36,921 Stars, 85% Markdown: An Audit of Anthropic's Financial-Services Agent Repository

On September 23, 2026, anthropics/financial-services sat at #1 on GitHub Trending with 36,921 stars, 665 of them gained that day, ahead of Univer (16,310 stars, 1,140 gained) and a dozen other fast-moving projects. The pitch is compelling: named end-to-end agents for investment banking, equity research, private equity, fund administration and KYC — installable as Claude Cowork plugins or deployable as Claude Managed Agents behind your own workflow engine.

I cloned it, read it, ran its own checks, and pulled independent benchmark data on what LLMs can actually do with financial analysis. The result is not a takedown. It is a specific picture of what this repository is: an unusually well-researched domain knowledge base wearing the costume of a software platform — and the difference matters a great deal if you plan to point it at a live model.

What the repository actually contains

Every number below comes from an independent clone of main (commit 574ed36), the GitHub REST API, and a headless-browser read of the repository page on 2026-09-23.

For scale comparison, on the same day openai/openai-agents-python held 29,661 stars with 60 MB of code, and langchain-ai/langchain held 146,941 stars with 588.9 MB. This repository carries 0.9 MB and outranks the first of them by more than 7,000 stars.

85% of the bytes are prose — and that is the product

The largest single artifact in the repository is not code. It is plugins/vertical-plugins/financial-analysis/skills/dcf-model/SKILL.md: 49,508 bytes, 1,264 lines, 68 headings, of which roughly 40 are error-avoidance sections — WRONG: Formula Row References Off, WRONG: Operating Expenses Based on Gross Profit, TOP 5 ERRORS SUMMARY, WACC Calculation Errors, Terminal Value Mistakes.

Read those headings as a symptom list. Someone at Anthropic watched a language model build DCF models badly, repeatedly, and wrote down every failure mode in prose. The agent system prompts themselves are tiny by comparison — the ten named agents run 204 to 482 words each, while the skills they bundle run to hundreds of kilobytes.

There is nothing wrong with shipping prose. Domain conventions are the hard part of financial modeling, and encoding them as instructions is fast, reviewable, and forkable. But it changes what a star means. There is no compiled artifact here, no runtime, no calculation engine. Only 17 Python files ship, and the two biggest are duplicated three and two times respectively because the repository’s sync script copies skill sources into every agent bundle that uses them.

Three defects in the first twenty minutes

The obvious complaints about prompt repositories are aesthetic — “it’s just markdown.” These are different: they are reproducible defects in the shipping state of a repository with 36,921 stars.

Defect 1 is the interesting one, because of why it survived. scripts/check.py — which the repository’s own CLAUDE.md tells contributors to run before committing — parses only marketplace.json, plugins/**/.claude-plugin/plugin.json and managed-agent-cookbooks/*/steering-examples.json. It never parses .mcp.json. The one config file that touches external production endpoints is the one the linter skips, and the coverage gap is visible in the linter source itself.

Defect 2 is not my finding alone. Two independent contributors reached the same conclusion: PR #365 (opened 2026-09-22, still open) states that scripts/check.py “failed on main with three bundled-skill errors for the meeting-prep agent,” and PR #358 notes “the same 3 pre-existing meeting-prep-agent failures on both your branch and clean upstream/main.” I reproduced it on a clean clone without any modification.

A plugin that lived seven days

The repository’s recent history explains the breakage — and shows how fast its structure moves.

Users noticed before maintainers documented anything. That is a governance signal, not a code signal: a public repository with 5,374 forks changed its product surface three times in eleven days without a changelog entry, and the fallout landed in the linter and the README. This is exactly the kind of unversioned, undocumented churn that model risk functions were built to catch.

The recalc.py that has been missing since March

Here is the finding that should interest anyone thinking about production use. The flagship DCF skill instructs the agent, in a section titled Formula Recalculation (MANDATORY):

python recalc.py [path_to_excel_file] [timeout_seconds]

The skill even names a path: /mnt/skills/public/xlsx/recalc.py. That script is not in this repository. It is not in any of the 363 tracked files.

Issue #25, “recalc.py missing”, was opened on 2026-03-09 and remains open. On 2026-09-20, PR #358 proposed adding it — a LibreOffice-headless recalculation step that detects #DIV/0! and #NAME? and reports the exact sheet and cell. That PR is still open.

Why this deserves attention beyond a tracking bug: a language model writing a spreadsheet writes formulas as text. Unless something recalculates them, a delivered .xlsx can contain a formula cell with no cached value, and a downstream reader — or the next agent in the chain — sees a stale or empty result. The repository ships a validator, validate_dcf.py, but it does not recompute anything. It runs three heuristics: terminal growth must be below WACC, WACC must be in a plausible range, terminal value must be a plausible share of enterprise value. Those catch model-building sloppiness. They cannot tell you whether the arithmetic resolves.

So the mandatory step in the most important skill points at a file that has been absent for six months, and the community patch that fixes it has been waiting for review since September 20.

What independent benchmarks actually say

Anthropic’s repository leans on a disclaimer that is worth quoting, because it is the honest core of the whole project: nothing here is investment, legal, tax or accounting advice; these agents draft analyst work product for review by a qualified professional; they do not make recommendations, execute transactions, bind risk, post to a ledger or approve onboarding; every output is staged for human sign-off.

Independent numbers explain why that disclaimer is there. The Finance Agent Benchmark (arXiv 2508.00828) evaluates autonomous agents on 537 real-world financial research tasks written and peer-reviewed by financial experts across nine categories, with rubric-based grading and explicit contradiction detection. On the published leaderboard, no model exceeds 50% accuracy:

Note the generation: these are 2025-era models, not the Claude Opus 5.5 or GPT-6 class shipping today. I could not find a successor financial-agent benchmark published alongside this repository, which is itself a data point — the marketing moved forward, the public evidence did not.

Two further findings travel with that table:

• Confident hallucination. Across 6,105 FinQA and 1,138 TAT-QA filing questions, 15% to 23% of answers that were 100% self-consistent across eight independent runs were factually wrong. Output-level uncertainty signals (token log-probabilities, self-reported confidence) decay to near chance — 0.55–0.63 AUROC — meaning a system built on “the model sounds unsure” will miss them.
• Where agents are unreliable. Retrieval of an explicit number from a filing is high-reliability work. Beat-or-miss analysis, GAAP-to-non-GAAP bridges, multi-year trend tracking across changing reporting structures, and financial modeling with projections are all classified as unreliable or high-failure. That is not a coincidence: it is precisely the territory this repository’s agent names promise to automate — GL reconciliation, valuation review, statement auditing, model building.
• Domain tuning can make things worse. In controlled studies, domain fine-tuning of open financial models raised overt numerical hallucination from 5.4% (base instruction model) to 82.5%, and to 96.7% under weak numerical grounding — with memorised templates like “operating cash flow of USD…” appearing in up to 97% of outputs. This is research on open models, not on Claude, and it should be read as a warning about the class of technique, not an accusation against this repository.

The moat is data subscriptions, not prompts

The repository’s skills are free. The data is not. All 12 MCP connectors point at vendor-hosted endpoints — Daloopa, Morningstar, S&P Global (Kensho), FactSet, Moody’s, MT Newswires, Aiera, LSEG, PitchBook, Chronograph, Egnyte, Box — and the README states plainly that “MCP access may require a subscription or API key from the provider.”

That is where the actual competitive advantage sits. A competitor can fork 241 markdown files today and have the same prompts by tomorrow. Nobody can fork a FactSet seat. Which means the repository’s real function is distribution: it lowers the activation energy for firms that already pay for institutional data, and it is close to inert for everyone else. The 5,374 forks are better read as people extracting the domain conventions than as 5,374 deployments.

What regulated deployment would actually require

If an agent produces something a firm reports or trades on, model risk management applies — FRB SR 11-7 / OCC 2011-12 in the US, PRA SS1/23, OSFI E-23, and the EU AI Act’s higher-risk obligations. Modern interpretation treats the system as the model, not the weights:

Against that list, the plugin.json version bumps and the drift checks in sync-agent-skills.py are a genuine start — they are the only mechanical change control in the repository, and they exist because a plugin’s version gates update delivery to installed users. But markdown that can be edited ad hoc, a linter that is red on main, and a config file that no check parses are the opposite of an evidence package. Anthropic’s own disclaimer implicitly concedes the point: “human sign-off” is the control.

A practical playbook

Use it if you already hold institutional data subscriptions, you want well-researched scaffolding for analyst work product rather than an autonomous decision system, and a qualified reviewer reads every output. The domain conventions in these skills — the WRONG: sections especially — are worth far more than the star count suggests.

Before you deploy, fix these:

1. Repair .mcp.json (add the missing comma after the egnyte block) and add every *.json in the repository to your own schema linting, not just the three globs check.py covers.
2. Pin versions by hash, not by tag. Copy the specific skill directories you use into your own repository and record their SHA-256 in your change log, so a silently edited instruction file is visible in review.
3. Wire in deterministic recalculation for anything spreadsheet-shaped. Until PR #358 lands, run LibreOffice headless yourself and assert zero #DIV/0!, #NAME?, #REF! cells before an output leaves your pipeline.
4. Stress-test weak grounding. Feed the agent filings with the numbers stripped out and confirm it abstains instead of inventing plausible figures. Domain-tuned models fail this test catastrophically; general models fail it too, just less loudly.
5. Keep the human sign-off step in code, not in prose. Make the hand-off a required approval in your workflow engine. A disclaimer in a README is not a control.
6. Budget for trace logging from day one. Tool calls, parameters, retrieved chunks and prompt versions — this is the artifact an auditor will ask for, and it is nearly impossible to reconstruct after the fact.

FAQ

Is this repository just markdown? Not literally: 363 tracked files include 40 YAML files, 39 JSON files and 17 Python scripts. But markdown accounts for 85.3% of its bytes and 40,189 lines, and the executable surface — a DCF validator, a number extractor, a deck checker — is thin. Treat it as a domain knowledge base with a plugin-shaped delivery mechanism.

Does the broken .mcp.json mean the connectors don’t work? No. It means the file will not parse as JSON. Depending on how your client loads MCP configuration, you may get a hard error at load time or you may get an empty server list. Either way it fails loudly — which is why it is worth fixing before you reason about anything else.

Why does the star count keep climbing if the checks fail? Because stars track distribution and interest, not verification. The repository is genuinely useful, timely, and from a well-known vendor. None of that requires its linter to be green, and almost nobody runs a repository’s own pre-commit check before starring it.

Is it safe to use for real financial work? For drafting work product that a qualified professional reviews, that is exactly the designed use, and the disclaimer says so. For anything that requires accurate figures without independent verification — reporting, valuation sign-off, ledger reconciliation — the benchmark evidence does not support it. The most dangerous failure mode is plausible-looking numbers that pass a skim.

Should I use the skills with a model other than Claude? The skills are plain markdown and portable in principle, but they assume Claude’s file-based plugin and command conventions, and the managed-agent cookbooks assume the Managed Agents API, including a preview capability (callable_agents) for subagent delegation. Porting is real work, not a find-and-replace.

How do I track whether this repository has stabilised? Watch three things: whether scripts/check.py exits 0 on main, whether .mcp.json starts being parsed by the linter, and whether issue #25 (recalc.py missing) closes. Those three are a decent proxy for whether the project is being maintained as software or published as content.

The bottom line

Anthropic’s financial-services repository earns its stars on the hard part: 40,189 lines of domain convention, error taxonomy and process discipline that took someone months to write down, packaged so a firm can adapt it in an afternoon. That is real value, and it is why the trending position is deserved.

What it does not do is shift the burden of proof. There is no calculation engine, the mandatory recalculation step points at a script that has been missing since March, the linter that gates contributions is failing on main today, and the one config file reaching out to production data endpoints has never been parsed by any check in the project. Meanwhile the strongest public evidence available puts the best agents at 46.8% accuracy on expert financial research tasks, with 15–23% of their most confident answers factually wrong.

So use the prose, keep the reviewer, add the checks the repository does not ship — and measure the agents on your own tasks before you let a star count stand in for validation.