Atlas / MCP servers / vinayvobbili / jobwatch

jobwatchCAUTION

mcp/vinayvobbili/jobwatch

Watch company job boards (Greenhouse, Lever, Ashby, Workable, Workday, Eightfold, Rippling), get a ranked digest of new matches, track every application, and use it from Claude via MCP. Never auto-applies.

Verdict
CAUTION
Grade
B
Trust score
86 /100
Exposed tools
9 7r · 2w · 0d
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://m8ven.ai/mcp/vinayvobbili-jobwatch-1cvk7w?s=readme) [](https://glama.ai/mcp/servers/vinayvobbili/jobwatch) [](https://mcpservers.org/servers/vinayvobbili/jobwatch) [](https://aiagentslisting.com/mcp/jobwatch)

Watch the job boards of the companies you care about and get a short, ranked digest of new roles that match you, optionally fit-scored against your resume. jobwatch finds and ranks. It never applies for you.

Watch it with sound (11⁄2 minutes, made from made-up data).

$ jobwatch run
Checked 48 board(s): 9,412 open roles, 37 new.

# jobwatch digest

6 matching job(s). Filtered out: 22 by location, 4 by pay, 5 by title.
Applied today: 1 of 3.

### [Staff AI Engineer](https://jobs.ashbyhq.com/initech/c1)
Initech · Denver, CO, United States; Remote · $230K–$300K · posted today
**Fit 81/100**, must-haves 6/7. Gaps: 3+ years with Kubernetes in production
Keywords: Python, RAG, agents
`ashby:initech:c1`
...

Why company boards

Most tech companies post jobs through Greenhouse, Lever, Ashby or Workable, and most large employers through Workday (some through Eightfold, Oracle Recruiting Cloud, SmartRecruiters or a Jibe careers site), and many small companies through Rippling. Each publishes open roles as public JSON so anyone can build a careers p

Read from source at commit 6c835ccc8381OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (pypi)
claude mcp add jobwatch -- uvx jobwatch==0.4.1 mcp
03

Exposed tools (9)

7 read · 2 write · 0 destructive.

ToolRiskDescription
find_duplicatesreadJobs tracked twice: pairs of tracked jobs, open or closed, where the person queued, applied to or skipped
get_application_packagereadWhat was sent with an application: files kept (with their folder), form answers, note, and the day the
get_interview_prepreadA prep sheet for a recruiter call or interview: stage and next step, each requirement and responsibility
get_jobwriteEverything about one job, by key or posting id: the full posting text, pay, tracking (status, note, next
list_applicationsreadEvery application (applied or a later stage) and where it stands, follow-ups due soonest first;
list_boardsreadThe boards on the watchlist (entry, display name, careers: the board
list_jobsreadTracked jobs with their tracking fields, newest first, including closed postings. A plain list by status
list_queued_jobswriteJobs queued to apply to, oldest first, with fit scores, notes, people the user knows there (ask them for
list_skill_gapsreadSkills today
04

Trust audit

CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (10 observation(s))
Shell
declared (1 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (9)

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
jobwatch/score.py:141
rows.append((name, about, [], getattr(importlib.import_module(module), constant)))
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
jobwatch/service.py:81
return f"http://127.0.0.1:{port}/"
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
jobwatch/service.py:102
info["url"] = f"http://127.0.0.1:{args[args.index('--port') + 1]}/"
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
jobwatch/web.py:945
url = f"http://127.0.0.1:{port_ref[0]}/"
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/screenshots.py:60
yield f"http://127.0.0.1:{server.server_address[1]}/"
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
jobwatch/contacts.py:48
lines = text.lstrip("").splitlines()
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
tests/test_service.py:31
assert "http://127.0.0.1:8800/" in capsys.readouterr().out
INFOInventory / provenance · inv.oversize · CWE-1104
docs/demo.gif
docs/demo.gif
Why it matters. 1602793 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
docs/jobwatch-demo.mp4
docs/jobwatch-demo.mp4
Why it matters. 4078567 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 6c835ccc8381full audit observations/trust-audit/mcp-server/vinayvobbili__jobwatch.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-116c835ccc8381CAUTIONB86first audit
06

Questions

What is the jobwatch MCP server?

Watch company job boards (Greenhouse, Lever, Ashby, Workable, Workday, Eightfold, Rippling), get a ranked digest of new matches, track every application, and use it from Claude via MCP. Never auto-applies.

What tools does jobwatch expose?

9 in total: 7 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is jobwatch safe to connect to an agent?

With care. The audit graded it B (86/100) and found 9 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does jobwatch need?

It reads ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does jobwatch run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as jobwatch.

How current is this page?

The grade is for one exact copy of the source (6c835ccc8381), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement