career-compass-mcpBLOCK
Turn Claude into a full job-search partner — Career KB, tailored resumes, application pipeline, interview prep. MCP server + local dashboard; your data never leaves your machine.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/career-compass-mcp) [](https://www.npmjs.com/package/career-compass-mcp) [](LICENSE) [](https://nodejs.org) [](https://modelcontextprotocol.io)
Paste a job posting. Get an honest fit verdict.
Paste a job posting and your resume, and ask "Do I fit this?" You get a straight verdict (strong fit, stretch, or long shot), each of the posting's must-haves matched to evidence from your own background, and the top two gaps with how to handle them. Then Claude can tailor your résumé, write the cover letter and prep the interview without padding your history. Free, MIT-licensed, and in Claude Code and Cowork your files stay on your own computer.
What a fit check looks like
<img src="https://raw.githubusercontent.com/benskamps/career-compass-mcp/main/docs/assets/demo/demo.gif" width="100%" alt="A chat: the user pastes a Director of Operations posting and asks Do I fit this. Career Compass's explore_opportunity tool returns the sample candidate's evidence and preference contract, and Claude replies: Strong fit, pay inside the band, the first three must-haves matched to evidence, and two gaps, risk ops and payments regulation. Verdict: pursue it.">
A real run: the explore_opportunity output on the bundled sample
5d4013cc6db1OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add career-compass-mcp --env CAREER_COMPASS_LIVE_REGISTRY_TEST=${CAREER_COMPASS_LIVE_REGISTRY_TEST} --env CAREER_COMPASS_TODAY=${CAREER_COMPASS_TODAY} -- npx -y [email protected]{
"mcpServers": {
"career-compass-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CAREER_COMPASS_LIVE_REGISTRY_TEST": "${CAREER_COMPASS_LIVE_REGISTRY_TEST}",
"CAREER_COMPASS_TODAY": "${CAREER_COMPASS_TODAY}"
}
}
}
}Exposed tools (19)
16 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
answer_application | read | |
capture_insight | read | |
check_setup | read | |
classify_email | read | |
evaluate_offer | read | |
explore_opportunity | read | |
format_for_ats | read | |
generate_cover_letter | read | |
generate_rejection_response | read | |
harvest_evidence | read | |
ingest_document | read | |
interview_arc | read | |
pipeline_add | write | |
pipeline_update | write | |
pipeline_view | read | |
prepare_interview | read | |
research_company | read | |
save_career_section | write | |
tailor_resume | read |
Trust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (19)
try { current = exec(bin, ["mcp", "get", "career-compass"]); } catch { current = null; }if (stale) exec(bin, ["mcp", "remove", "career-compass", "-s", "user"]);
exec(bin, args);
const list = JSON.parse(exec(bin, ["plugin", "list", "--json"])) as unknown;
exec(cmd, args);
.nojekyll
"@shared": path.resolve(__dirname, "../../src"),
const repoRoot = path.resolve(import.meta.dirname, "../../..");
import pkg from "../../package.json";
arguments: { section: "../../escaped", data: [] },const EXAMPLE_DATA_PATH = fileURLToPath(new URL("../../data/example", import.meta.url));`http://127.0.0.1:<port>/`. That is a loopback request to your own machine; it never
<code>http://127.0.0.1:<port>/</code>. That is a loopback request to your own machine; it never
`http://127.0.0.1:<port>/`. That is a loopback request to your own machine; it never
<code>http://127.0.0.1:<port>/</code>. That is a loopback request to your own machine; it never
expect(isAllowedOrigin("http://127.0.0.1:3141")).toBe(true);@base-ui/react, class-variance-authority, clsx, lucide-react, next, react, react-dom, recharts
@modelcontextprotocol/sdk, yaml, zod, @modelcontextprotocol/inspector, @types/node, playwright, tsx, typescript
docs/assets/demo/demo.gif
Gates applied: no_behavioural_pass.
5d4013cc6db1full audit observations/trust-audit/mcp-server/benskamps__career-compass-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 5d4013cc6db1 | BLOCK | D | 62 | first audit |
Questions
What is the career-compass-mcp MCP server?
Turn Claude into a full job-search partner — Career KB, tailored resumes, application pipeline, interview prep. MCP server + local dashboard; your data never leaves your machine.
What tools does career-compass-mcp expose?
19 in total: 16 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is career-compass-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does career-compass-mcp need?
It reads CAREER_COMPASS_LIVE_REGISTRY_TEST and CAREER_COMPASS_TODAY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does career-compass-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as career-compass-mcp at 2.11.2.
How current is this page?
The grade is for one exact copy of the source (5d4013cc6db1), read on 2026-10-11. The repository is watched and re-audited when it changes.