Spring 1998, six MBA students at Cornell ran one equation on Enron's financials and got -1.89 back.
The cutoff for "this company is probably cooking the books" is -2.22. Enron was past it. And again, these were students, not some forensic accounting shop.
They stuck the report up on the school website. The whole street still had Enron rated buy around then, and most of them kept it there until a few weeks before it went to zero.
It was a public filing anyone could've pulled and one formula that takes maybe 20 minutes by hand. That's the whole thing I'm about to walk you through, except you'll run it in seconds and you can point it at any company or token on earth.
Not financial advice, do your own research. Forensic scores are probability flags not proof, and every price in here changes so verify before you commit. I build tooling for professional prediction market traders @coldvisionXYZ
L0: Data House
Every public company in the US files with the SEC, and the SEC just hands it all over through an API called EDGAR. You hit a URL and get back every number a company ever reported, already structured.
2 things make EDGAR a weapon:
- Full text search. It indexes the actual text of every filing ever submitted, so you can search a phrase like "material weakness" across the entire market and pull back every company that just quietly admitted its accounting controls are broken. That's a short watchlist in about one second.
- Structured financials. Every line item, every quarter, machine readable, going back years.
edgartools is the one you want.
Pip install, no key, and it parses 10-Ks, 8-Ks, insider Form 4s, 13F fund holdings, all of it into clean Python objects.
It ships an MCP server too, so you can point Claude right at it and go "compare Apple and Microsoft revenue growth over 3 years" and it actually goes and grabs the real filings instead of making up numbers that sound right.
sec-edgar-downloader is the one everybody finds first. It just downloads the raw filing and dumps you into a pile of HTML to parse yourself. That was the move a few years ago, now it's just pain. Use edgartools.
BamSEC if you only want to read filings without EDGAR's interface from 1998. Clean reader, side by side compare, free for most of what you need. Good for eyeballing.
Now u got free structured access to every public company's books.
L1 - Catch Liars
You've got the numbers. Before you read a single sentence of management talking about their "transformational year," you run a few formulas on the raw figures.
Academics built these off decades of actual fraud cases. You just have to know what each one is sniffing for.
Beneish M-Score is the Enron one.
Eight inputs mashed into a single number. Heaviest input by a mile is total accruals over total assets, because the fastest way to fake earnings is to book income that never showed up as cash. Next flag is sales growth that's just too clean to be honest, and that's the one that lit up on Enron. Above -2.22 you go investigate. Enron printed -1.89.
Altman Z-Score is your bankruptcy read.
Mixes profitability, leverage and how hard the assets are working into one distress score. Under 1.81 is the danger zone.
Sloan accruals ratio is earnings quality.
Earnings made of cash are real, earnings made of accruals reverse. Drift past about 25% either way and the earnings are basically an accounting mirage about to unwind on you.
Piotroski F-Score, 9 yes/no points on whether a company is actually getting financially stronger. 6 or up is healthy.
The thing that turns this from homework into a workflow is running all 4 at once across your whole watchlist and only reading the names that flag. Which is exactly what the script down below does.
And please don't reimplement these off some random blog, half the M-Score code on GitHub is subtly wrong.
FinanceToolkit repo has 150+ ratios - Beneish, Altman, Piotroski, Sloan, all of them - with the formulas written out in the open so you can audit a number when you don't trust it.
Pair it with an FMP key for data and you're set. Honestly one of the most slept-on finance repos out there, transparent and actually maintained.
Beneish runs on last year's data so the manipulation might already be unwinding by the time you see it. It misses some real frauds and false-flags some clean ones. A bad score means open the filing. It's never on its own a reason to short.
L2: AI Read the Words for You
You screened, something flagged, now you open the 10-K, which is 100+ pages of legalese built specifically to be unreadable.
Leave that work for AI
wrong way is:
pasting the whole filing into a chat box and going "is this a good company." It drowns and tells you whatever you want to hear.
good way is:
Ask it to diff this year's against last year's.
Pull the Risk Factors section out of this year's 10-K and last year's, hand both to the model and give it one job.
Tell me only what's new this year or what got cut, quote the new language, ignore the boilerplate that's in both.
A company that quietly slips in a paragraph about customer concentration just told you a big client is wobbling. One that deletes a line about a key supplier just told you a relationship ended. None of that ever hits the press release. Lawyers write those sentences because they're scared of getting sued, and fear is information sitting in plain text nobody reads twice.
Same diff works on the MD&A (management's own story of the year) and the footnotes. Enron's entire fraud lived in footnotes about off-balance-sheet entities. The story was a lie, the footnotes weren't.
The edgar-crawlerrepo exists basically just to rip those item sections, Risk Factors and MD&A, into clean JSON so you're not regexing through HTML to get them. That's its whole job and it does it well, feed the output into your diff.
If you'd rather pay than build, here's the honest map of who does this for you.
Hudson Labs (used to be Bedrock AI)
It's the under-the-radar pick and the one I'd actually pay for. Does the cross-year red flag extraction automatically, surfaces going-concern language, material weaknesses, related party risk without you asking. Starts around $100/mo. If you read filings seriously this is the best value per dollar on the list.
**AlphaSense
I**nstitutional default, somewhere around 15-20k a seat, so realistically only if your firm is paying. It owns Tegus, a library of thousands of paid interviews with former execs and customers. About as close to legal insider knowledge as you get, and you can't recreate it for free.
Daloopa
Pulls model-ready financials with every single number hyperlinked back to its exact spot in the filing. That audit trail is why people building serious DCFs use it. Enterprise pricing, overkill unless modeling is your actual job.
Fintool is AI-first, built for US equities, citations on everything, plus standing alerts like "ping me whenever any company newly mentions supply chain problems."
Decent middle ground if Hudson feels too forensic and AlphaSense too pricey.
L3: Crypto
Flip over to tokens. Same idea exactly
In stocks the fraud hides in accruals and footnotes.
In crypto it hides in supply schedules and holder concentration, and both of those are sitting on a public chain you can read for free.
Your EDGAR equivalent here is DefiLlama.
Free API, no key, covers basically every protocol's TVL, fees, revenue and unlock schedule.
A protocol has 3 numbers that map straight onto a normal company.
- Fees = everything users pay. That's gross revenue.
- Revenue = the slice the protocol actually keeps. That's net.
- Earnings = revenue minus the tokens it printed to bribe users into showing up in the first place.
Token Terminal standardizes exactly these, fees, revenue, earnings, the crypto P/E equivalents, across every major chain.
Genuinely the Bloomberg-of-crypto and the standardizing is real work you'd hate doing by hand. But it's ~350/mo which is a lot for one person, and the free tier plus DefiLlama gets you most of the way.
Then the 2 killers, the crypto version of forensic screening.
Unlock schedules first.
Tokens don't all exist at launch, team and VC allocations vest over years, and when they unlock the people who got in near zero finally get to dump on you. Rule of thumb, any single unlock over 5% of circulating supply is a red flag. To make it real, Arbitrum's first big cliff unlocked, in one day, an amount of ARB roughly equal to the entire circulating supply at the time. Whales who held since the start got to exit into retail and the date was on a calendar months ahead.
Know the 3 shapes.
- Cliff dumps a slug on one day (violent).
- Linear vest drips daily (slow bleed you can sometimes hold through).
- Emissions release based on activity. A cliff into a VC wallet is the one that ends portfolios.
Holder concentration second. Who actually owns the thing. If a handful of wallets hold most of supply and they're labeled team or some early VC fund, congrats, you're the exit liquidity by design.
This is where wallet labeling tools earn it, because raw chain data is just 0xxxxxxx.... until somebody tells you it's Jump Trading or a team vesting contract.
Arkham
Start here because it's free for individuals, which no other serious platform is. The de-anon engine is the real deal, it's the firm that publicly traced billions in stolen bitcoin back to a hack. You can run that same entity tracing on whatever token you're looking at. Free is the killer feature, just use it.
Nansen
Tracks "smart money," wallets with a track record of being early and right, across a ton of chains. Cut its Pro price hard recently to around 49/mo. The labels are the entire product and they're good, but the trail goes cold the second funds hit a centralized exchange. Worth it if you trade onchain seriously.
Dune
100k+ community SQL dashboards you can fork without writing a line of SQL yourself. Free tier is plenty for almost everyone, and somebody already built the dashboard you want so go find it before you build your own.
Messari has strong qualitative research and ratings. Pricing is opaque and enterprise-leaning, the free research is worth reading but don't expect the good stuff without a sales call.
Tokenomist (was Token Unlocks) is the dedicated unlock calendar. DefiLlama covers unlocks too, but if unlock-trading is your whole thing this is the specialist.
L4: One System
You've got the pieces now, free data both sides, forensic math, the doc diff, onchain screening. Last layer is getting it to run as one machine instead of you copy-pasting across 15 tabs.
virattt/ai-hedge-fund is a team of AI agents, each modeled on a famous investor's philosophy, that argue over a stock and spit out a call. The investor-persona thing is honestly kind of a gimmick and you should absolutely not trade it live with real money.
But as a free lesson in how to orchestrate analysis agents, how to chain a data-fetcher into a screener into a reasoner, it's the best teacher on GitHub right now.
OpenBB is the open source Bloomberg terminal. Connect your data vendors once, use them everywhere, with an MCP server so an agent can drive the whole thing. Powerful but heavy, setup is real work and the data quality depends entirely on which free vendor you wire in. Worth it if you want one cockpit for everything, overkill if you just want to screen a few names.
FinGPT / FinRobot are open financial LLMs you can fine-tune cheap. Academically impressive and yeah, fine-tuning is cheaper than people think.
But for basically everyone you don't need to fine-tune anything, a frontier model with the prompts above does the job.
In order
Tool layer first, function calling or MCP servers wrapping EDGAR, FMP, DefiLlama, so the model fetches real numbers and never invents them. Non-negotiable, an AI quoting an unsourced financial figure is a liability not an analyst.
Screen layer, the forensic scores and onchain checks run automatically on anything entering your universe.
Read layer, the year over year diff on whatever survives the screen.
Synthesis, the model writes the memo with a citation on every claim and you read the memo instead of the 200 pages.
On models, Claude or GPT both work. If you're touching sensitive data and don't want filings leaving your machine, run an open model locally through Ollama. The model was never the moat. The moat is wiring it to clean, verified, source-linked data and pointing disciplined math at it.
L5: Build L1
Hand it a ticker, it pulls the real filings from EDGAR, computes Beneish, Altman, Piotroski and the accruals ratio, and if you give it a key it runs the year over year Risk Factors diff and writes you a one-paragraph verdict.
1#!/usr/bin/env python32"""3forensic_screener.py - read any company like an analyst, in one command.45setup:6 pip install edgartools anthropic7 export SEC_IDENTITY="Your Name [email protected]" # SEC requires this header8 export ANTHROPIC_API_KEY="sk-..." # optional, only for the diff910run:11 python forensic_screener.py AAPL12 python forensic_screener.py TSLA NVDA SMCI # screen several at once13 python forensic_screener.py SMCI --diff # add the risk-factor diff14"""1516import os, sys, argparse17from dataclasses import dataclass1819# THRESHOLDS - the lines that change your stance. tune to taste.20M_FLAG = -1.78 # Beneish above this -> manipulation risk (classic cutoff -2.22)21Z_DISTRESS = 1.81 # Altman below this -> distress zone22Z_SAFE = 2.99 # Altman above this -> safe zone23ACCRUAL_BAD = 0.25 # |accruals/assets| above this -> earnings-quality red flag24F_STRONG = 6 # Piotroski at or above this -> strengthening2526@dataclass27class YearData:28 sales: float; cogs: float; sga: float; net_income: float; cfo: float29 receivables: float; current_assets: float; current_liabilities: float30 ppe_net: float; depreciation: float; total_assets: float31 total_liabilities: float; long_term_debt: float; retained_earnings: float32 ebit: float; market_cap: float; shares: float3334def load_two_years(ticker: str):35 """returns (this_year, last_year). calls SEC EDGAR over the network."""36 from edgar import Company, set_identity37 identity = os.environ.get("SEC_IDENTITY")38 if not identity:39 sys.exit("set SEC_IDENTITY='Your Name [email protected]' - the SEC requires it.")40 set_identity(identity)4142 company = Company(ticker)43 fin = company.get_financials()44 inc, bal, cfs = fin.income_statement(periods=2), fin.balance_sheet(periods=2), fin.cash_flow(periods=2)4546 def g(stmt, col, *aliases):47 # best-effort row lookup; companies tag the same idea differently48 for a in aliases:49 try:50 row = stmt.loc[stmt.index.str.contains(a, case=False, na=False)]51 if not row.empty:52 return float(row.iloc[0, col])53 except Exception:54 continue55 return 0.05657 def build(col):58 return YearData(59 sales=g(inc, col, "RevenueFromContractWithCustomerExcludingAssessedTax", "Revenues", "SalesRevenueNet"),60 cogs=g(inc, col, "CostOfGoodsAndServicesSold", "CostOfRevenue"),61 sga=g(inc, col, "SellingGeneralAndAdministrativeExpense"),62 net_income=g(inc, col, "NetIncomeLoss"),63 cfo=g(cfs, col, "NetCashProvidedByUsedInOperatingActivities"),64 receivables=g(bal, col, "AccountsReceivableNetCurrent", "ReceivablesNetCurrent"),65 current_assets=g(bal, col, "AssetsCurrent"),66 current_liabilities=g(bal, col, "LiabilitiesCurrent"),67 ppe_net=g(bal, col, "PropertyPlantAndEquipmentNet"),68 depreciation=g(cfs, col, "DepreciationDepletionAndAmortization", "DepreciationAmortizationAndAccretionNet"),69 total_assets=g(bal, col, "Assets"),70 total_liabilities=g(bal, col, "Liabilities"),71 long_term_debt=g(bal, col, "LongTermDebtNoncurrent", "LongTermDebt"),72 retained_earnings=g(bal, col, "RetainedEarningsAccumulatedDeficit"),73 ebit=g(inc, col, "OperatingIncomeLoss"),74 market_cap=getattr(company, "market_cap", 0.0) or 0.0,75 shares=g(bal, col, "CommonStockSharesOutstanding"),76 )7778 # col 0 = newest year, col 1 = prior year (edgartools orders newest first)79 return build(0), build(1)8081def d(a, b): return a / b if b else 0.0 # safe divide8283def beneish_m_score(t, p):84 DSRI = d(d(t.receivables, t.sales), d(p.receivables, p.sales))85 GMI = d((p.sales - p.cogs)/p.sales if p.sales else 0, (t.sales - t.cogs)/t.sales if t.sales else 0)86 AQI = d(1 - d(t.current_assets + t.ppe_net, t.total_assets), 1 - d(p.current_assets + p.ppe_net, p.total_assets))87 SGI = d(t.sales, p.sales)88 DEPI = d(d(p.depreciation, p.depreciation + p.ppe_net), d(t.depreciation, t.depreciation + t.ppe_net))89 SGAI = d(d(t.sga, t.sales), d(p.sga, p.sales))90 TATA = d(t.net_income - t.cfo, t.total_assets)91 LVGI = d(d(t.total_liabilities, t.total_assets), d(p.total_liabilities, p.total_assets))92 return (-4.84 + 0.92*DSRI + 0.528*GMI + 0.404*AQI + 0.892*SGI93 + 0.115*DEPI - 0.172*SGAI + 4.679*TATA - 0.327*LVGI)9495def altman_z_score(t):96 wc = t.current_assets - t.current_liabilities97 return (1.2*d(wc, t.total_assets) + 1.4*d(t.retained_earnings, t.total_assets)98 + 3.3*d(t.ebit, t.total_assets) + 0.6*d(t.market_cap, t.total_liabilities)99 + 1.0*d(t.sales, t.total_assets))100101def piotroski_f_score(t, p):102 s = 0103 s += t.net_income > 0104 s += t.cfo > 0105 s += d(t.net_income, t.total_assets) > d(p.net_income, p.total_assets)106 s += t.cfo > t.net_income # cash beats accruals107 s += t.long_term_debt < p.long_term_debt108 s += d(t.current_assets, t.current_liabilities) > d(p.current_assets, p.current_liabilities)109 s += t.shares <= p.shares # no dilution110 s += d(t.sales - t.cogs, t.sales) > d(p.sales - p.cogs, p.sales)111 s += d(t.sales, t.total_assets) > d(p.sales, p.total_assets)112 return int(s)113114def sloan_accruals(t): return d(t.net_income - t.cfo, t.total_assets)115116def risk_factor_diff(ticker):117 """diff this year's vs last year's Risk Factors. the single best read in the stack."""118 key = os.environ.get("ANTHROPIC_API_KEY")119 if not key:120 return "(skipped - set ANTHROPIC_API_KEY to enable the diff)"121 from edgar import Company122 import anthropic123 f = Company(ticker).get_filings(form="10-K").latest(2)124 this_rf = getattr(f[0].obj(), "risk_factors", str(f[0]))125 last_rf = getattr(f[1].obj(), "risk_factors", str(f[1]))126 client = anthropic.Anthropic(api_key=key)127 msg = client.messages.create(128 model="claude-opus-4-8", max_tokens=1024,129 messages=[{"role": "user", "content": (130 "compare these two Risk Factors sections from consecutive annual filings. "131 "report ONLY what is NEW this year or what was REMOVED. quote the new language. "132 "ignore boilerplate in both. end with one sentence: does anything here change the risk?\n\n"133 f"LAST YEAR:\n{last_rf[:40000]}\n\nTHIS YEAR:\n{this_rf[:40000]}")}],134 )135 return msg.content[0].text136137def screen(ticker, do_diff=False):138 print(f"\n{'='*60}\n {ticker.upper()}\n{'='*60}")139 try:140 t, p = load_two_years(ticker)141 except Exception as e:142 print(f" could not load filings: {e}"); return143144 m, z, f, a = beneish_m_score(t, p), altman_z_score(t), piotroski_f_score(t, p), sloan_accruals(t)145 flags = []146 if m > M_FLAG: flags.append(f"M-Score {m:+.2f} - earnings-manipulation risk")147 if z < Z_DISTRESS: flags.append(f"Z-Score {z:.2f} - financial distress zone")148 if abs(a) > ACCRUAL_BAD: flags.append(f"Accruals {a:+.1%} - earnings-quality red flag")149 if f < F_STRONG: flags.append(f"F-Score {f}/9 - not strengthening")150151 print(f" Beneish M : {m:+.2f} (> {M_FLAG} = investigate)")152 print(f" Altman Z : {z:.2f} (< {Z_DISTRESS} distress, > {Z_SAFE} safe)")153 print(f" Piotroski F: {f}/9 (>= {F_STRONG} strong)")154 print(f" Sloan Accr : {a:+.1%} (|x| > {ACCRUAL_BAD:.0%} red flag)")155 print(f"\n VERDICT: {'INVESTIGATE' if flags else 'CLEAN'}")156 for fl in flags: print(f" - {fl}")157 if do_diff:158 print("\n RISK-FACTOR DIFF (year over year):")159 print(" " + risk_factor_diff(ticker).replace("\n", "\n "))160161def main():162 ap = argparse.ArgumentParser(description="forensic screener for any US public company")163 ap.add_argument("tickers", nargs="+")164 ap.add_argument("--diff", action="store_true", help="also run the risk-factor diff")165 args = ap.parse_args()166 for tk in args.tickers:167 screen(tk, do_diff=args.diff)168 print("\nreminder: probability flags, not proof. Beneish runs on last year's data so "169 "manipulation may already be unwinding. a bad score means open the filing, never "170 "short on the number alone.\n")171172if __name__ == "__main__":173 main()
I checked the math before shipping, feed a healthy set of numbers in and it prints a clean M around -2.24, Z in the safe zone, F at 9/9, accruals near zero, exactly what you'd want.
Only thing that needs your machine is the live SEC connection and a key for the diff. The tag aliases cover standard filers, an exotic one might need a line added and I marked where.
