• what you need
• install
• call the tool
• why this matters
• extending the recipe
• free tier limits
• one common failure mode

a quick recipe. the goal: when a sitting director or officer at a public company files a buy in their own stock and 2 other insiders at the same issuer file inside the next 24 hours, your MCP-connected coding agent learns about it the next time you ask. no manual scraping of SEC filings. no broker terminal.

this is what insider_buy_clusters does inside the falsifylab alpha MCP. 5 minutes of setup. free tier returns 5 results per query, no signup.

§what you need

• an MCP-compatible coding agent (Cursor, Cline, Windsurf, or similar)

• python 3.10+

• 5 minutes

§install

pip install falsifylab-alpha-mcp==0.3.2then add this to your agent’s MCP config. config path varies by client; the shape is the same:

{ "mcpServers": { "falsifylab-alpha": { "command": "python", "args": ["-m", "falsifylab_alpha_mcp"] } } }restart your client. the MCP loads. no key needed for free tier.

§call the tool

in your coding agent, type a question. the agent picks the tool:

who’s been buying at the company level in the last 24 hours, 3 or more filers same issuer

agent calls insider_buy_clusters with default args. the tool returns up to 5 clusters on the free tier, ranked by total dollar size of insider buys inside the cluster window.

what the response looks like:

{ "clusters": [ { "ticker": "xyz", "issuer": "Sample Industries", "cluster_size": 4, "filers": ["director.a", "officer.b", "director.c", "officer.d"], "first_filing_utc": "2026-05-21T15:42:00Z", "last_filing_utc": "2026-05-22T09:18:00Z", "total_shares_bought": 18450, "total_dollars": 821400, "cluster_density": "high" } ], "as_of": "2026-05-22T10:00:00Z", "tier": "free", "remaining_quota_today": 9 }your agent can iterate this. ask it for the cluster density distribution. ask it to filter for clusters above a dollar threshold. it has the data.

§why this matters

a single insider buy is noise. one director picking up a few thousand shares is routine. it can mean nothing.

a cluster of 3 or more separate filers buying the same issuer inside 24 hours is signal. it means multiple people with separate fiduciary exposure made the same decision in the same short window. they have access to the same internal data. they bet on the same outcome.

academic work on this goes back at least two decades. Cohen, Malloy, Pomorski (2012) showed that insider transactions filtered for “opportunistic” trades (excluding routine option-exercise sells) produced abnormal returns. the cluster filter is a different kind of selectivity. it does not depend on classifying the trade as opportunistic. it depends on multiple people choosing to file inside a window.

the noise problem is amendment. form 4 has an amendment cycle. a filing made on date T can be amended on date T+N. databases that show “all form 4s as of date T” by querying their state at date T+N show amendments that did not exist at date T. backtests built on this data overestimate edge by a non-trivial amount on names with heavy amendment activity. the insider_buy_clusters tool runs amendment deduplication against the as-of snapshot at request time. you see clusters that actually existed when they actually existed.

§extending the recipe

once the tool is live in your agent, you have other tools to combine with:

• confluence_today (Pro plan $19/mo) returns assets where 2 or more independent signal sources align in the same window. an insider cluster plus an ETF flow outlier plus a polymarket whale position change on the same ticker the same session is a different information density than any one of them alone.

• sec8k_material_today returns same-day 8-K filings filtered to the material item codes (1.01, 2.02, 5.02, 8.01). pair with an insider cluster on the same name and you get the filing context for why the insiders moved.

• etf_flow_today returns the US spot crypto ETF aggregate flows. less relevant for single-name equity clusters, but useful when the cluster is a name with exposure to a macro flow surface.

these are calls. the agent decides when to make them based on the conversation. you do not have to wire pipelines manually.

§free tier limits

• 5 results per query

• 60 requests per hour

• 24h cache lag

free tier is enough to confirm the data is real and to use it in research workflows where 24-hour latency does not matter. real-time refresh and the Pro-only confluence_today live at $19/mo. webhooks for push delivery sit at $49/mo.

§one common failure mode

the free tier serves cached data with up to 24-hour latency. if your agent loop depends on calling the tool inside an action window measured in hours, the cache lag will kill the edge. for that case the Pro refresh interval is the minimum useful tier. measure your action latency requirement before picking a tier. that is the size of question that decides whether the gate is at the right place for your workflow.

pip install falsifylab-alpha-mcp==0.3.2falsifylab.com/pro

research and educational content only. not investment, legal, or tax advice. do your own research.

#OnchainAlpha #BTCFlow #ETHFlow

Originally published on FalsifyLab Substack.