
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
whetstone-mcp
Advanced tools
MCP server for U.S. public-records data: business registration (KYB) across 25 states, new business filings, federal watchlist screening (OFAC/BIS/State Dept), and federal awards (USAspending). Powered by the Whetstone actors on Apify.
An MCP server for U.S. public-records data — so AI agents and MCP clients (Claude Desktop, Cursor, etc.) can look up business records, screen names against government watchlists, and pull federal awards directly.
Powered by the Whetstone actors on Apify. All data is official U.S. government public-record data.
| Tool | What it does |
|---|---|
business_search | Official Secretary of State business registration (KYB) across 28 states |
new_business_filings | Newly registered businesses from 16 states, windowed by date |
watchlist_screen | Screen a name against 12 federal watchlists (OFAC, BIS, State Dept) |
federal_awards | A company's federal contracts, grants, and loans (USAspending.gov) |
You need a free Apify API token (apify.com → Settings → API & Integrations). Runs bill to your Apify account under pay-per-result pricing (~$2 per 1,000 result rows; the free tier covers light use).
Add to claude_desktop_config.json:
{
"mcpServers": {
"whetstone": {
"command": "npx",
"args": ["-y", "whetstone-mcp"],
"env": { "APIFY_TOKEN": "apify_api_your_token_here" }
}
}
}
Restart Claude Desktop. The four tools then appear and the agent can call them.
Run the server over stdio:
APIFY_TOKEN=apify_api_... npx -y whetstone-mcp
states subset for
faster, cheaper runs.MIT © Whetstone Tools · support@whetstonetools.com
FAQs
MCP server for U.S. public-records data: business registration (KYB) across 25 states, new business filings, federal watchlist screening (OFAC/BIS/State Dept), and federal awards (USAspending). Powered by the Whetstone actors on Apify.
We found that whetstone-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.