DEV Community: Hudson Enterprises

Query SEC filings from inside Claude Desktop — Filingrail is now MCP-enabled

Hudson Enterprises — Thu, 09 Jul 2026 12:34:20 +0000

Filingrail now ships a first-party MCP server on PyPI: pip install filingrail-mcp. One install, one config block, and Claude Desktop — or Cursor, or Continue, or any MCP-compatible client — can query SEC filings as tools. No glue code.

That's worth naming directly. Most SEC-data APIs ship a REST endpoint and stop. You write the agent integration yourself: parse the response, wire up the tool schema, handle auth headers. Filingrail ships the integration as a maintained package with the same update cadence as the underlying REST API.

This post covers the setup, what you can ask once it's wired in, and the honest limits. I built both the API and the MCP server — I'll be upfront about that throughout.

This post covers a data API that returns SEC-registered financial information. Nothing here is investment advice.

Two ways to wire it in

Option 1 — pip install filingrail-mcp (recommended)

Install the package, add one block to your Claude Desktop config, restart. Filingrail's endpoints appear as tools. No separate service to run, no background daemon.

Option 2 — RapidAPI MCP Playground tab (no local install)

The Filingrail listing on RapidAPI has an MCP tab that generates a ready-to-paste config block. Same endpoints, same auth, zero install step.

Either path gives Claude the same tools. Pick the one that fits your setup.

Setup — the `pip install` path

You'll need Python 3.10+ and a RapidAPI key.

1. Subscribe to Filingrail

Go to the Filingrail RapidAPI listing and subscribe. Free tier is 50 calls/day, no credit card. Copy your X-RapidAPI-Key from the RapidAPI dashboard.

2. Install the server

pip install filingrail-mcp

3. Add Filingrail to your Claude Desktop config

On macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
On Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "filingrail": {
      "command": "filingrail-mcp",
      "env": {
        "RAPIDAPI_KEY": "your_rapidapi_key_here"
      }
    }
  }
}

4. Restart Claude Desktop

Filingrail's endpoints appear as available tools. Your key lives in the env block — you don't pass it per-call; the server handles the X-RapidAPI-Key and X-RapidAPI-Host headers for you.

The same config pattern works in Cursor and Continue — point their MCP config at filingrail-mcp the same way.

What you can ask once it's wired in

All seven v1.0 endpoints are available as tools. Here's what that looks like in practice:

Company search

"Find the CIK for Berkshire Hathaway"

Claude calls /v1/search/companies. Over 8,200 SEC-registered issuers are indexed by ticker, CIK, or name fragment.

Financials

"What was Apple's operating margin for the most recent quarter? Show me the source filing."

Claude calls /v1/companies/AAPL/financials, pulls the normalized income statement from the most recent 10-Q or 10-K, and surfaces the meta.source_filing_url — a direct sec.gov link to the filing the numbers came from. Every response carries it.

The difference between "Claude says revenue was $X" and "Apple's 10-Q filed 2025-10-31 says revenue was $X — here's the filing" is meaningful if you need the primary source, not the model's recall.

Financial history

"Pull Amazon's quarterly revenue for the last 3 years and show me the trend"

Claude calls /v1/companies/AMZN/financials/history with period=Q&limit=12. Multiple periods per call, spanning the XBRL history available for each company.

Filings stream

"List the most recent 10-K filings for Microsoft"

Claude calls /v1/filings/recent. Filterable by CIK, form type, and date range. Each record includes the accession number and a filing_url pointing to the document on sec.gov.

Insider trades

"What Form 4 transactions has Nvidia's CEO filed in the last 6 months?"

Claude calls /v1/companies/NVDA/insider-trades. Continuously refreshed from SEC EDGAR.

8-K material events

"Show me every 8-K with item code 5.02 — executive changes — that Tesla has filed"

Claude calls /v1/companies/TSLA/8k-events. Item codes are preserved as structured fields (1.01 for material agreements, 2.01 for acquisitions, 5.02 for director/officer changes, etc.), so Claude can filter and reason over them in the same conversation.

13F institutional holdings

"What are Berkshire Hathaway's top 10 equity positions by dollar value?"

Claude calls /v1/institutions/{cik}/13f-holdings. Returns positions in whole-dollar USD. Continuously updated from EDGAR filings.

The `meta.source_filing_url` field

Every endpoint — financials, insider trades, 8-K events, 13F holdings — returns a meta.source_filing_url. It's the direct sec.gov URL for the filing that produced the data in that response.

In an MCP context this matters: when Claude answers a financial question, it can attach the source filing as a citation in the same response. Research workflows that need the answer and the primary source get both without a second lookup.

Honest limits

You still need a RapidAPI key. filingrail-mcp is the integration layer, not a separate data source. It calls the same RapidAPI-hosted endpoints. Subscribe, pass your X-RapidAPI-Key via the env block, done.

Rate limits apply to every tool call Claude makes. Free tier is 50 calls/day. A long research session with many back-and-forth questions can burn through that. Budget accordingly or upgrade to Pro ($9/mo for 5,000 calls/month).

Not real-time. Data is refreshed daily from EDGAR. New filings appear within approximately 6–24 hours of EDGAR acceptance. Yesterday's 8-K disclosures, not this morning's.

EDGAR only. US SEC filings. Non-US issuers (SEDAR, FCA, etc.) are out of scope for v1.

Why this is a different abstraction

Most financial data APIs were designed for servers calling servers. The MCP layer shifts how you interact: instead of writing code to call an endpoint and parse the response, you describe what you want and the model routes the tool call, parses the JSON, and reasons over the result in the same context window.

That works for research-style questions — the ones that aren't really REST queries but aren't pure reasoning either. "What did Berkshire buy or sell in their most recent 13F compared to Q4?" is awkward to write as two sequential API calls stitched together; it's a natural question when Claude has both tools available.

The citation layer — meta.source_filing_url on every response — keeps that convenience from floating free of primary sources.

What's next on the MCP side

filingrail-mcp tracks the REST API. As new endpoints ship (expanded ratio coverage, screening endpoints, broader company coverage), the MCP tools surface them too. Updates arrive through pip install --upgrade filingrail-mcp.

If you'd rather call the API directly from Python, there's also a typed SDK: pip install filingrail — sync and async clients, typed dataclasses, all seven endpoints. The MCP server is built on the same client.

Pricing

Tier	Price	Calls/month
Free	$0	1,500 (50/day)
Pro	$9/mo	5,000
Ultra	$49/mo	50,000
Mega	$199/mo	500,000

Subscribe on the Filingrail RapidAPI listing.

Questions: support@hudsonenterprisesllc.com

Built by Hudson Enterprises LLC, an Indiana software studio.

I built a browser extension that exports any web table to CSV, Excel, or Markdown — processed entirely on your device

Hudson Enterprises — Thu, 09 Jul 2026 12:33:09 +0000

There is a table on almost every page I work with — government data portals, Wikipedia, SaaS analytics dashboards, documentation sites. The standard workflow for getting that data somewhere useful is: select all, copy, paste into a spreadsheet, spend five minutes fixing the formatting. Or pay a monthly subscription for an export format you need twice a week.

I priced the segmentation as "your problem, not mine" and built a flat one-time alternative. That is the entire reason this exists.

How it works

Click the extension icon on any page. The extension reads the <table> elements from the DOM — the same data your browser already downloaded and rendered. You pick which table (the popup lists all detected tables with a mini-preview and their dimensions), pick a format, and the file is written to disk.

Nothing leaves your device during that process.

SheetJS (xlsx) handles XLSX generation entirely in the browser. The library is bundled inside the extension — not loaded from a CDN at runtime — so the network tab stays empty when you export. CSV and Markdown are pure JavaScript over the DOM structure, no dependencies.

License validation (when you activate a key) makes one call to api.lemonsqueezy.com. That is the only external network request the extension ever makes.

Three file formats — why each one

Different consumers want different things from the same table.

Format	When you want it
CSV	Data pipeline, pandas, any spreadsheet
XLSX	Send to a non-technical colleague, need column widths or sheet structure
Markdown	Documentation, GitHub issues, Obsidian notes, PRs

Copy to clipboard is also there for pasting directly into Slack, email, or a text field. That covers the full range of "I have a table on this page, I need it somewhere else."

What it handles — and what it doesn't

It handles standard HTML <table> elements. Most data tables on government sites, Wikipedia, documentation pages, and SaaS dashboards use standard table markup.

What it does not handle:

CSS grid / flexbox "tables" — if there is no <table> element in the DOM, there is nothing to read
Virtualized tables — enterprise dashboards that only render visible rows in the DOM; the extension captures the rendered rows, not the full dataset
Pages that block extensions — chrome:// URLs and the Chrome Web Store itself block extension scripting by design

I document these in the extension's help text. I would rather a user know upfront what to expect than discover it on a page that matters.

The trial and price

Seven-day free trial, no account needed — the trial runs locally in the extension's storage. After that, it is $9 one-time. No subscription. All three export formats on day one.

The extension is live on the Chrome Web Store. The product page is at tableexporter.hudsonenterprisesllc.com.

What I learned building it

A few things that came up during the build worth sharing:

SheetJS in a Chrome extension (MV3) — bundling xlsx.full.min.js as a local vendor file is the right call. Loading from a CDN would break the "nothing transmitted" guarantee and also fails under strict CSP headers on some pages. Bundling avoids both problems.

activeTab is enough — the extension only needs activeTab, scripting, and storage permissions. No broad host permissions for the table-reading functionality. The only host permission is api.lemonsqueezy.com for license key activation. That keeps the permission prompt honest.

Nested tables — querySelectorAll('table') catches nested tables too. I skip any <table> whose parent is inside another <table>. Without that filter, a table used for layout inside a data table shows up as a separate entry, which is confusing.

Virtualized tables are a real cliff — I initially thought I could handle them with a scroll-and-capture approach. The DOM truly does not contain the full dataset in those cases; the rows are created and destroyed as you scroll. Documenting the limitation honestly turned out to be the right call rather than shipping a partial solution.

Try it

Chrome Web Store listing — seven-day trial, no account.

Questions: support@hudsonenterprisesllc.com

I built this. Hudson Enterprises LLC is an Indiana software studio.

I built a color picker with one permission — because a Featured one got caught exfiltrating visited URLs

Hudson Enterprises — Thu, 09 Jul 2026 12:33:08 +0000

In April 2026, a widely-used color picker extension — Featured on the Chrome Web Store, 400,000+ users — was caught collecting and transmitting users' visited URLs and referrer data to a remote server (PiunikaWeb, April 2026). Not suspected of it — a researcher diffed the extension's code between versions and showed the tracking being added. The extension was still Featured when this story ran.

That is not a hypothetical about what browser extensions could do. It happened. It was reported. And it illustrates the problem with color pickers specifically: they're small, trusted, always-on tools that you install once and forget about. Which makes them attractive targets for abuse.

After reading that story, I looked for an alternative I could actually verify. I couldn't find one I was confident about — so I built one.

One permission. Here's the manifest

"permissions": ["storage"]

That's it. One permission. storage keeps your local palette between sessions. There is no tabs permission, no activeTab, no <all_urls>, no host permissions for ad networks or analytics providers.

There is one host permission — https://api.lemonsqueezy.com/* — for license validation on the paid tier. That call goes out when you activate a paid license key. It verifies the key. It does not send browsing history, installed extensions, tab URLs, or anything about what you're doing. The free eyedropper works with no network calls at all.

You can verify this yourself. In Chrome: chrome://extensions → Details on any extension → "Site access" and "Permissions." Cross-check the source. This is what I'd want from any extension I'm running constantly in my browser.

How the eyedropper actually works

The extension uses the browser's native EyeDropper API (window.EyeDropper), available in Chrome 95+ and part of the W3C spec. Here's the full flow:

const eyeDropper = new EyeDropper();
const result = await eyeDropper.open();
// result.sRGBHex — that's the entire data surface

When you click the eyedropper button, the browser takes over screen capture — not the extension. The extension receives a single hex value when you click a pixel. It does not take screenshots. It does not maintain persistent access to what's on your screen. It cannot see what tab you're on or what page you're reading.

This is not a design choice I made. It's how the API works. The browser sandboxes screen access to the moment of selection and hands the extension only the result.

What happens after you pick a color:

The hex value is displayed in the popup
It's added to a local palette stored in chrome.storage.local — your browser's own storage, not a server
A WCAG contrast check runs against your palette entries using the relative luminance formula (WCAG 2.1 §1.4.3)

What does not happen:

No network requests during normal use
No analytics SDK
No account system
No background service worker running while you're not using the popup
No access to page content, tab URLs, or browsing history

The WCAG contrast checker

This was the feature I kept not finding in alternatives. When you're picking colors for a UI, you need to know whether a foreground/background pair meets WCAG AA (4.5:1 for normal text, 3:1 for large text). The extension calculates this inline as you build your palette — no external call, just the relative luminance formula over two hex values.

L = 0.2126 * R + 0.7152 * G + 0.0722 * B
contrast = (L1 + 0.05) / (L2 + 0.05)

It tells you pass/fail at both thresholds as you work. Useful if you're picking brand colors, building design tokens, or checking a client's palette for accessibility compliance.

What I'm launching

The extension is live on the Chrome Web Store: mmdnjjpnigidljigfkjohldlipdkaomp.

The basic eyedropper is free. The paid features — export (PNG, JSON, CSS custom properties) and image palette extraction — unlock for $9 one-time. No subscription. License tied to your browser via Lemon Squeezy, which is the one outbound call mentioned above.

Demand page with install link and details: colorpicker.hudsonenterprisesllc.com

On the permission question

If you're currently using a color picker extension, open chrome://extensions, find it, and look at "Permissions" and "Site access." Extensions with tabs permission can read your open tab URLs. Extensions with <all_urls> or broad host permissions can inject scripts into every page you load. Permissions don't expose what an extension does with that access — only what it's allowed to do. Network calls happen within whatever access the extension already has.

Worth knowing. I'm not saying any specific extension you're using is doing something wrong. I'm saying the April 2026 incident was real, the risk is structural, and the minimum-permission approach I took here is verifiable.

Built by Hudson Enterprises LLC. Questions: support@hudsonenterprisesllc.com

I built this and the demand page linked above is mine.

I built a PDF editor that runs entirely in your browser — no upload, no account, $9 once

Hudson Enterprises — Thu, 09 Jul 2026 11:19:09 +0000

Every time I merge a contract PDF with a signature page, I'm handed the same bad choice: use a web tool that uploads my files to a server I know nothing about, or fight with a desktop app that costs $80/year and ships features I don't need.

I've watched people paste tax returns, medical records, and NDA drafts into browser-based PDF tools without thinking about where those files go. The upload is the product. The free tier exists because documents are valuable.

So I looked at what the browser can actually do without a server involved. The answer is more than most people assume.

What runs where

pdf-lib handles all the actual PDF manipulation — merge, split, extract pages, delete pages, rotate. It's a JavaScript library that runs entirely in the browser. When you click "Merge," your files go from disk into a Uint8Array in the browser's memory, get processed by pdf-lib, and come back out as a new file downloaded to your disk. The network is never involved in that path.

The extension itself is minimal on purpose. The service worker does one thing:

chrome.action.onClicked.addListener(() => {
  chrome.tabs.create({ url: chrome.runtime.getURL('editor.html') });
});

Click the toolbar icon, get a full-page editor tab. No popup (too cramped for PDF thumbnails), no background process, no telemetry, no account system. The service worker has nothing to phone home to.

PDF.js renders page thumbnails inline. Before you merge or split, you can see the pages you're working with. That's a significant UX difference from tools where you operate on filenames blindly — especially when page order matters or you're not sure which pages you actually need to extract.

License validation talks to Lemon Squeezy's API, but only when you enter a key. The processing path is clean — there's no license check inside the merge or split logic, and the extension runs in a 7-day trial before asking for anything.

What it does

Merge — drag PDFs into order, output one combined file
Split — choose which pages go into which output file
Extract — pull specific pages into a new document
Delete — remove pages by number
Rotate — rotate individual pages or all pages 90/180/270 degrees

Page thumbnails render inline so you can see what you're working with before committing.

Why not just a desktop app

Desktop apps solve the upload problem but create a different one: most serious PDF tools are subscription-based or require expensive one-time purchases. The lightweight free options have narrow feature sets — typically merge-only or split-only, not the full set you need when you're actually working with documents.

The browser-based approach means it runs on Windows, Mac, and Linux anywhere Chrome runs. One install. No update treadmill — the extension updates through Chrome's normal mechanism, but the processing logic doesn't drift between versions in ways that would break your workflow.

For documents in the dozens-of-pages range, the processing speed is fine. For 500-page books, a native app will be faster. That's an honest tradeoff worth stating clearly.

Where to get it

It's live on the Chrome Web Store: PDF Toolkit — Offline. There's a bit more detail on the product page.

Price: $9 one-time. No subscription. No account required to use the extension after you enter your license key. The 7-day trial starts on first use, so you can evaluate it on your own documents before buying.

If you've dealt with the "upload your sensitive document to our server" problem and built your own workaround, I'm curious what that looked like. Drop it in the comments. And if you want to try it, the install link is up above.

support@hudsonenterprisesllc.com for anything else — async only.

I built this. The links above go to my product's Chrome Web Store listing and product page. I'm disclosing that because I'd want to know.

Screen a name against the OFAC sanctions list in 3 lines (REST API, free tier)

Hudson Enterprises — Thu, 09 Jul 2026 11:19:08 +0000

Read this before the code: SanctionRail is one input to your own OFAC compliance program — not a substitute for it, not a sole or final screening control, and not legal or compliance advice. Fuzzy matching produces both false positives and false negatives. You independently review every result and make all blocking, rejection, and reporting determinations. Hudson Enterprises LLC is a software publisher, not a regulated screening provider, law firm, or compliance advisor. Use is governed by the SanctionRail Terms of Service.

U.S. businesses handling regulated transactions are required to screen counterparties against the OFAC Specially Designated Nationals (SDN) list. If a transaction involves a listed party, you're required to block it and report it to Treasury.

The tooling gap is real. OFAC.gov has a search box — browser only, no API, no fuzzy matching. If the name is transliterated differently or the parts are reordered, an exact-string search misses it. Enterprise tools like LexisNexis WorldCompliance and ComplyAdvantage start at $1,000+/month on annual contracts. There's nothing useful in between for a team that needs a screening signal without a six-figure budget.

This tutorial walks through calling SanctionRail — a REST API that does fuzzy name matching against the OFAC SDN and consolidated sanctions lists. Free tier: 1,500 calls/month, no credit card. I built it; I'll be upfront about that throughout.

There's also a free web checker — no account required, type a name and see whether it matches. Good for a manual spot-check before you write any code.

Before you integrate: what this is and isn't

This needs to be said plainly before the code.

What SanctionRail screens against: U.S. Treasury OFAC Specially Designated Nationals (SDN) list and the OFAC consolidated (non-SDN) sanctions lists, sourced from treasury.gov and refreshed daily. Approximately 18,959 records across individuals, entities, vessels, and aircraft, plus their indexed aliases and AKAs (total_records_searched in every response tells you the exact count at query time).

What it does NOT screen against: EU, UN, UK (HM Treasury / OFSI), Canadian (OSFI), or any other non-U.S. sanctions regime. No PEP lists. No adverse-media. If your compliance program requires multi-regime screening, this is not the right tool.

What fuzzy matching means in practice: the API catches transliteration variants, reordered name parts, and partial matches that exact-string search misses. It also means false positives (a legitimate customer whose name resembles a listed party) and false negatives (a listed party whose name is transliterated differently than the indexed alias). You review every match result. You make all blocking and reporting decisions. The API does not make compliance determinations for you.

Step 1 — Set up

A free RapidAPI account → subscribe to SanctionRail on the Free tier → copy your X-RapidAPI-Key.

export RAPIDAPI_KEY="your_key_here"

Python 3.8+ with requests is all you need for the examples below.

Step 2 — The 3-line version

import requests

r = requests.post(
    "https://sanctionrail.p.rapidapi.com/screen",
    json={"name": "Vladimir Putin", "threshold": 0.85, "limit": 5},
    headers={"X-RapidAPI-Key": "YOUR_KEY", "X-RapidAPI-Host": "sanctionrail.p.rapidapi.com"},
)
print(r.json())

That's the core call. One endpoint, a ranked list of matches with confidence scores.

Step 3 — Read the response

{
  "query": "Vladimir Putin",
  "threshold": 0.85,
  "list_version": "05/11/2026",
  "list_loaded_at": "2026-05-14T22:52:21Z",
  "total_records_searched": 18959,
  "match_count": 1,
  "matches": [
    {
      "sdn_id": 35096,
      "name": "PUTIN, Vladimir Vladimirovich",
      "sdn_type": "Individual",
      "score": 1.0,
      "matched_via": "primary",
      "matched_text": "PUTIN, Vladimir Vladimirovich",
      "program": ["RUSSIA-EO14024"],
      "remarks": null
    }
  ]
}

Fields worth noting:

list_version and list_loaded_at — the age of the data at query time. Check this against the current OFAC publication date on treasury.gov for high-stakes transactions.
score — confidence of the match (0–1). Not a compliance determination.
matched_via — whether the match came from the primary name or an indexed alias.
program — the sanctions program(s) the record is listed under (e.g. RUSSIA-EO14024, SDGT, IRAN).

Step 4 — Understand the parameters

POST /screen accepts:

Param	Type	Default	What it does
`name`	string	—	Required. The name to screen (2–200 chars)
`threshold`	float	0.85	Minimum confidence score to return a match (0–1)
`sdn_type`	string	`Any`	Scope to `Individual`, `Entity`, `Vessel`, `Aircraft`, or `Any`
`include_aliases`	bool	`true`	Match against indexed aliases and AKAs
`limit`	int	20	Max matches returned (1–100). Must be ≥ 1.

The threshold parameter is the most operationally significant decision you'll make. 0.85 is the default — a reasonable starting point. Drop it toward 0.70 for higher recall and more false positives to review. Raise it toward 0.95 to cut noise, accepting higher false-negative risk. What the right value is for your program depends on your risk tolerance and review capacity — that's a judgment call for your compliance team, not something this documentation can prescribe.

Step 5 — Screen a batch of names

import os
import requests

RAPIDAPI_KEY = os.environ["RAPIDAPI_KEY"]

HEADERS = {
    "X-RapidAPI-Key": RAPIDAPI_KEY,
    "X-RapidAPI-Host": "sanctionrail.p.rapidapi.com",
}

def screen_name(name, threshold=0.85, sdn_type="Any"):
    r = requests.post(
        "https://sanctionrail.p.rapidapi.com/screen",
        json={
            "name": name,
            "threshold": threshold,
            "sdn_type": sdn_type,
            "include_aliases": True,
            "limit": 5,
        },
        headers=HEADERS,
        timeout=15,
    )
    r.raise_for_status()
    return r.json()

names_to_screen = [
    "Acme Trading Co",
    "Kim Jong Un",
    "Jane Smith",
]

for name in names_to_screen:
    result = screen_name(name)
    match_count = result["match_count"]
    if match_count > 0:
        top = result["matches"][0]
        print(f"{name}: {match_count} match(es) — top score {top['score']:.2f} ({top['name']})")
        print(f"  → REQUIRES REVIEW — do not proceed without manual verification")
    else:
        print(f"{name}: no matches above threshold {result['threshold']}")
        print(f"  → No match found; your own compliance process determines next steps")

A match does not mean block. No match does not mean clear. Those determinations belong to your compliance program and your legal or compliance advisors. The API surfaces whether a name resembles an OFAC-listed party; what you do with that signal is yours.

Step 6 — Look up a full entity record

When a match returns an sdn_id, pull the full record — aliases, addresses, citizenships, dates of birth, ID documents, and sanctions programs:

sdn_id = 35096  # from the match result

r = requests.get(
    f"https://sanctionrail.p.rapidapi.com/entity/{sdn_id}",
    headers=HEADERS,
    timeout=15,
)
entity = r.json()
print(entity)

This is the record as published on the OFAC list. If you're doing manual review on a positive match, start here.

Step 7 — Check list freshness

r = requests.get(
    "https://sanctionrail.p.rapidapi.com/list-status",
    headers=HEADERS,
    timeout=15,
)
status = r.json()
print(f"List version: {status['list_version']}")
print(f"Loaded at:    {status['list_loaded_at']}")
print(f"Record count: {status['record_count']}")

The list refreshes daily from treasury.gov. Because the refresh depends on Treasury's own publication timing, newly-designated parties may not appear immediately. For high-stakes transactions, cross-reference list_version against the current OFAC publication date at sanctions.ofac.treas.gov.

What this is not

Not a compliance program. SanctionRail is one input to your own OFAC compliance program — not a substitute for it and not a final screening control. Your program must include review procedures, documentation, and blocking/reporting determinations that no API can make for you.
Not multi-regime. U.S. OFAC SDN and consolidated lists only. EU, UN, UK (OFSI), and other regimes are out of scope.
Not PEP or adverse-media. No politically-exposed-person lists, no adverse-media screening.
Not legal or compliance advice. If you're building OFAC compliance into a regulated product, work with a qualified attorney or compliance professional.

Pricing

Tier	Price	Calls/month
BASIC	$0	1,500
PRO	$9/mo	10,000
ULTRA	$49/mo	100,000
MEGA	$199/mo	1,000,000

No credit card on the free tier. Subscribe at the RapidAPI listing. Every call needs X-RapidAPI-Key and X-RapidAPI-Host: sanctionrail.p.rapidapi.com — that's the full auth story.

Enterprise tools (LexisNexis WorldCompliance, ComplyAdvantage, Refinitiv World-Check) cover multiple global regimes + PEP + adverse-media at $1,000+/month on annual contracts. SanctionRail is narrower — U.S. OFAC only — at a fraction of the cost. If you need multi-regime coverage, budget for the enterprise tier; if U.S. OFAC is the specific gap, this fills it.

Questions or issues

support@hudsonenterprisesllc.com — same-business-day response, async only. Include your RapidAPI key prefix (first 8 chars), the endpoint, and the request body.

For list data questions — a suspected outdated record, an incorrect alias — we can point you to the originating OFAC record on treasury.gov so you can verify against the source.

Built by Hudson Enterprises LLC. Use governed by the SanctionRail Terms of Service.

Find catastrophic-backtracking regexes before they ship (free checker + API)

Hudson Enterprises — Thu, 09 Jul 2026 10:20:36 +0000

A regex that works correctly under normal inputs can pin a CPU at 100% when a crafted input triggers catastrophic backtracking. The attack class is CWE-1333 — ReDoS, regular expression denial of service. The runtime doesn't matter: Node.js, Python, Java, Ruby, all use backtracking-based engines. What matters is whether the pattern itself creates an exponentially growing search space on a non-matching input.

This tutorial walks through what catastrophic backtracking looks like, how to detect it before it ships, and how to wire the check into a CI/CD gate so it runs automatically on every changeset.

Everything here runs against ReDoScan — a REST API I built for this specific job. There's also a free web checker if you want to paste a regex without writing code. I built both; I'll be upfront about that throughout.

What catastrophic backtracking actually is

Most regex engines work by trying every possible path through the pattern when a match fails. For safe patterns the search space is small — the engine finds a dead-end quickly and moves on. For certain constructs the search space grows exponentially with input length, and a crafted non-matching input can force the engine to explore it all.

Three constructs reliably cause this:

Nested quantifiers — (a+)+

The inner a+ can match one or more as. The outer + lets the group repeat. For input aaaaaX, the engine tries every way to distribute the as across iterations before concluding there's no match. The number of combinations is exponential in the length of the input.

Overlapping alternation — (a|a)*

Both branches match the same input. The engine explores every combination of which branch matched which character.

Prefix overlap — (a|ab)*

The two branches share a prefix. On a non-matching input the engine can't prune the search tree early.

A pattern like ^(\w+)+$ — common in username validators — is nested quantifiers in production clothes. \w+ expands to [a-zA-Z0-9_]+. Same exponential behavior. Input aaaaaaaaaaaaaaaaaaaaaaaaaaaaX will hang the thread.

Step 0 — Try the free checker

Paste any regex at redoscan.hudsonenterprisesllc.com. No account needed. Static analysis runs and returns a risk badge (safe / low / medium / high / critical) with the findings in plain English.

Paste (a+)+$. It comes back high with the finding: "Nested quantifier inside a quantified group. Triggers exponential backtracking on long non-matching inputs."

The API adds an optional dynamic timing layer for deeper checks — covered in Step 3.

Step 1 — Set up the API

Free tier on RapidAPI: 1,500 scans/month, no credit card. Subscribe at the ReDoScan listing and your X-RapidAPI-Key appears in the dashboard within seconds.

export RAPIDAPI_KEY="your_key_here"

Step 2 — Scan one pattern

curl -s -X POST "https://redoscan1.p.rapidapi.com/scan" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: $RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: redoscan1.p.rapidapi.com" \
  -d '{"pattern": "(a+)+$", "dynamic": false}'

Response:

{
  "pattern": "(a+)+$",
  "overall_risk": "high",
  "is_redos_vulnerable": true,
  "static_findings": [
    {
      "rule_id": "nested-quantifier",
      "severity": "high",
      "description": "Nested quantifier inside a quantified group. Triggers exponential backtracking on long non-matching inputs.",
      "matched_at": 0
    }
  ],
  "syntax_valid": true,
  "scan_time_ms": 0.5
}

overall_risk gives you the 5-level classification. is_redos_vulnerable is the boolean gate for automated pipelines. static_findings tells you which rule fired and where in the pattern — useful when you need to explain the finding in a PR comment or a security ticket.

Step 3 — Add dynamic timing (optional, deeper)

Static rules catch the canonical constructs in sub-millisecond time — the right default for a batch CI gate. Dynamic timing feeds the pattern adversarial inputs of increasing length, measures how runtime scales, and classifies the growth curve (safe / polynomial / exponential). It catches some patterns that static rules miss.

curl -s -X POST "https://redoscan1.p.rapidapi.com/scan" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: $RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: redoscan1.p.rapidapi.com" \
  -d '{"pattern": "(a+)+$", "dynamic": true}'

The response adds a dynamic_finding object with per-length timing data (timings_ms) and the growth classification (growth_classification). Use dynamic on a final audit pass or for a single suspicious pattern you want to confirm. For a 200-pattern batch in CI, keep "dynamic": false.

Step 4 — Wire it into a CI gate

The /scan-batch endpoint takes up to 200 patterns in one request — the right tool for a pre-merge gate. Extract every regex literal from a changeset, batch-scan them, fail the build on high or critical.

import os
import sys
import requests

RAPIDAPI_KEY = os.environ["RAPIDAPI_KEY"]

# These would come from static analysis of the changed files
patterns = [
    "^[a-z]+$",           # safe
    "(a+)+",              # high — nested quantifier
    "^(\\w+)+$",          # high — same pattern, common in validators
    "^[a-zA-Z0-9._%+\\-]+@[a-zA-Z0-9.\\-]+\\.[a-zA-Z]{2,}$",  # email — likely safe
]

r = requests.post(
    "https://redoscan1.p.rapidapi.com/scan-batch",
    json={"patterns": patterns, "dynamic": False},
    headers={
        "X-RapidAPI-Key": RAPIDAPI_KEY,
        "X-RapidAPI-Host": "redoscan1.p.rapidapi.com",
    },
    timeout=30,
)
r.raise_for_status()
results = r.json()

# Fail on high or critical
high_risk = [x for x in results if x["overall_risk"] in ("high", "critical")]
if high_risk:
    print(f"FAIL: {len(high_risk)} high-risk regex(es) detected:")
    for x in high_risk:
        print(f"  Pattern: {x['pattern']}")
        print(f"  Risk:    {x['overall_risk']}")
        for f in x.get("static_findings", []):
            print(f"  Finding: {f['description']}")
    sys.exit(1)

print(f"PASS: {len(results)} patterns scanned, none high-risk or critical")

One thing worth noting: invalid patterns come back with "syntax_valid": false rather than erroring the whole batch. A malformed pattern won't stop the other 199 from being checked.

Step 5 — Validate against the known-evil corpus

GET /known-evil is a public endpoint — no API key required. It returns a curated corpus of canonical evil patterns, real-world CVE patterns, and safe baselines.

curl -s "https://redoscan1.p.rapidapi.com/known-evil" | python -m json.tool | head -60

Hit this before wiring any gate into production. If a pattern you know is vulnerable comes back safe, something is misconfigured. The corpus also works as a test fixture for anyone building their own tooling on top of the API.

What this is not

Honest caveats, because someone will ask:

Not a full SAST suite. It does one thing — ReDoS / regex denial-of-service detection. No SQL injection, no XSS, no secrets. Use a full SAST platform for that; this is the ReDoS check you run without licensing one per seat.
Not a guarantee. safe means no static rule fired and — if dynamic was enabled — no pathological growth was observed on adversarial inputs. It does not mean the pattern is invulnerable to every possible input. Real-world CVE patterns can carry non-obvious vulnerabilities that static rules and timing tests both miss. Your own application security review still applies.
Not a regex linter. It scores denial-of-service risk, not style or correctness. [A-Za-z]+ can be written as \p{L}+ — ReDoScan doesn't care about that. The score is about whether the pattern can be weaponized against your server.

Pricing

Tier	Price	Scans/month
BASIC	$0	1,500
PRO	$9/mo	10,000
ULTRA	$49/mo	100,000
MEGA	$199/mo	1,000,000

No credit card on the free tier. Subscribe at the RapidAPI listing. Every call needs X-RapidAPI-Key and X-RapidAPI-Host: redoscan1.p.rapidapi.com — that's the full auth story.

Questions or issues

support@hudsonenterprisesllc.com — same-business-day response, async only. Include your RapidAPI key prefix (first 8 chars), the endpoint, and the request body if you're reporting an issue.

Built by Hudson Enterprises LLC, an Indiana software studio.

Pull any public company's SEC financials in 3 lines of Python (with source filing URL)

Hudson Enterprises — Sun, 28 Jun 2026 23:31:36 +0000

Every number a company reports to the SEC is public. The bottleneck isn't access — EDGAR is free and open. The bottleneck is the parser, the XBRL normalizer, the rate-limit governor, and the deduplication layer you have to write before you get to the one number you actually wanted.

This tutorial skips all of that. By the end you'll have working Python that returns Apple's income statement, balance sheet, and cash flow from a live 10-Q — plus the exact sec.gov URL for every number, so you can verify any figure at its source.

Everything here runs against Filingrail, a REST API on RapidAPI that normalizes SEC EDGAR filings into clean JSON. Free tier: 50 calls/day, no credit card. I built it; the tutorial is honest about what it can and can't do.

What you need

Python 3.8+ with requests (pip install requests)
A free RapidAPI account → subscribe to Filingrail on the Free tier → copy your X-RapidAPI-Key

export RAPIDAPI_KEY="your_key_here"

That's it. No EDGAR User-Agent configuration, no local XBRL parser, no rate-limit governor to wire up.

Prefer a typed client over raw HTTP? There's an official Python SDK:
pip install filingrail
from filingrail import Filingrail

client = Filingrail(api_key="your_rapidapi_key")
print(client.financials("AAPL").meta.source_filing_url)
Sync and async clients, typed dataclasses, all seven endpoints. PyPI page has the full reference. The rest of this tutorial uses plain requests so the HTTP shape stays visible — but the SDK is the shorter path for production code.

Step 1 — Resolve a ticker to its SEC CIK

The SEC's Central Index Key (CIK) is the canonical identifier for every registered issuer. Filingrail's search endpoint handles the ticker-to-CIK lookup, so you don't maintain a mapping file.

curl --silent \
  "https://filingrail.p.rapidapi.com/v1/search/companies?q=apple&limit=3" \
  -H "X-RapidAPI-Key: $RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: filingrail.p.rapidapi.com" \
  | python -m json.tool

Response (abbreviated):

{
  "data": [
    {
      "cik": 320193,
      "ticker": "AAPL",
      "name": "Apple Inc.",
      "sic_code": null,
      "sic_description": null,
      "exchange": null,
      "state_of_inc": null
    }
  ],
  "meta": {
    "ticker": null,
    "cik": null,
    "as_of": "2026-06-03T11:20:39",
    "source_filing_url": null,
    "source_filing_date": null
  }
}

A note on the nulls: sic_code, exchange, and state_of_inc are sparsely populated in the index — the search response's meta.source_filing_url is also null because the company record (not a filing) is the source. You'll see that field populated on every financial, insider-trade, and 8-K response.

8,005 SEC-registered issuers are indexed. Search accepts a ticker symbol, a CIK number, or a name fragment. Postgres trigrams handle fuzzy matching — "appel" finds Apple.

Step 2 — Pull the financials

import os
import requests

RAPIDAPI_KEY = os.environ["RAPIDAPI_KEY"]

BASE_URL = "https://filingrail.p.rapidapi.com"
HEADERS = {
    "X-RapidAPI-Key": RAPIDAPI_KEY,
    "X-RapidAPI-Host": "filingrail.p.rapidapi.com",
}

resp = requests.get(
    f"{BASE_URL}/v1/companies/AAPL/financials",
    headers=HEADERS,
    timeout=15,
)
resp.raise_for_status()
body = resp.json()

meta = body["meta"]
print(f"Source filing: {meta['source_filing_url']}")
print(f"Filed:         {meta['source_filing_date']}")

The meta.source_filing_url field is the one worth understanding. It's the direct URL to the SEC filing that produced the data in this response — not a database reference, a live sec.gov link. Every response carries it. If you're building anything where a user might ask "where does this number come from," you have the answer in the response envelope.

Step 3 — Print the headline numbers

def fmt_usd(n):
    if n is None:
        return "—"
    if abs(n) >= 1_000_000_000:
        return f"${n / 1_000_000_000:,.2f}B"
    if abs(n) >= 1_000_000:
        return f"${n / 1_000_000:,.2f}M"
    return f"${n:,.0f}"

for statement in body["data"]:
    stype  = statement["statement_type"]
    period = statement["period_end"]
    items  = statement["line_items"]

    print(f"\n--- {stype} ({period}) ---")

    if stype == "income_statement":
        print(f"  Revenue:          {fmt_usd(items.get('revenue'))}")
        print(f"  Operating income: {fmt_usd(items.get('operating_income'))}")
        print(f"  Net income:       {fmt_usd(items.get('net_income'))}")
        print(f"  Diluted EPS:      {items.get('eps_diluted', '—')}")

    elif stype == "balance_sheet":
        print(f"  Total assets:     {fmt_usd(items.get('total_assets'))}")
        print(f"  Cash + equiv.:    {fmt_usd(items.get('cash_and_equivalents'))}")
        print(f"  Long-term debt:   {fmt_usd(items.get('long_term_debt'))}")

    elif stype == "cash_flow":
        print(f"  Operating CF:     {fmt_usd(items.get('operating_cash_flow'))}")
        print(f"  Capex:            {fmt_usd(items.get('capex'))}")

Three statements, headline fields, source filing URL. Swap AAPL for MSFT, NVDA, BRK-B, or any of the 8,005 tickers in the index.

What the response shape looks like

/v1/companies/{ticker}/financials returns the most recent 10-K or 10-Q filing. The data is backed by 1.85M+ rows of XBRL-normalized financial data going back to 2006.

The ~30 canonical fields per statement are normalized across the multi-tag drift that makes raw XBRL painful. The same economic concept — revenue, for instance — gets tagged as us-gaap:Revenues, us-gaap:SalesRevenueNet, or us-gaap:RevenueFromContractWithCustomerExcludingAssessedTax depending on the filer and the year. Filingrail resolves that before it reaches your response.

Getting historical quarters

/financials/history returns a time series. Up to 20 periods per call (roughly 5 years quarterly):

resp = requests.get(
    f"{BASE_URL}/v1/companies/AAPL/financials/history",
    params={"period": "Q", "limit": 8},
    headers=HEADERS,
    timeout=15,
)
history = resp.json()

for entry in history["data"]:
    if entry["statement_type"] != "income_statement":
        continue
    items = entry["line_items"]
    print(f"{entry['period_end']}  revenue={fmt_usd(items.get('revenue'))}")

Monitoring the filings stream

If you want to watch what a company files — rather than pull normalized data — use /v1/filings/recent. 237,000+ filings indexed, filterable by CIK, form type, or date range:

# Most recent filings for Apple, 10-Ks only
curl "https://filingrail.p.rapidapi.com/v1/filings/recent?cik=320193&form_type=10-K&limit=5" \
  -H "X-RapidAPI-Key: $RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: filingrail.p.rapidapi.com"

Each record includes the filing date, accession number, and a filing_url pointing directly to the document on sec.gov. The same source-traceability, just at the filing level rather than the data level.

What this is not

Honest caveats, because senior developers will ask:

Not real-time. New filings appear within ~24 hours of EDGAR acceptance. Sub-minute polling would violate EDGAR's fair-access policy.
Not Bloomberg. No intraday prices, no options chains, no non-US issuers, no analyst estimates.
Not a research platform. No AI summaries, no commentary. Structured data from SEC filings, traced back to source.
Not a replacement for EdgarTools if you're already running your own pipeline. EdgarTools is excellent and free. Filingrail is the option for developers who'd rather pay $9/month than maintain the plumbing.

The other endpoints

Beyond financials, v1.0 includes:

Endpoint	Data	Volume
`/v1/companies/{ticker}/insider-trades`	Form 4 transactions	63,000+ rows, daily refresh
`/v1/companies/{ticker}/8k-events`	Material events with SEC item codes (1.01, 2.01, 5.02, etc.)	7,500+ rows, daily refresh
`/v1/institutions/{cik}/13f-holdings`	Form 13F positions in whole-dollar USD	222,019 holdings across 66 managers incl. Berkshire Hathaway

meta.source_filing_url is present on every response across all endpoints.

Pricing

Free tier: 50 calls/day, no credit card. Subscribe on the RapidAPI listing and get your key within seconds.

Tier	Price	Calls/month
Free	$0	1,500 (50/day)
Pro	$9/mo	5,000
Ultra	$49/mo	50,000
Mega	$199/mo	500,000

RapidAPI handles auth — every call needs X-RapidAPI-Key and X-RapidAPI-Host: filingrail.p.rapidapi.com. That's the full auth story.

Questions or issues

support@hudsonenterprisesllc.com — same-business-day response. Include the endpoint, parameters, and error response if applicable.

Built by Hudson Enterprises LLC, an Indiana software studio.

DEV Community: Hudson Enterprises

Query SEC filings from inside Claude Desktop — Filingrail is now MCP-enabled

Two ways to wire it in

Setup — the pip install path

What you can ask once it's wired in

The meta.source_filing_url field

Honest limits

Why this is a different abstraction

What's next on the MCP side

Pricing

I built a browser extension that exports any web table to CSV, Excel, or Markdown — processed entirely on your device

How it works

Three file formats — why each one

What it handles — and what it doesn't

The trial and price

What I learned building it

Try it

I built a color picker with one permission — because a Featured one got caught exfiltrating visited URLs

One permission. Here's the manifest

How the eyedropper actually works

The WCAG contrast checker

What I'm launching

On the permission question

I built a PDF editor that runs entirely in your browser — no upload, no account, $9 once

What runs where

What it does

Why not just a desktop app

Where to get it

Screen a name against the OFAC sanctions list in 3 lines (REST API, free tier)

Before you integrate: what this is and isn't

Step 1 — Set up

Step 2 — The 3-line version

Step 3 — Read the response

Step 4 — Understand the parameters

Step 5 — Screen a batch of names

Step 6 — Look up a full entity record

Step 7 — Check list freshness

What this is not

Pricing

Questions or issues

Find catastrophic-backtracking regexes before they ship (free checker + API)

What catastrophic backtracking actually is

Step 0 — Try the free checker

Step 1 — Set up the API

Step 2 — Scan one pattern

Step 3 — Add dynamic timing (optional, deeper)

Step 4 — Wire it into a CI gate

Step 5 — Validate against the known-evil corpus

What this is not

Pricing

Questions or issues

Pull any public company's SEC financials in 3 lines of Python (with source filing URL)

What you need

Step 1 — Resolve a ticker to its SEC CIK

Step 2 — Pull the financials

Step 3 — Print the headline numbers

What the response shape looks like

Getting historical quarters

Monitoring the filings stream

What this is not

The other endpoints

Pricing

Questions or issues

Setup — the `pip install` path

The `meta.source_filing_url` field