEY, MASSIVE_API_KEY, SMTP_PASS, SMARTMONEY_ADMIN_SESSION_SECRET, SMARTMONEY_ADMIN_TOTP_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configEXPECT_PRO_TOOLS
configEXPECT_WAF_REJECTIONS
configHEALTH_URL
configMCP_13FLOW_API_BASE
configMCP_13FLOW_PRO_API_BASE
configMCP_ALLOWED_HOSTS
configMCP_ALLOWED_ORIGINS
configMCP_HOST
configMCP_PATH
configMCP_PUBLIC_SITE
configMCP_STATS_FILE
configMCP_X402_ASSET
configMCP_X402_FACILITATOR_URL
configMCP_X402_NETWORK
configMCP_X402_PAY_TO
configMCP_X402_PRICE
configMCP_X402_SCHEME
configOVERSIZE_TEST_BYTES
configSECURITY_TEST_PORT
configSITE
configSKIP_HEALTH
configSTATS_URL
configURL
🔐 secretOPENFIGI_APIKEYexport ="..." # optional, free; lifts FIGI rate limits
configSEC_UAexport ="SmartMoney/1.0 you@example.com" # SEC requires a contact email or 403s you
🔐 secretMASSIVE_API_KEYin the process environment; stooq is available as a free fallback for
configMASSIVE_BASE_URL
configSMTP_HOSTEmail needs / SMTP_PORT / SMTP_USER / SMTP_PASS / SMTP_FROM in the env.
configSMTP_PORTEmail needs SMTP_HOST / / SMTP_USER / SMTP_PASS / SMTP_FROM in the env.
configSMTP_USEREmail needs SMTP_HOST / SMTP_PORT / / SMTP_PASS / SMTP_FROM in the env.
🔐 secretSMTP_PASSEmail needs SMTP_HOST / SMTP_PORT / SMTP_USER / / SMTP_FROM in the env.
configSMTP_FROMEmail needs SMTP_HOST / SMTP_PORT / SMTP_USER / SMTP_PASS / in the env.
configSMARTMONEY_CACHE_DIRhistory is written to confluence-history.jsonl in ; corrections are
configSMARTMONEY_GIT_SHA
configSMARTMONEY_PRO_DBaudit events in a dedicated control-plane SQLite file via .
configSMARTMONEY_SYNC_SLEEP_SEC
configSMARTMONEY_VALUE
configSMARTMONEY_DB/var/lib/13flow/13flow.db
configSMARTMONEY_CONFLUENCE_SCAN_MIN_FUNDStracked funds opening or adding in the latest 13F
configSMARTMONEY_DEMO
configSMARTMONEY_DB_READONLYSMARTMONEY_OPEN=1 =1 python -m smartmoney.api --db demo.db
configSMARTMONEY_PRO_APIIt is off by default. Enable it with =1 and store keys, counters, and
🔐 secretSMARTMONEY_ADMIN_SESSION_SECRETserver-only-random-secret>
configSMARTMONEY_CONFLUENCE_LIVESEC_UA="you@example.com" =1 python -m smartmoney.api --db demo.db
configSMARTMONEY_CONFLUENCE_DEMOexplicitly requested (?demo=1 in the browser or =1 for the
configSMARTMONEY_ADMIN_PANEL_PASSWORD_SHA256
configSMARTMONEY_ADMIN_PASSWORD_PBKDF2pbkdf2-sha256$...>
configSMARTMONEY_ADMIN_PANEL_USERadmin@toonux.com
🔐 secretSMARTMONEY_ADMIN_TOTP_SECRETbase32-secret>
configSMARTMONEY_ADMIN_TOTP_REQUIRED
configSMARTMONEY_EDGAR_RATE_PER_SEC
configSMARTMONEY_WORKSPACE_AUTOMATION_MAX
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/bluetouff-13flow-10mgm9)](https://m8ven.ai/mcp/bluetouff-13flow-10mgm9)
commit: cc1c37e17cefc0e211b55f86ed97fa83c9316058
code hash: f8884e7190931b7bda73cd810ddd58100f50bdedb506beeb400f55cad461263b
verified: 7/31/2026, 8:55:49 AM
view raw JSON →