Alphanume Datasets

Cyber Incident 8-Ks

get_cyber_incidents

Read-onlyIdempotent

Material cybersecurity incidents: every Form 8-K filed under Item 1.05 (the SEC cyber-disclosure rule, live since 2023-12-18) plus its 8-K/A amendments -- the entire population, ~80 filings and growing. One row per filing, with FOUR distinct date roles kept rigorously separate: incident discovered, materiality determined (both extracted from prose, with day/month/quarter precision enums), disclosed and amended (both structural EDGAR dates, never model-guessed) -- plus the intervals between them (investigation time, compliance-clock time, total latency).

Flags are three-state: 1 = filing says yes, 0 = filing says no, NULL = filing does not say -- never collapsed. Amendments are separate rows linked to their original (original_accession_number, days_original_to_amendment); an incident with three 8-K/As is four rows. materiality_determined_date is sparse (~15% fill) because most filings simply do not state one. days_determination_to_disclosure is CALENDAR days; the SEC's deadline is four BUSINESS days -- adjust before compliance claims.

Requires an Alphanume Pro API key. A 403 PRO_SUBSCRIPTION_REQUIRED or DATE_RANGE_RESTRICTED error means the key's plan does not cover the request -- it does not mean the data is missing.

Input Schema

TableJSON Schema

Name	Required	Description
`cik`	No	SEC CIK number (digits only) -- the durable issuer key (3 rows have no ticker).
`date`	No	Exact date, YYYY-MM-DD. Cannot be combined with the date range parameters.
`ticker`	No	Ticker symbol filter, e.g. 'AAPL'. Case-insensitive.
`date_gt`	No	Start of date range, exclusive (YYYY-MM-DD).
`date_lt`	No	End of date range, exclusive (YYYY-MM-DD).
`refused`	No	1/0: rows where the labeler declined the filing text (served with NULL extraction fields; the disclosure event is still real).
`date_gte`	No	Start of date range, inclusive (YYYY-MM-DD).
`date_lte`	No	End of date range, inclusive (YYYY-MM-DD).
`max_rows`	No	Maximum data rows to return to the client (applied after the API responds). Default 500. Use 0 for no cap. Prefer narrowing with date/ticker filters over raising this.
`attack_type`	No	One of data-breach, unauthorized-access, ransomware, business-email-compromise, other, unstated.
`cursor_date`	No	Pagination: 'date' from next_cursor (send with cursor_accession).
`amended_flag`	No	1 = originals that were later amended, 0 = originals never amended (NULL on amendment rows themselves).
`is_amendment`	No	1 = 8-K/A amendments only, 0 = original 8-Ks only.
`updated_since`	No	YYYY-MM-DD, on last_updated -- rows touched by the amendment-linkage sweep since this date.
`cursor_accession`	No	Pagination: 'accession_number' from next_cursor (send with cursor_date).
`data_compromised_flag`	No	1/0 three-state flag: filing states data was/was not stolen (unfiltered rows include NULL = filing does not say).
`operations_disrupted_flag`	No	1/0 three-state flag: filing states operations were/were not disrupted.
`third_party_incident_flag`	No	1/0 three-state flag: incident originated at a vendor/third party.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

First observedSep 6, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses critical behavioral traits: flags are three-state and 'never collapsed,' amendments are separate rows linked to originals, materiality_determined_date is sparse (~15% fill), and days_determination_to_disclosure uses calendar days while the SEC deadline uses business days. It also clarifies that a 403 error means plan restrictions, not missing data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but densely informative, with the core population and scope stated first, followed by row semantics, flag behavior, date caveats, and API error interpretation. Every sentence adds necessary operational detail; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 18 parameters, no output schema, and a complex domain, the description is remarkably complete: it explains population size, row-level granularity, date semantics, amendment modeling, sparse fields, calendar-day caveats, required API key, and error interpretation. An agent has enough context to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even with 100% schema coverage, the description adds substantial meaning beyond the parameter list: the four distinct date roles, calendar-versus-business-day adjustment, NULL semantics for three-state flags, amendment linkage fields, and pagination behavior. This directly prevents misinterpretation when using date, flag, and amendment-related parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: retrieving material cybersecurity incidents from every Form 8-K filed under Item 1.05 plus 8-K/A amendments, described as the 'entire population, ~80 filings and growing.' It clearly differentiates the tool from generic SEC-filing siblings by specifying row granularity, date roles, and amendment linkage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: this is the cyber-incident 8-K dataset, with explicit explanatory notes about amendment rows, flag semantics, date calculations, and authentication errors. It does not explicitly name sibling tools or state when to use this tool versus alternatives, so it stops short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Alphanume Datasets tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.2/5.0

Disambiguation4/5

Each tool maps to a distinct dataset, and the descriptions are detailed enough to resolve most ambiguity. A few adjacent pairs (S-1 dilution vs. shelf registrations, IV-HV premium vs. IV rank, FDA votes vs. FDA adverse events) share thematic surface area and could be confused by name alone.

Naming Consistency4/5

The overwhelming majority of tools follow a clean get_<noun_phrase> snake_case pattern. The two exceptions, check_api_status and list_market_cap_tickers, are semantically appropriate utility/companion tools but break the otherwise uniform verb prefix.

Tool Count3/5

At 27 tools, the surface is heavy and spans many unrelated financial domains, making selection and prompt context more expensive. Each tool does earn its place as a distinct dataset, but the server would benefit from some consolidation or a higher-level catalog tool.

Completeness4/5

As a read-only datasets API, the surface is broadly complete: status checking, pagination, and one coverage-map companion exist where needed. Minor gaps include the absence of a global dataset catalog/coverage listing and the lack of companion list tools for most other datasets.

Resources

Need Help?