Reactive Resume

Overview

From the repository's own README, as read at the audited commit.

> [!IMPORTANT]> **Repository moved:** Reactive Resume now lives at **[`reactive-resume/reactive-resume`](https://github.com/reactive-resume/reactive-resume)** on GitHub.> **Docker Hub stays at `amruthpillai/reactive-resume`.** GHCR builds now publish to `ghcr.io/reactive-resume/reactive-resume`.> Verified image tags: `latest`, `v5`, `v5.3`, and `v5.3.0` (AMD64 and ARM64). The current version was rebuilt and production redeployed for this rename; no new GitHub release or version bump was made. See [migration details](https://github.com/reactive-resume/reactive-resume/issues/3503).> GitHub Sponsors and Open Collective funding links remain unchanged.<div align="center">  <a href="https://rxresu.me">    <img src="apps/web/public/opengraph/banner.jpg" alt="Reactive Resume" />  </a>  <h1>Reactive Resume</h1>  <p>Reactive Resume is a free and open-source resume builder that makes it easy to create, update, and share your resume.</p>  <p>    <a href="https://rxresu.me"><strong>Get Started</strong></a>    ·    <a href="https://docs.rxresu.me"><strong>Learn More</strong></a>  </p>  <p>    <img src="https://img.shields.io/github/package-json/v/reactive-resume/reactive-resume?style=flat-square" alt="Reactive Resume Version">    <img src="https://img.shields.io/github/stars/reactive-resume/reactive-resume?style=flat-square" alt="GitHub Stars">    <img src="https://img.shields.io/github/license/reactive-resume/reactive-resume?style=flat-square" alt="License" />    <img src="https://img.shields.io/docker/pulls/amruthpillai/reactive-resume?style=flat-square" alt="Docker Pulls" />    <a href="https://discord.gg/aSyA5ZSxpb"><img src="https://img.shields.io/discord/1173518977851473940?style=flat-square&label=discord" alt="Discord" /></a>    <a href="https://crowdin.com/project/reactive-resume"><img src="https://badges.crowdin.net/reactive-resume/localized.svg?style=flat-square" alt="Crowdin" /></a>    <a href="https://github.com/sponsors/AmruthPillai"><img src="https://img.shields.io/

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add tooling --env AUTH_SECRET=${AUTH_SECRET} --env BETTER_AUTH_INTERNAL_URL=${BETTER_AUTH_INTERNAL_URL} --env OAUTH_TEST_DATABASE_URL=${OAUTH_TEST_DATABASE_URL} --env SKILL_KEYWORD_ARTIFACT_DIR=${SKILL_KEYWORD_ARTIFACT_DIR} -- npx -y @reactive-resume/[email protected]

{
  "mcpServers": {
    "tooling": {
      "command": "npx",
      "args": [
        "-y",
        "@reactive-resume/[email protected]"
      ],
      "env": {
        "AUTH_SECRET": "${AUTH_SECRET}",
        "BETTER_AUTH_INTERNAL_URL": "${BETTER_AUTH_INTERNAL_URL}",
        "OAUTH_TEST_DATABASE_URL": "${OAUTH_TEST_DATABASE_URL}",
        "SKILL_KEYWORD_ARTIFACT_DIR": "${SKILL_KEYWORD_ARTIFACT_DIR}"
      }
    }
  }
}

Exposed tools (2) 2 read · 0 write · 0 destructive

Details

Source

amruthpillai/reactive-resume

npm

@reactive-resume/tooling@0.0.0

Transports

streamable-http

Credentials it reads

AUTH_SECRETBETTER_AUTH_INTERNAL_URLOAUTH_TEST_DATABASE_URLSKILL_KEYWORD_ARTIFACT_DIR

License

MIT

Stars

43,117 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (3 observation(s))

Network

declared (4 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

found

Findings (25)

DATABASE_URL="postgresql://postgres:postgres@postgres:5432/postgres"

DATABASE_URL: postgresql://postgres:postgres@postgres:5432/postgres

| fa-IR | `توسعهدهنده نرمافزار — ۲۰۲۶` | Persian letters/digits and the literal ZWNJ between words |

CMD ["node", "-e", "fetch(`http://127.0.0.1:${process.env.PORT ?? 3000}/api/health`).then((r) => { if (!r.ok) process.exit(1); }).catch(() => process.exit(1));"]

const text = input.replace(/^/, "");

DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres

DATABASE_URL=postgresql://postgres:postgres@localhost:5432/postgres

DATABASE_URL=postgresql://postgres:postgres@postgres:5432/postgres

binding: { type: "alias", canonicalKind: "section", token: "interleaved-section-row" },

token: "interleaved-section-row",

.codacy.yml

.markdownlint-cli2.yaml

.mintignore

CLAUDE.md

target = fileURLToPath(new URL("../../../../docs/spec.json", import.meta.url)),

const packageJson = JSON.parse(await readFile(new URL("../../../../package.json", import.meta.url), "utf8")) as {

await readFile(new URL("../../../../docs/spec.json", import.meta.url), "utf8"),

fileURLToPath(new URL("../../../web/dist", import.meta.url)),

fileURLToPath(new URL("../../web/dist", import.meta.url)),

expect(isPrivateOrLoopbackHost("::ffff:169.254.169.254")).toBe(true);

body: JSON.stringify({ redirect_uris: ["https://192.168.1.10/callback"] }),

const redirectURI = "http://127.0.0.1:33921/callback";

const redirectURI = "http://127.0.0.1:33921/callback";

redirect_uris: ["http://127.0.0.1:33921/callback"],

const png = decode(Uint8Array.from(atob(shadow.src.split(",")[1] ?? ""), (char) => char.charCodeAt(0)));

Gates applied: no_behavioural_pass.

Audited 2026-09-18 · audit v0.4.0 · source sha 4d474828a092 · full audit: observations/trust-audit/mcp-server/amruthpillai__reactive-resume.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions