Skip to main content
SEC API’s hosted MCP endpoint is https://api.secapi.ai/mcp. GET /mcp is public discovery metadata. Authenticated POST JSON-RPC requests, including tool calls, use an API key in x-api-key; keep that key in the client process environment, not in a prompt, URL, or repository.

​
Add the API key

Create a key in the signed-in dashboard, then expose it to the client process:

​
Configure Claude Code

Restart the client after changing its environment or configuration.

​
Read the public discovery metadata

GET /mcp is public and returns the deployed server’s connection metadata and install guidance. It does not verify an API key or authorize a tool call.
For supported client configuration, the CLI can generate the appropriate setup:
For clients that accept portable remote HTTP MCP configuration, use their supported environment-variable syntax for this shape:

​
Make authenticated tool calls through the client

After the client has the API key, ask it to discover the current catalog before it makes an authenticated tool call:
tools.search and tools.describe are SEC API tools, not JSON-RPC methods. The MCP client invokes them through authenticated POST JSON-RPC tools/call requests. Treat structured output and returned identifiers as the source record; provenance, freshness, truncation, and trace context are available only when the selected tool returns them.

​
Repair a failed connection

  • No tools appear: reload configuration and confirm that SECAPI_API_KEY is visible to the client process.
  • 401 or 403: repair or rotate the API key. Do not substitute a browser bearer token.
  • JSON-RPC validation error: send one JSON-RPC 2.0 request object with the required request ID. Batch requests are not supported.
  • Validation, billing, quota, or timeout result: retain the returned request ID, narrow the next call, and follow the response instead of replaying a broad job.
Continue with MCP workflows for evidence retention and production use, or request diagnostics for a failing request.