openhireBLOCK
Job postings with the employer's REAL posting date, pulled from Greenhouse / Lever / Ashby / 北森 Beisen / Moka ATS APIs. MCP server + CLI for Claude, Cursor and any agent. 139 employers in AI infra, autonomous driving 智驾 and embodied AI 具身. Your résumé never leaves your machine.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A job-search radar for your AI assistant — first-party listings, every posting's real age, and your résumé never touches our servers. 让 AI 助手替你盯岗的求职雷达 —— 一手职位、岗位在架时长打分,简历不经过我们的服务器。
[](https://glama.ai/mcp/servers/gzchenhao/openhire)
Real terminal output — install from PyPI, download the public index, search. No account, no signup.
Every number here is checkable. Open-duration report (per-employer medians, named, monthly) · numbers.json (the provenance of every figure we quote, regenerated each refresh) · raw report data. 我们引用的每个数字都能核:岗位在架时长月报 · numbers.json
Is your company in here, and you did not put it here? Your postings are in this index because your own careers page serves them publicly. We can measure how long a role has been open; we cannot see why, and a long-open role is a question, not a verdict. Claim your company — free, no payment, ever — and say why in your own words, or ask us to remove you and we will, without arguing. 贵公司被收录了、而且不是贵公司提交
025fec14c568OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add openhire -- uvx openhire==0.8.2 serve
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (13)
const fn = new Function(
new Function("React", "module", "exports", "require", code)(openhire-岗位表.xlsx
.cnb.yml
posting["id"] = hashlib.sha1(
job_id = str(p.get("id") or "").strip() or hashlib.sha1(return "rg_" + hashlib.sha1(key.encode("utf-8")).hexdigest()[:8]decrypt_cbc(base64.b64decode(payload["data"]), key.encode(), iv.encode())
plain = _decrypt_block(bytes.fromhex(ct_hex), _expand_key(bytes.fromhex(key_hex)))
`twine upload`(token 取自 `.pypirc`,全程未打印)→ https://pypi.org/project/openhire/0.2.0/
curl -LsSf https://astral.sh/uv/install.sh | sh # macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh # macOS / Linux
Gates applied: no_behavioural_pass.
025fec14c568full audit observations/trust-audit/mcp-server/gzchenhao__openhire.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 025fec14c568 | BLOCK | D | 69 | first audit |
Questions
What is the openhire MCP server?
Job postings with the employer's REAL posting date, pulled from Greenhouse / Lever / Ashby / 北森 Beisen / Moka ATS APIs. MCP server + CLI for Claude, Cursor and any agent. 139 employers in AI infra, autonomous driving 智驾 and embodied AI 具身. Your résumé never leaves your machine.
Is openhire safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does openhire need?
It reads ANTHROPIC_API_KEY, DEEPSEEK_API_KEY, FEISHU_APP_SECRET, OPENHIRE_ANTHROPIC_API_KEY and ZHIPU_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does openhire run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as openhire.
How current is this page?
The grade is for one exact copy of the source (025fec14c568), read on 2026-10-11. The repository is watched and re-audited when it changes.