Jobjourney Claude Plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Jobjourney Claude Plugin (Plugin) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A production-ready MCP server for JobJourney with AI job-search tools, local job discovery, and scheduled scraping from Claude.
~/.jobjourney/jobs.dbUse it naturally from Claude:
"Usediscover_jobswith keywordfull stack, locationSydney, sourcesseek, pages1."
"Use search_jobs and show me the latest LinkedIn roles in Sydney.""Use schedule_discovery to run every day at 9am for backend jobs in Melbourne.""Evaluate how well my resume matches this job and draft a cover letter."
If you want product screenshots or GIFs later, this is the right place to add them.
claude mcp add jobjourney \
-e JOBJOURNEY_API_URL=https://server.jobjourney.me \
-e JOBJOURNEY_API_KEY=jj_your_api_key_here \
-e TRANSPORT=stdio \
-- npx -y jobjourney-claude-plugin@latestAdd this to your Claude Desktop config file (claude_desktop_config.json):
{
"mcpServers": {
"jobjourney": {
"command": "npx",
"args": ["-y", "jobjourney-claude-plugin@latest"],
"env": {
"JOBJOURNEY_API_URL": "https://server.jobjourney.me",
"JOBJOURNEY_API_KEY": "jj_your_api_key_here",
"TRANSPORT": "stdio"
}
}
}
}For local browser-backed sources like SEEK, install a browser once:
npx playwright install chromiumclaude mcp add jobjourney \
-e JOBJOURNEY_API_URL=https://server.jobjourney.me \
-e JOBJOURNEY_API_KEY=jj_your_api_key_here \
-e TRANSPORT=stdio \
-- npx -y jobjourney-claude-plugin@latestFrom Claude:
Use login_jobsite with site "seek"From Claude:
Use discover_jobs with keyword "full stack", location "Sydney", sources ["linkedin", "seek"], pages 1Use search_jobs with source "linkedin" and limit 5Use schedule_discovery with keyword "full stack", location "Sydney", time "09:00", sources ["linkedin", "seek"]| Source | Status | Transport | Notes |
|---|---|---|---|
linkedin | Active | HTTP guest scraping | Primary supported LinkedIn path |
seek | Active | Playwright | Local browser session support |
indeed | Planned | Playwright | Not implemented yet |
jora | Planned | Playwright | Not implemented yet |
| ATS | Support |
|---|---|
greenhouse | Detect + expand |
lever | Detect + expand |
workday | Detect only |
smartrecruiters | Detect only |
ashby | Detect only |
The local discovery engine lives under src/discovery and uses one canonical job model across all sources.
Local runs are stored in:
~/.jobjourney/jobs.db~/.jobjourney/agent-heartbeat.jsonThe database stores:
This MCP exposes a broad JobJourney toolset. For local discovery, these are the most important ones:
| Tool | What it does |
|---|---|
discover_jobs | Run the canonical multi-source discovery engine and store results locally |
search_jobs | Query jobs already stored in local SQLite |
schedule_discovery | Schedule recurring local discovery runs |
get_latest_discovery_report | Show the latest discovery batch summary |
scrape_jobs | Legacy one-off local scrape path |
login_jobsite | Save browser login state for supported sites |
check_login_status | Confirm browser login state |
And the broader platform also includes:
src/
index.ts # FastMCP server entrypoint
tools/ # MCP tool registration
discovery/ # Canonical local discovery engine
core/ # orchestration and job types
sources/ # linkedin guest, seek browser, planned sources
ats/ # ATS detection and supported crawlers
analysis/ # salary, tech stack, PR, experience enrichment
fallback/ # optional company career-page probing
storage/ # discovery persistence adapters
parity/ # TS vs Python parity harness
scraper/ # legacy browser scraper layer, being phased down
storage/sqlite/ # SQLite repos and migrations
agent/ # background scheduling agent
config/ # path and runtime configBuilt with FastMCP, TypeScript, Zod, Playwright, and SQLite.
| Variable | Description | Default |
|---|---|---|
JOBJOURNEY_API_URL | JobJourney backend base URL | https://server.jobjourney.me |
JOBJOURNEY_API_KEY | API key for backend-authenticated features | - |
TRANSPORT | MCP transport: stdio or httpStream | stdio |
PORT | HTTP port when TRANSPORT=httpStream | 8080 |
git clone https://github.com/Rorogogogo/jobjourney-claude-plugin.git
cd jobjourney-claude-plugin
npm install
npx playwright install chromium
npm run build
npm test
npm run typecheckUseful local commands:
npm run start
npm run agent
npm run parity:discovery
npm run parity:live-smokeContributions are welcome. Useful contribution areas right now:
src/discovery architectureindeed and jorasrc/scraperStandard flow:
git checkout -b feature/my-change
npm test
npm run typecheck
git commit -m "feat: my change"AGPL-3.0 + Commercial © JobJourney
This project is dual-licensed:
| Use case | License |
|---|---|
| Personal use / running locally | AGPL-3.0 (free) |
| Forking and publishing under AGPL-3.0 | AGPL-3.0 (free) |
| Bundling into a closed-source product | Commercial |
| Hosting a modified version as a SaaS without publishing source | Commercial |
| Internal company tool not open-sourced | Commercial |
For a commercial license, contact Robert Wang at [email protected] — see COMMERCIAL.md for what to include in your request.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.