Neuromancer Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Neuromancer Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Your résumé, as a remote MCP server.
Most job-search tooling built on the Model Context Protocol points one way. A candidate's agent auto-applies to job boards, or a recruiter's agent screens a stack of résumés. This flips the direction. You publish yourself as a remote MCP server, and a company's agent connects with one command to learn about you and, if there's a fit, reach out.
claude mcp add --transport http you https://mcp.example.com/api/mcpThen, inside their agent:
"Look up this candidate. What have they shipped with agents? If they fit our staff engineer role, get in touch."
The agent calls about_me, reads get_experience and list_projects, runs the role past fit_for_role, checks availability, and if it adds up, calls contact_me. You get an email.
No recruiter has to use this, and there is no discovery layer that routes agents to personal MCP servers today. But anyone who would bother to connect is exactly the kind of person worth hearing from, and making yourself addressable by an agent is itself the signal. Treat this as a high-signal, low-volume channel and a working reference implementation, not a traffic firehose.
Eight tools and one resource. Everything is read-only except contact_me. Every tool returns human/LLM-readable text and machine-parseable structuredContent (validated against an outputSchema), so both frontier agents and simpler programmatic clients get value.
| Tool | Input | What it does |
|---|---|---|
about_me | none | Short bio, education, and key links. The entry point. |
get_profile | none | The entire profile in one call (text + structured). Use when you want everything at once. |
get_experience | area? | Work history, filtered at the bullet level by tag (e.g. agents returns only the agent bullets, not the whole role). |
list_projects | tag? | Public, shipped work with links. Proof, not claims. |
search | query | Free-text keyword search across experience, projects, and skills. |
fit_for_role | job_description | Returns the full background framed against the role for the calling agent to judge. The server runs no model — a non-LLM client gets context, not a verdict. |
availability | none | What the owner is open to, so an agent can self-qualify before reaching out. |
contact_me | from, message, context? | Notifies the owner by email that someone wants to connect, and returns a booking link. Inbound only, rate-limited, and idempotent (dedupes accidental repeats). |
Plus a resource, profile://me, which returns the whole profile as one document for clients that prefer to ground on a resource instead of calling tools. (Tools-only clients that don't support resources can use get_profile instead.)
A JSON liveness check is at GET /api/health (and GET /health locally).
Any MCP client works (Claude Code, Claude Desktop, Cursor, Windsurf, or your own agent). With Claude Code:
claude mcp add --transport http <name> https://<host>/api/mcp
# talk to your agent, then remove it with:
claude mcp remove <name>To explore it visually, point the MCP Inspector at the same URL:
npx @modelcontextprotocol/inspector
# Transport: Streamable HTTP, URL: https://<host>/api/mcp(Running locally, the endpoint is http://localhost:3000/mcp via the Express dev server.)
This repo is built to be forked. The whole profile lives in one file.
src/profile.ts. It is the single source of truth.The server never invents or fetches anything; it only reads from this file. Keep it to public, share-anything facts. Private contact details stay out of the file by design (see below).
.env.example to .env and fill in the values you want (see Configuration).claude mcp add line on your site.
Start the dev server (Express, Streamable HTTP):
npm install
npm run dev # serves http://localhost:3000/mcpThe fastest way to poke every tool by hand. With the dev server running:
npx @modelcontextprotocol/inspectorIt opens a browser UI. Set Transport: Streamable HTTP, URL: `http://localhost:3000/mcp`, click Connect, and you'll see all eight tools plus the profile://me resource, each callable from a form.
Note the Accept header must list both application/json and text/event-stream.
# list tools
curl -s http://localhost:3000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
# call a tool
curl -s http://localhost:3000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"about_me","arguments":{}}}'
# read the resource
curl -s http://localhost:3000/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":3,"method":"resources/read","params":{"uri":"profile://me"}}'Point Claude Code or Codex at the local server, drive it conversationally, then remove it:
# Claude Code
claude mcp add --transport http rahul-local http://localhost:3000/mcp
claude mcp remove rahul-local
# Codex
codex mcp add rahul-local --url http://localhost:3000/mcp
codex mcp remove rahul-localAll optional. With nothing set, the server runs and contact_me falls back to a dry run that logs the message instead of sending it, so the project works the moment you clone it.
| Variable | Purpose |
|---|---|
PORT | Local port. Defaults to 3000. |
RESEND_API_KEY | Resend API key, so contact_me can send email. |
CONTACT_TO_EMAIL | Where contact_me notifications are delivered (your inbox). |
CONTACT_FROM_EMAIL | Sender address. Must be verified in Resend. Defaults to Resend's test sender, which delivers to your own account email. |
sessionIdGenerator: undefined). Everymessage is a POST /mcp and the server replies with plain JSON. A fresh server and transport are built per request, so concurrent callers never collide on message IDs, and the same code drops onto serverless without changes.
fit_for_role does not score or keyword-match. It hands thecalling agent the full background plus the role and asks for an honest verdict. The frontier model on the other end does the semantic judgment, which is better than anything a matcher in this repo could do.
contact_me notifies the owner. It never emails thirdparties on the owner's behalf. Inputs are length-capped and validated by the schema before the handler runs, and a small per-IP rate limit guards the endpoint.
CONTACT_TO_EMAIL from theenvironment, so a public repo never exposes a scrapable address.
Production runs on Vercel as a serverless function (api/mcp.ts), while local dev uses the Express server. Both register the same tools via src/capabilities.ts. See DEPLOY.md for the full walkthrough: import, environment variables, custom domain, and turning off Deployment Protection.
MIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.