CompanyLens vs SEC EDGAR APIs

CompanyLens 72

OpenAPI 3.0.4 at api.companylens.io/swagger/v1/swagger.json, behind the Swagger playground linked from the API reference, 20 operations and 55 schemas (25). llms.txt with endpoints, tools and pricing; no Markdown twins of docs pages (7 of 10). Tool descriptions say what each returns and some say when to call it ('use to discover valid jurisdiction slugs before calling other tools'), but llms.txt names four tools (search_entities, get_entity_detail, search_officers, execute_query) and /api/v1 paths that match neither the 16-tool page nor the /v1 paths in the spec, and gives 18 jurisdictions where the site says 19 (11 of 20). 74 parameters, 17 marked required and 12 with enums or schema references (10 of 15). Errors 400, 401, 404, 422, 429, 501 and 503 in the spec, a troubleshooting page, examples pages for REST and MCP and a Postman collection (14 of 15). The path carries v1, but no changelog was found (5 of 15). 25+7+11+10+14+5 = 72.

SEC EDGAR APIs 23

No OpenAPI file or other machine-readable contract is linked from the docs (0). www.sec.gov/llms.txt returns 404 (0). One page describes the four routes in prose, says what each returns and points large pulls to the bulk files, with nothing on response fields (10 of 20). Path patterns state the 10-digit CIK, the taxonomy, the unit form and the three period formats, with no list of allowed values and no response schema (7 of 15). Example URLs are given, with no example response and no error reference (4 of 15). Paths carry no version and no API changelog was found. The page shows a last update of 8 April 2025 (2 of 15). Total 23.

CompanyLens 30

No x402, MPP or L402 (0). Plan prices with query quotas are public on the pricing page and in llms.txt; there is no per-call price outside a plan (10 of 20). REST free tier of 500 queries a month and MCP free tier of 50, both without a card (20). A person signs up in a browser and buys plans through Stripe checkout (0). 0+10+20+0 = 30.

SEC EDGAR APIs 60

No x402, MPP or L402 (0). Free, stated publicly, with nothing to buy (20). No account or card (20). An agent can call with no sign-up, sending only a declared User-Agent (20). Total 60.

CompanyLens 70

16 MCP tools (15), with get_company returning a core profile and get_company_section fetching only officers or owners, and get_company_batch taking up to 20 companies (20 of 25 with 5 added back). page and pageSize up to 100 with a meta total, and jurisdiction and status filters on search (16 of 20). Errors are JSON with a code, message and correlation id, and the troubleshooting table maps 401 causes to fixes (15 of 20). The data surface is GETs; the only delete is deactivating an API key. MCP tool annotations weren't readable without connecting (12 of 20). Few required parameters, but no official SDK, only a Postman collection (7 of 15). 20+16+15+12+7 = 70.

SEC EDGAR APIs 41

No limit, paging or field selection. companyconcept and frames narrow a request to one concept, and submissions use compact column arrays, but Apple's submissions file was 164 KB on the day (8 of 25). No query parameters. Older filings are split into extra files listed with their date ranges, and nothing filters by form or date (6 of 20). Errors are not documented, and a missing path answered 404 with an XML NoSuchKey body (5 of 20). Every route is a GET on a JSON document and safe to retry (15 of 20). A call needs one CIK and no key, but the CIK comes from a separate file, the User-Agent must be set, and no official SDK was found (7 of 15). Total 41.

CompanyLens 41

Closed service with terms dated 8 March 2026 under the laws of England and Wales, which name no legal entity (12 of 30). The privacy policy of 18 March 2026 gives retention by data type (usage logs 90 days, server logs 30 days, account data within 30 days of deletion, payments 7 years, audit logs at least a year) and a GDPR lawful basis for registry personal data, with processors described by type only (22 of 30). No deprecation policy or dated notices found (0 of 20). Servers in the EU, some processors in the United States under SCCs, processor categories listed without names (10 of 20). 12+22+0+10 = 44.

SEC EDGAR APIs 57

Closed government service. The policy says information on sec.gov is public and may be copied or redistributed without permission, and sets the automated access rules (15 of 30). The privacy policy lists what is logged on each visit, says partial IP addresses are published in response to FOIA requests, and links Privacy Impact Assessments and system of records notices. No retention period for access logs is stated (18 of 30). No deprecation policy for the APIs. The policy says its limits may change (2 of 20). Google Analytics, Foresee, Akamai and GovDelivery are named. The Amazon hosting seen in response headers is not, and no data locations are given (8 of 20). Total 43.

CompanyLens 3

Closed service. No changelog, release notes, dated API change or dated docs page was found; the OpenAPI document carries no date and the sitemap no lastmod (0). So no releases in the last 90 days can be counted (0). A contact address and a demo form, with no public tracker or community channel (3 of 15). No official SDK (0). No package to judge (0). 0+0+3+0+0 = 3. The low figure is the checklist's reading of a service with no dated public record, not evidence of neglect.

SEC EDGAR APIs 14

No dated change to the data APIs was found. The docs page shows a last update of 8 April 2025, 549 days before the check (0 of 30). EDGAR News and Announcements carries three posts in the last 90 days (14 August, 14 September and 7 October 2026), all about the filing system and its taxonomies and none about these APIs, so half credit (10 of 20). The SEC publishes webmaster@sec.gov and opendata@sec.gov for feedback and says it gives no technical support for scripted access. No forum or issue tracker was found (4 of 15). No official SDK (0 of 15). No package to judge (0 of 10). Total 14.

CompanyLens 47

REST keys rotate and revoke at once from the dashboard, with a separate sandbox prefix, but carry the whole account with no per-endpoint restrictions. The MCP server uses OAuth through Clerk with dynamic client registration and only openid, profile and email scopes, or long-lived service tokens on Agent plans. No key in the URL (20 of 30). The data surface is read-only; no write actions on registry data (15 of 20). Company names, addresses and officer details are filed by third parties, with no prompt-injection guidance (5 of 15). get_usage and the usage endpoint show plan use; the privacy policy says audit logs are kept at least a year, with no per-call log documented for customers (7 of 15). security.txt answered 403 and no disclosure policy, bug bounty or certification was found (0 of 20). 20+15+5+7+0 = 47.

SEC EDGAR APIs 52

No credential, so there is no secret to leak. The declared User-Agent carries a contact address, not a key (20 of 30). The APIs are read-only (15 of 20). Responses are mostly numbers and filing metadata, with names and descriptions as filers wrote them and no guidance on treating them as untrusted (7 of 15). No account, so no request log or usage view (0 of 15). A Vulnerability Disclosure Policy updated on 21 September 2026 authorises good-faith research, takes reports through a Bugcrowd form and asks for 90 days before disclosure. security.txt returns 404, there is no paid bounty, and no certification was found (10 of 20). Total 52.