Reproduce the anonymous Synoptic SEC MCP check

Observed results

The response describes the SEC stream as NO DELAY. This is the publisher’s catalog label, not a timing measurement. Its description says package-only while the structured packageOnly flag was false; the probe cannot resolve the current commercial access policy.

Run the public calls yourself

Save the following as reproduce_mcp.py and run it with Python 3.10 or later. It uses the standard library, sends no authorization header and performs only public reads. Network policy or server changes may produce different results.

The script reproduces the request sequence used for the saved evidence; the original responses were captured with direct HTTP requests. It uses the server-compatible protocol version observed in that run rather than asserting it is the newest MCP version.

"""Read-only anonymous probe; python3 reproduce_mcp.py. No credentials needed."""
import json
from urllib.request import Request, urlopen

URL = "https://mcp.api.synoptic.com/mcp"

def rpc(identifier, method, params):
    payload = {"jsonrpc": "2.0", "id": identifier, "method": method, "params": params}
    request = Request(URL, data=json.dumps(payload).encode(), headers={"Content-Type": "application/json", "Accept": "application/json, text/event-stream"})
    with urlopen(request, timeout=45) as response:
        return {"http_status": response.status, "response": json.load(response)}

if __name__ == "__main__":
    calls = [
        (1, "initialize", {"protocolVersion": "2025-03-26", "capabilities": {}, "clientInfo": {"name": "synoptic-public-verification", "version": "1.0"}}),
        (2, "tools/list", {}),
        (3, "tools/call", {"name": "search", "arguments": {"query": "SEC", "limit": 10}}),
        (4, "tools/call", {"name": "get_stream", "arguments": {"id": "01JSPH2HZMMND30770DECW091Q"}}),
    ]
    for identifier, method, params in calls:
        print(json.dumps({"method": method, "params": params, **rpc(identifier, method, params)}))

The matching request sequence was actually run through direct HTTP calls on 2026-11-14. This script is provided for reproduction; it prints public metadata and requires no account credentials.

Inspect both transport and tool errors

HTTP 200 is not sufficient proof that an MCP tool succeeded. Inspect the JSON-RPC error and, for tools/call, the tool result’s isError flag as well. A public search returning no items is a different result from an authorization error.

Record the request arguments, HTTP status and full public response for each case. Avoid recording OAuth tokens, API keys, private posts or the user’s unrelated assistant conversation. The evidence retained for this check contains anonymous public metadata and the unauthenticated error.

What this test leaves open

It did not authenticate, fetch subscriber posts, connect a WebSocket, read an original filing document or evaluate an AI answer. It also did not establish latency, replay completeness, retention or coverage across forms. Those require a permitted account test and a separate acceptance plan.