An automated SEC filing alert monitors the EDGAR feed for specific filing types, filters by your criteria, and surfaces only what needs attention. With Shibui Finance's MCP server, Claude checks 6.4 million SEC filings and insider transactions directly. You describe what matters in English, schedule the check to run daily or weekly, and get a filtered report with no manual triage.
This guide covers four alert types: daily 8-K material event triage, insider cluster buying detection, 13D activist position alerts, and watchlist-based filing monitors. Each includes the prompt, the scheduling command, and how to handle deduplication so you only see new filings. For connection setup, see the connection guide. For scheduling details, see the scheduling section.
What you can monitor
8-K material events
Leadership changes, agreement terminations, restatements, asset impairments, and triggering events. Filter by item code and market cap.
Insider buying clusters
Three or more insiders buying open-market shares within the same 30-day window. Signal flags filter out 10b5-1 plans, tax withholding, and gifts.
13D activist positions
New positions above 5% from 38 verified activist groups including Elliott, Icahn, Starboard, and Third Point. Entity resolution matches filings across CIK variants.
Watchlist filing activity
Any new filing for your ticker list: 8-Ks, Form 4 insider trades, 13D positions, 10-Q earnings, and proxy statements in one daily check.
For background on what each form type contains, see the SEC Filings hub. For the full insider transaction methodology, see the insider trading tracker guide. For a line-by-line walkthrough of Form 4 fields, see how to read Form 4. For 13D vs 13G, see the 13D and 13G filing guide.
How to set up a daily 8-K triage alert
8-K filings report material events: a CEO departure, a terminated contract, an accounting restatement, an asset write-down. Hundreds are filed every day. Most are routine. The alert below filters to the five high-signal item codes and limits results to companies above $500M market cap.
"Check for 8-K filings filed yesterday where the company has a market cap above $500M. Filter to item codes 5.02 (departure of directors or principal officers), 1.02 (termination of a material agreement), 4.02 (non-reliance on previously issued financial statements), 2.04 (triggering events that accelerate obligations), and 2.05 (costs associated with exit or disposal). For each, show the company name, ticker, market cap, item code with description, filing date, and the EDGAR filing link. Return as JSON."
The key to deduplication is the date filter. By checking filings from
yesterday only (filing_date >= CURRENT_DATE - 1), each daily
run surfaces only new events. If you run the alert on Monday morning, widen
the window to 3 days to catch weekend filings.
Schedule it with cron:
# Run at 7:00 AM ET every weekday
0 11 * * 1-5 claude -p "$(cat ~/alerts/8k-triage.txt)" \
--allowedTools 'mcp__shibui-finance__*' \
> ~/alerts/output/8k-$(date +\%Y-\%m-\%d).json 2>&1
Save the prompt to a text file (~/alerts/8k-triage.txt) so you
can version it independently of the cron schedule. For scheduling alternatives
including Claude Code /schedule, see the
scheduling guide.
How to detect insider cluster buying automatically
A single insider buying shares is noise. Three or more insiders buying open-market shares at the same company within a 30-day window is a signal. The prompt below runs daily and surfaces only new clusters, filtering out the common false positives: pre-arranged 10b5-1 plans, tax withholding on vesting, gifts, and estate transfers.
"Find companies where 3 or more different insiders made discretionary open-market purchases (transaction code P) in the last 14 days. Exclude transactions flagged as 10b5-1, tax withholding, gifts, or estate transfers. For each company, show the ticker, company name, number of distinct buyers, each insider's name and purchase date, total dollar value of all purchases combined, and the current stock price vs. 200-day SMA. Return as JSON."
The 14-day window catches clusters forming in the current period. Extend it to 30 days for a broader view. The 200-day SMA cross-reference adds context: insiders buying while the stock is below its long-term average is a stronger signal than buying into an uptrend.
For the full cluster buying methodology, transaction codes, and noise filtering flags, see the insider trading tracker guide. For details on which signal flags to filter when separating routine selling from meaningful patterns, see the insider selling signals guide. For interactive insider screening without scheduling, see insider buying stocks.
How to set up 13D activist position alerts
When an investor acquires more than 5% of a company's shares with the intent to influence management, they file a Schedule 13D. Shibui indexes 335,000+ of these filings and includes an entity resolution layer that identifies 38 verified activist groups by canonical name.
"Find Schedule 13D filings from the last 7 days where the target company has a market cap above $1B. For each, show the target company ticker and name, the filer's canonical name, whether the filer is a known activist (and which activist group), the filing date, and the EDGAR link. If the filer is from the verified activist list, also show the stock price change in the 5 trading days after the filing date. Return as JSON."
Run this weekly rather than daily. New 13D filings are less frequent than 8-Ks or Form 4s, and the analysis (price change after filing) benefits from a few days of post-filing data.
For the full 13D vs 13G distinction and how to track activists across companies, see the 13D and 13G guide.
How to monitor filings for your watchlist
The alerts above scan the full market. This one scopes to your ticker list and checks for any new filing, regardless of form type. If a company on your watchlist files an 8-K, a Form 4, a 13D, or a 10-Q, it shows up.
"Check if any of these companies filed anything with the SEC yesterday: AAPL, MSFT, NVDA, GOOGL, AMZN, META, JPM, UNH, XOM, JNJ. For each filing found, show the ticker, form type, filing date, a one-line description of what that form type means, and the EDGAR filing link. If a Form 4 was filed, also show the insider name, transaction type, and dollar value. Return as JSON."
For larger watchlists, save the ticker list in a file and reference it in the prompt, the same approach described in the portfolio monitoring guide. This keeps the prompt short and makes the watchlist easy to update.
Free, no API key, works on all Claude plans.
Connect now →Building a combined overnight SEC report
Instead of running three separate alerts, you can combine them into a single prompt that produces one structured report with three sections. One scheduled task, one output file, all SEC activity that matters.
"Run three SEC checks and combine the results into one JSON report with three sections: Section 1 - 8K_EVENTS: 8-K filings from yesterday where company market cap is above $500M, filtered to item codes 5.02, 1.02, 4.02, 2.04, 2.05. Include ticker, company name, market cap, item code, item description, and EDGAR link. Section 2 - INSIDER_CLUSTERS: Companies where 3+ different insiders made discretionary open-market purchases in the last 14 days. Exclude 10b5-1, tax withholding, gifts, and estate transfers. Include ticker, company name, buyer count, insider names, total dollar value, and current RSI. Section 3 - ACTIVIST_POSITIONS: Schedule 13D filings from the last 7 days targeting companies above $1B market cap. Include target ticker, target name, filer name, activist group (if known), filing date, and EDGAR link. If a section has no results, return an empty array for that section."
The empty-array instruction prevents Claude from generating explanatory text when a section has no hits. Schedule this to run before market open and pipe the JSON to a file:
# Combined overnight SEC report, 6:30 AM ET weekdays
30 10 * * 1-5 claude -p "$(cat ~/alerts/sec-overnight.txt)" \
--allowedTools 'mcp__shibui-finance__*' \
> ~/alerts/output/sec-overnight-$(date +\%Y-\%m-\%d).json 2>&1For output format control, structured JSON patterns, and error handling for unattended runs, see the output format guide and error handling section.
How it compares to other filing alert tools
SEC EDGAR itself offers free email alerts, and tools like OpenInsider and WhaleWisdom track subsets of filing activity. The comparison below covers what each tool monitors, how you filter results, and what it costs.
| Feature | Shibui MCP | SEC EDGAR Alerts | OpenInsider | WhaleWisdom | Finviz |
|---|---|---|---|---|---|
| Price | Free | Free | Free | $50-200/mo | Free / $24.96/mo |
| Form types | 3/4/5, 8-K, 10-K/Q, 13D/G, S-1 + 337 more | 3/4/5, 8-K, 10-K/Q, 13D/G, S-1 + all | Form 4 only | 13F, 13D/G | Form 4 only |
| Custom filters | Any criteria in English | Form type + CIK only | Preset filters | Preset filters | Preset filters |
| Cluster detection | Yes (multi-insider, configurable window) | No | No | No | No |
| Activist tracking | 38 verified groups with entity resolution | No | No | Yes (13F quarterly) | No |
| Cross-reference with fundamentals | Yes (market cap, P/E, RSI, SMA) | No | No | No | Limited |
| Natural language | Full | None | None | None | None |
| Scheduling | Cron or /schedule | Email alerts | No | Email alerts | Email alerts |
SEC EDGAR email alerts cover all form types but only filter by CIK (company) and form type. You cannot filter by market cap, item code, or combine with fundamentals. OpenInsider is excellent for browsing recent Form 4 filings but has no cluster detection, no scheduling, and no cross-referencing. WhaleWisdom tracks institutional holders via quarterly 13F filings, not the real-time 13D positions that Shibui indexes.
Limitations: Shibui indexes SEC filing metadata, not full-text content. You can see that a company filed an 8-K with item code 5.02 (leadership change), but you cannot read the 8-K document itself. Use the EDGAR filing link in the results to read the actual document. Price data for cross-referencing is end-of-day US equities only. Full coverage details on the data sources page. This is a data tool, not financial advice.
Frequently asked questions
Can Claude monitor SEC filings automatically?
Yes. Connect Shibui Finance via MCP and schedule a filing-check prompt to run daily or weekly. Claude queries 6.4 million SEC filings and insider transactions directly. You define what matters in English: form types, market cap thresholds, insider buying patterns, and activist positions. See the scheduling guide for the full setup.
How do I get alerted to insider buying?
Schedule a daily prompt that checks for new Form 4 open-market purchases. Filter to cluster buying (3+ insiders buying within 30 days), exclude noise (10b5-1 plans, tax withholding, gifts), and cross-reference with fundamentals. The cluster buying alert section above shows the exact prompt.
Does Shibui track activist investors like Elliott or Icahn?
Yes. Shibui includes 335,000+ Schedule 13D and 13G filings with an entity resolution layer that identifies 38 verified activist groups by canonical name. You can query by activist name, track new positions, and cross-reference with stock price changes after the filing date. See the 13D and 13G guide for the full methodology.
What SEC filing types can I set alerts for?
All 342 form types indexed by EDGAR: Forms 3/4/5 (insider transactions), 8-K (material events with item codes), 10-K and 10-Q (annual and quarterly reports), Schedules 13D/13G (major holders), S-1 (IPO registrations), DEF 14A (proxy statements), and more. The full list is on the SEC filings hub.
Does this work with ChatGPT or only Claude?
It works with any MCP-compatible client, including ChatGPT, Claude, Claude
Code, Codex, and custom agents. Connect via streamable HTTP transport to
mcp.shibui.finance/mcp. The same alert prompts work across
all clients.
How often does Shibui update SEC filing data?
The SEC EDGAR filing feed updates every 5 minutes. Insider transactions are parsed from Forms 3/4/5 on the same schedule. Prices, technicals, and valuations update daily after market close. For daily alerts, the data is current enough that a morning run catches everything filed the previous day.