
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@evidinvest/aether-mcp
Advanced tools
Aether MCP Server — financial-vertical agent search engine. Hybrid SEC filings (10-K/10-Q/8-K) + earnings transcripts retrieval over 1.4M+ chunks, plus a two-sided marketplace for third-party data. Tools: financial_search, transcript_search, list_partners
@evidinvest/aether-mcpStdio MCP server for Aether. One-line install for Claude Desktop, Cursor, Cline, Continue — anything that spawns an MCP server as a subprocess over stdio.
Aether is a financial-vertical agent search engine + marketplace: hybrid SEC filings + earnings-transcript retrieval over 1.4M+ chunks, plus a two-sided marketplace for third-party data. Production endpoint:
https://api.aether.evidinvest.com/mcp(HTTP MCP).
This package wraps that HTTP endpoint so MCP clients that only speak stdio can still use it.
# No install needed — runs straight from npx:
npx -y @evidinvest/aether-mcp
# Or install globally for slightly faster startup:
npm install -g @evidinvest/aether-mcp
aether-mcp
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"aether": {
"command": "npx",
"args": ["-y", "@evidinvest/aether-mcp"]
}
}
}
For higher rate limits + paid marketplace access, add your Aether API key:
{
"mcpServers": {
"aether": {
"command": "npx",
"args": ["-y", "@evidinvest/aether-mcp"],
"env": {
"AETHER_API_KEY": "aether_ak_…"
}
}
}
}
.cursor/mcp.json in your workspace, or ~/.cursor/mcp.json globally:
{
"mcpServers": {
"aether": {
"command": "npx",
"args": ["-y", "@evidinvest/aether-mcp"]
}
}
}
Any client that supports MCP stdio servers takes the same shape — name, command, args, optional env.
Auto-discovered on startup from https://api.aether.evidinvest.com/v1/tools:
| Tool | Purpose |
|---|---|
financial_search | Hybrid SEC filing retrieval (BM25 + 256-d arctic-embed + cross-encoder rerank) |
transcript_search | Earnings-call transcript segment search |
list_partners | List marketplace sellers + per-call prices |
partner_search | Search a partner's indexed corpus (Mode A, free) |
partner_proxy_search | Route query to partner's API server-to-server (Mode B, per-call paid) |
seller_signup | Register as a marketplace seller |
seller_publish_document | Publish a document into Aether's index |
seller_register_endpoint | Register a proxy endpoint |
seller_list_my_documents | List own documents |
seller_list_my_endpoints | List own endpoints |
| Variable | Default | Effect |
|---|---|---|
AETHER_BASE_URL | https://api.aether.evidinvest.com | Override for local dev (http://localhost:8787) or staging |
AETHER_API_KEY | (empty) | If set, attached as Authorization: Bearer <key> to every tool call. Use a seller key (aether_sk_…) for seller actions OR an agent key (aether_ak_…) for higher search rate limits + paid proxy access. |
{
echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"0.0"}}}'
sleep 0.2
echo '{"jsonrpc":"2.0","method":"notifications/initialized"}'
sleep 0.2
echo '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'
sleep 1
} | npx -y @evidinvest/aether-mcp
Expected: handshake reply on stdout, plus a tools/list response with 10 tool definitions.
MCP client (Claude Desktop / Cursor / Cline)
│ JSON-RPC over stdio
▼
@evidinvest/aether-mcp (this package, Node)
│ HTTP MCP (REST-shaped, /v1/tools/<name>)
│ optionally with `Authorization: Bearer …`
▼
Aether HTTP MCP @ api.aether.evidinvest.com/mcp
│
├──► Vespa (filing_chunk + transcript_segment + partner_document)
├──► Embedder + reranker (GPU service)
└──► Postgres (sellers, agents, marketplace state)
Tool defs are discovered once on startup; any new tools added upstream show up after restart without releasing a new npm version.
Apache-2.0. Source: https://github.com/EBD-Sweden/agentsearch/tree/main/clients/npm-mcp
FAQs
Aether MCP Server — the search engine whose user is an agent. Search results aren't pages for humans: they're pre-processed, citation-complete payloads (exact SEC section text, form type, filing date, accession-numbered citation, sec.gov source URL, confi
The npm package @evidinvest/aether-mcp receives a total of 42 weekly downloads. As such, @evidinvest/aether-mcp popularity was classified as not popular.
We found that @evidinvest/aether-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.