No red flags found in any of the 11 categories — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against the SlowMist agent-security taxonomy, refreshed every 8 hours. Full audit →
by workopia · MCP Server · ★ 304
Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h
🔒 Is workopia-mcp safe to install? View the security audit →
Workopia MCP Server Job search, resume tailoring, cover letters & application tracking — available via the Model Context Protocol for Claude Code, Claude Desktop, Cursor, Windsurf, and other MCP clients. Note: This is a hosted MCP server. Connect via the public endpoint below and sign in with Workopia (OAuth) — no API key to manage. All tools require a free Workopia sign-in; searching, job detail, resume tailoring, cover letters, and your dashboard are all scoped to your account. Resume tailoring and cover letters run on your own AI client's model — Workopia hosts no LLM and never charges for AI. Endpoint Transport: Streamable HTTP Auth: OAuth 2.0 (Dynamic Client Registration + PKCE; handled automatically by the client) Website: https://workopia.io Install as a Claude Code plugin On first tool use, Claude Code opens the Workopia OAuth flow in your browser; the token is then stored and refreshed automatically. Tools | coverle
| Stars | 304 |
| Forks | 20 |
| Language | JavaScript |
| Category | MCP Server |
| License | MIT |
| Quality Score | 72.6971772123483/100 |
| Last Updated | 2026-08-31 |
| Created | 2026-04-14 |
| Platforms | claude-code, mcp, node |
| Est. Tokens | ~3k |
Explore other popular mcp server tools:
workopia-mcp is Workopia MCP Server — free job search, resume builder & career advice for Claude, ChatGPT, Cursor.. It is categorized as a MCP Server with 304 GitHub stars.
workopia-mcp is primarily written in JavaScript.
You can find installation instructions and usage details in the workopia-mcp GitHub repository at github.com/workopia/workopia-mcp. The project has 304 stars and 20 forks, indicating an active community.
workopia-mcp is released under the MIT license, making it free to use and modify according to the license terms.
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy, covering 11 red-flag categories including credential harvesting, data exfiltration, and curl | sh installers. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: