com.mambabuilt/mcp-account-hiring-watch
NPM · @MAMBALABSDEV/MCP-ACCOUNT-HIRING-WATCH
Watch company job boards for new, closed, and reposted postings, with 30 day hiring velocity.
Available components
Last scanned (6 hours ago)
Scores higher than 39% of npm servers
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability57
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 868 tokens (~868/item across 1 items; 1 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 1 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 1 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 18 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Oct 26 +1
- Tool safety: pass → unverified ▼ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: unverified → 0.03 ▲ functional
- First check of Schema quality: unverified functional
- Package version: 1.0.0 → 1.0.1 functional
- 15 Oct 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 18 Oct 2026 · Analysed npm/@mambalabsdev/mcp-account-hiring-watch@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 92 packages
| Packages resolved | 92 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
watch_account_hiring Watch account hiring ~868
Watch a list of company domains and get back only what changed on their job boards since the last run with the same watch name: new, closed, and reposted postings, read live from 17 job boards including Greenhouse, Lever, Ashby, and Workday. Each change row carries the full job description, a stable posting key, and the board it came from; each company also gets a summary row with open postings and 30 day hiring velocity. The first run for a watch sets the baseline, and its rows are marked is_backfill and never charged. Optional signed webhook delivery. A run that does not succeed is returned as an error with its run ID. Read-only on the boards; requires an APIFY_TOKEN and consumes Apify credits per change returned.
| Name | Type | Req | Description |
|---|---|---|---|
| board_hints | array | – | Point a domain at its job board when the watch cannot find it, as domain=provider:slug, for example acme.com=greenhouse:acmeinc or acme.com=workday:acme.wd5/External. Providers: greenhouse, lever, as… |
| closed_after_misses | string | – | A posting closes after this many complete board reads without it. A partial read never counts. 1 to 5. Default 2. |
| custom_keywords | array | – | Extra title keywords, matched on whole words. Prefix with T1: for the strongest tier or T3: for the weakest; no prefix is tier 2. Adding any keyword also adds the Custom category. |
| description_max_chars | string | – | Longest description kept per row. job_description_chars always reports the full length. 500 to 100000. Default 20000. |
| domains | array | yes | Company website domains to watch, for example stripe.com. The watch reads each company's own job board. Up to 2,000 per run. |
| first_run_mode | string | – | What a domain's first run returns. recent returns postings the board dates inside the last N days, baseline_only returns the summary row, all_open returns every open posting. First run rows are marke… |
| first_run_recent_days | string | – | With first_run_mode recent: how many days back counts as recent. 1 to 30. Default 7. |
| include_job_description | string | – | Adds the full description text to new and reposted rows. Closed rows carry no description. Default true. |
| keyword_categories | array | – | Only changes to postings whose title matches these role categories are returned and charged. All returns every posting change. Every posting still counts toward hiring velocity. Default ["All"]. |
| max_charge_usd | string | – | Optional. When the next change would take this run's charges over this amount, the remaining changes are held and delivered first on the next run. |
| max_domains | string | – | Domains past this number are skipped. 1 to 2000. Default 500. |
| repost_window_days | string | – | A closed posting that comes back inside this many days is reported as reposted, not new. 7 to 60. Default 30. |
| state_store | string | – | Optional key value store that holds the watch state. Leave empty to use the store account-hiring-watch-state in your own Apify account. |
| watch_name | string | – | Keeps separate watch lists apart. Use one name per list or client. Changing the name starts a new watch, and its first run sets the baseline. Default default. |
| webhook_batch_mode | string | – | batch sends up to 50 changes per request, grouped by company. per_change sends one request per change, for tools where one request is one row (Clay table webhooks, Zapier). Default batch. |
| webhook_secret | string | – | Required with webhook_url. Signs each request (HMAC SHA256). A whsec_ prefixed secret is base64 decoded per the Standard Webhooks spec. |
| webhook_url | string | – | Optional HTTPS endpoint. Changes are sent as signed Standard Webhooks requests, and a change is charged only after your endpoint answers 2xx. |
No output schema declared.
No examples provided.
How do I install the com.mambabuilt/mcp-account-hiring-watch server?
com.mambabuilt/mcp-account-hiring-watch runs locally as an npm package, launched with npx -y @mambalabsdev/mcp-account-hiring-watch. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @mambalabsdev/mcp-account-hiring-watch
claude mcp add com-mambabuilt-mcp-account-hiring-watch -- npx -y @mambalabsdev/mcp-account-hiring-watch
What is the com.mambabuilt/mcp-account-hiring-watch server?
com.mambabuilt/mcp-account-hiring-watch is listed in the public MCP registry as com.mambabuilt/mcp-account-hiring-watch. Watch company job boards for new, closed, and reposted postings, with 30 day hiring velocity. This page covers its npm package (@mambalabsdev/mcp-account-hiring-watch).
Is the com.mambabuilt/mcp-account-hiring-watch server safe to use?
com.mambabuilt/mcp-account-hiring-watch scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 18 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.mambabuilt/mcp-account-hiring-watch server expose?
com.mambabuilt/mcp-account-hiring-watch exposes 1 tool: watch_account_hiring. Their descriptions and schemas cost roughly 868 tokens of context every time the server is loaded.
Is the com.mambabuilt/mcp-account-hiring-watch server still maintained?
com.mambabuilt/mcp-account-hiring-watch is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the com.mambabuilt/mcp-account-hiring-watch server under?
com.mambabuilt/mcp-account-hiring-watch declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.