
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
alternativespe-mcp
Advanced tools
MCP server for the Alternatives Partner API v3 (altdmp.io) — private-market data across Southeast Asia
An MCP server for the Alternatives Partner API v3 (altdmp.io) — read-only programmatic access to private-market data across Southeast Asia (funded companies, investors, funds, people, service providers).
all/any/not + operators), plus search, ordering, limit, offset.| Tool | Endpoint | Description |
|---|---|---|
search_capital_receivers | POST /capital-receivers/ | Funded companies / startups |
get_capital_receiver | GET /capital-receivers/{uuid}/ | Company detail: financials, cap table, investors, deals, news |
search_capital_allocators | POST /capital-allocators/ | Investors (VC/PE, corporates, family offices) |
get_capital_allocator | GET /capital-allocators/{uuid}/ | Investor detail: investments, AUM, commitments, funds, news |
search_funds | POST /funds/ | Funds (Atlas tier) |
get_fund | GET /funds/{uuid}/ | Fund detail: performance, AUM, commitments, investments |
search_people | POST /people/ | Founders, directors, executives |
get_person | GET /people/{uuid}/ | Person detail: roles, investments, news |
search_service_providers | POST /service-providers/ | Auditors, legal & professional services |
search_investors | POST /investors/ | Cross-entity investor discovery |
get_reference_data | GET /reference-data/ | Enums, countries, industries, themes |
npm install
npm run build
Set your API key (obtain credentials from support@alternatives.pe):
export ALTDMP_API_KEY=your_api_key_here
Add to your MCP config (e.g. claude_desktop_config.json):
{
"mcpServers": {
"alternativespe": {
"command": "node",
"args": ["/absolute/path/to/alternativespe-mcp/dist/index.js"],
"env": {
"ALTDMP_API_KEY": "your_api_key_here"
}
}
}
}
Or, for local development without building:
{
"mcpServers": {
"alternativespe": {
"command": "npx",
"args": ["tsx", "/absolute/path/to/alternativespe-mcp/src/index.ts"],
"env": { "ALTDMP_API_KEY": "your_api_key_here" }
}
}
}
filters is forwarded verbatim as the API's filters body. Combine logical groups with conditions:
{
"filters": {
"all": [
{ "op": "eq", "field": "domicile_country_iso_alpha3", "value": "SGP" },
{ "op": "gte", "field": "latest_valuation_usd", "value": 50000000 },
{ "any": [
{ "op": "eq", "field": "is_raising_now", "value": true },
{ "op": "in", "field": "themes_keys", "value": ["themes_payments"] }
]}
]
},
"limit": 50,
"ordering": "-latest_valuation_usd"
}
Operators: eq, in (array), gt, gte, lt, lte, range (2-element array), contains, isnull.
Logical groups: all (AND), any (OR), not (negate).
Use get_reference_data to discover valid field enum values.
| Variable | Required | Default | Description |
|---|---|---|---|
ALTDMP_API_KEY | yes | — | Your Alternatives Partner API key |
ALTDMP_BASE_URL | no | https://api.altdmp.io/v3 | API base URL override |
Both npm and the MCP Registry publish via OIDC — no long-lived tokens are stored in this repo.
Automated publishing uses npm Trusted Publishing: GitHub Actions authenticates to npm over short-lived OIDC and provenance is generated automatically — no NPM_TOKEN.
One-time setup on npmjs.com (after the first version exists — see bootstrapping below): package Settings → Trusted Publisher → GitHub Actions, set:
| Field | Value |
|---|---|
| Organization / user | luarss |
| Repository | alternativespe-mcp |
| Workflow filename | publish-mcp-registry.yml |
| Environment | release |
Bootstrapping: a trusted publisher can only be configured once the package already exists, so the very first version must be published manually — npm publish --access public locally — then configure the trusted publisher for all subsequent releases.
server.json is published to the official MCP Registry via the mcp-publisher CLI using GitHub OIDC (mcp-publisher login github-oidc) — also tokenless.
Pushing a v* tag (e.g. git tag v0.1.0 && git push origin v0.1.0) triggers .github/workflows/publish-mcp-registry.yml. The job runs in the protected release GitHub environment (required reviewer + v*-tags-only), so a publish waits for manual approval, then publishes to npm (OIDC) and syncs server.json's version to the tag before publishing it to the registry (OIDC).
MIT
FAQs
MCP server for the Alternatives Partner API v3 (altdmp.io) — private-market data across Southeast Asia
We found that alternativespe-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.