com.rolnia/mcp
NPM · @ROLNIA/MCP
Profile, CV, jobs, compensation & application-tracking tools for AI agents, by rolnia.com.
Available components
Last scanned (9 hours ago)
Scores higher than 38% of npm servers
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 34 of 106 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency6
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 40 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2907 tokens (~161/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Nov 26 0
- Stability: 0.97 → pass security
- 31 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 22 Oct 26 0
- Stability: 0.97 → pass security
- 21 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Oct 26 −1
- Stability: pass → 0.93 functional
- 17 Oct 26 +2
- Stability: 0.80 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@rolnia/mcp@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 106 packages
| Packages resolved | 106 |
|---|---|
| Stale | 34 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
analyze_compensation_for_job ~203
Analyze how a specific JD (by jd_id from the Jobs Module) or a free-text role+location compares to market compensation. Returns market percentiles, the user's position if comp data is on file, and AI insights.
| Name | Type | Req | Description |
|---|---|---|---|
| advertised_salary_max | number | – | Maximum advertised salary if known. |
| advertised_salary_min | number | – | Minimum advertised salary if known. |
| experience_level | string | – | Experience level (mirrors browser field name; entry/mid/senior/etc.). |
| jd_id | string | – | Job Description ID from the Jobs Module library (from list_jobs, get_job, or list_tracked_jobs.jd_id). If provided, the tool fetches the JD and extracts title + location + experience_level + advertis… |
| job_title | string | – | The job title. Required if jd_id is not provided. |
| location | string | – | The job location (free-text). Required if jd_id is not provided. |
No output schema declared.
No examples provided.
analyze_job_fit ~236
Analyze how well your CV (also called resume — terms interchangeable) profile matches a specific job description. Mirrors the working browser flow at src/app/jobs/page.tsx:461-494: stage 1 calls the gated job-fit BFF /api/analyze/job-fit (which meters the job_fit_analysis quota, then forwards to the Python analyzer), stage 2 persists to Go /api/v2/job-analyses (best-effort). Returns alignment scores (0-100 scale), strengths, weaknesses, recommendations. Enum hints (documented for agent UX, not enforced here — upstream may relax): • level: entry | mid | senior | lead | principal • recommendation: strong-fit | fit | partial-fit | not-fit Returns envelope.meta.score_scale="0-100" and envelope.meta.persisted=<bool>.
| Name | Type | Req | Description |
|---|---|---|---|
| candidate_profile_id | string | – | Optional CV profile id (discover via list_cv_profiles). Defaults to the most-recently-uploaded CV profile (profiles[0]). |
| jd_id | string | yes | The job description ID (from list_jobs, get_job, or import_job_from_url). |
No output schema declared.
No examples provided.
generate_cover_letter ~217
Generate a customized cover letter for a specific job description using AI. Uses your CV (also called resume — terms interchangeable) profile as the candidate context. Optionally persists the result to your library. Focus values: 'balanced' | 'cv-focused' | 'job-focused' (DB-enforced). Synonyms accepted; unknown values fall back to 'balanced'. Response includes the resolved focus on envelope.echo.input_focus and the normalized value on envelope.meta.focus_used.
| Name | Type | Req | Description |
|---|---|---|---|
| cv_profile_id | string | – | Optional CV profile id (from /api/v2/candidate-profiles). Defaults to the first available CV profile. |
| focus | string | – | Letter focus: one of 'balanced' | 'cv-focused' | 'job-focused' (matches browser+DB). Common synonyms ('professional', 'formal', 'cv', 'job') are normalized; unknown values fall back to 'balanced'. |
| jd_id | string | yes | The job description ID. |
| persist | boolean | – | If true, also stores the generated letter to your library. |
No output schema declared.
No examples provided.
get_compensation_for_role ~253
Fetch compensation benchmarks for a role. Two modes: (1) JD-context — pass jd_id from list_jobs/get_job/list_tracked_jobs.jd_id (RECOMMENDED for SG roles; mirrors browser pattern, closest-match relaxation via Gemini applies automatically). (2) Free-text US benchmark — pass role_title + country='US' for a US benchmark via the compensation analyze endpoint (job_id empty → no persistence). For SG roles without a jd_id, call import_job_from_url first to obtain a jd_id with extracted SSOC codes.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City (US: drives MSA selection). |
| country | string | – | Country. Defaults to US. SG REQUIRES jd_id. |
| jd_id | string | – | JD id from list_jobs/get_job/list_tracked_jobs.jd_id. Required for SG roles; recommended for US roles. When present, role_title/country/seniority/city/state are ignored (read from the JD). |
| role_title | string | – | Role title — required only when jd_id is omitted. |
| seniority | string | – | Seniority level. Applies a multiplier to the median. |
| state | string | – | State or region (US). |
No output schema declared.
No examples provided.
get_cv_download_url ~290
Return a short, copy-paste-friendly download URL for a previously-generated CV (also called resume — terms interchangeable). Use this when the original signed URL from rewrite_cv_for_job has expired (1 hour TTL) or got line-wrapped in the chat client. The returned short_url routes through the app's /d/[code] redirect, which re-signs the stored Supabase object on each follow (no DOCX/PDF re-render). Short URL itself is valid for 7 days. IMPORTANT: format is fixed at the time the CV was generated by rewrite_cv_for_job — this tool does NOT re-render across formats. If you need a different format than was originally generated, call rewrite_cv_for_job again with the desired export_format. PDFs generated via MCP are rendered with contentType='standard' and length='3_page'; this is fixed at generation time.
| Name | Type | Req | Description |
|---|---|---|---|
| cv_id | string | yes | The job-linked CV id (uuid) from rewrite_cv_for_job.ids.cv_id or list_generated_cvs[].id (Chunk D). |
| format | string | – | Export format. v0.4.0 supports both 'docx' and 'pdf' end-to-end. Format must match the one used at the original rewrite_cv_for_job call (no cross-format re-render). |
| template | string | – | Render template. Defaults to 'tech'. See multi-template docs (Chunk E). |
No output schema declared.
No examples provided.
get_job ~111
Fetch a single Job Description by id from the user's Jobs Module library. Returns the full parsed JD content (parsed_content, salary, classification codes). This is the canonical lookup used by analyze_job_fit, generate_cover_letter, and rewrite_cv_for_job. For Job Tracker pipeline entries (status/dates/notes), use get_tracked_job.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The Job Description ID (jd_id). Get from list_jobs, list_tracked_jobs (via jd_id field), or import_job_from_url. |
No output schema declared.
No examples provided.
get_profile ~31
Fetch the authenticated user's candidate profile including about, experience, education, and skills. Safe for display to the user.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_server_info ~41
Returns MCP server version, commit SHA, environment, and deployment timestamp. Useful for bug reports and debugging which version of the MCP is responding. No authentication required.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_tracked_job ~66
Fetch a specific job from the Job Tracker pipeline by ID. Returns the full tracker row (status, dates, jd_id). The job_tracker table does not store free-text notes — activity history lives on the activities endpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The Job Tracker row ID. |
No output schema declared.
No examples provided.
import_job_from_url ~91
Import a job listing from a URL. The backend auto-detects LinkedIn vs other sources. Parses the JD, persists it to the Jobs Module library, and returns the new jd_id for use with analyze_compensation_for_job, analyze_job_fit, generate_cover_letter, and rewrite_cv_for_job.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to the job listing (LinkedIn or any direct JD URL). |
No output schema declared.
No examples provided.
import_resume_from_text ~102
Import a resume (also called CV — terms interchangeable) from plain text. Parses the text and persists it as a new CV profile in the user's candidate-profiles library. Returns the new cv_profile_id for use with analyze_job_fit, generate_cover_letter, and rewrite_cv_for_job.
| Name | Type | Req | Description |
|---|---|---|---|
| cv_text | string | yes | The resume content as plain text. |
| profile_name | string | – | Optional name for the saved CV profile (defaults to "Imported Resume"). |
No output schema declared.
No examples provided.
list_cv_profiles ~125
List the user's CV profiles (CV and resume are interchangeable terms — this tool covers both) as a summary view (id, profile_name, display_name, headline, created_at). For full parsed_content (skills, experience, education), use the returned id with analyze_job_fit, generate_cover_letter, or rewrite_cv_for_job. Backend ordering is created_at DESC; if you omit cv_profile_id on downstream tools, the most-recent (index [0]) is used.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Optional client-side cap on returned profiles. Backend ordering is created_at DESC. |
No output schema declared.
No examples provided.
list_generated_cvs ~172
List the user's AI-rewritten CVs (also called resumes — terms interchangeable in this MCP) generated by rewrite_cv_for_job. Returns a summary view (id, name, original_cv_profile_id, jd_id, focus_type, template, created_at). Backend ordering is created_at DESC; index [0] is the most recent. To download a previously-generated CV, call get_cv_download_url(cv_id, format) — note format is fixed at the time of generation: if you generated a docx and now want PDF, you must call rewrite_cv_for_job(..., export_format='pdf') again. There is no cross-format on-demand re-render in v0.4.0.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Optional client-side cap on returned generated CVs. Backend ordering is created_at DESC. |
No output schema declared.
No examples provided.
list_jobs ~83
List your Jobs Module library as a summary view (id, title, company, location, brief summary). For full parsed_content / classification codes / salary bands, call get_job with the returned id. For active-pipeline rows with status, call list_tracked_jobs.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Number of jobs to return. |
| offset | integer | – | Pagination offset. |
No output schema declared.
No examples provided.
list_tracked_jobs ~79
List jobs the user is actively pursuing (Job Tracker pipeline — saved/applied/interviewing/offer/not_offered/accepted). Returns paginated tracker rows with status metadata. For the full library of imported JDs, use list_jobs.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Number of jobs to return. |
| offset | integer | – | Pagination offset. |
No output schema declared.
No examples provided.
rewrite_cv_for_job ~532
Generate a CV (also called a resume — terms interchangeable in this MCP) tailored to a specific job description. Optionally persists and returns a structured export descriptor: data.export.url (long signed download URL), data.export.short_url (chat-client-friendly short URL — new in v0.3.0), expires_at, content_type, size_bytes, filename. Set export_format to "docx" (default) or "pdf" — both formats route through the same /d/[code] short-URL flow. Use get_cv_download_url to mint a fresh short URL after the original expires; the re-mint preserves the original format (no cross-format re-render). Note: MCP-generated PDFs always render with contentType='standard' and length='3_page' regardless of what variation you previewed in the browser UI — the MCP layer does not expose those knobs in v0.4.0. To get a different variation, change the variation in the browser UI and use its Export PDF button. PDFs render with all sections visible; if you toggled sections off in the browser UI, that state does not propagate to MCP PDFs.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | – | Save-side color. Defaults to blue. |
| content_style | string | – | Optional content style knob. |
| content_type | string | – | Defaults to natural; ats also supported. |
| cv_profile_id | string | – | Optional CV profile id (from /api/v2/candidate-profiles). Defaults to first available. |
| export_format | string | – | Export format. 'docx' (default) or 'pdf'. PDF path reuses the same Chunk C.1 short-URL flow as docx (same /d/[code] redirect, same cv_short_links table) — your returned data.export.short_url just res… |
| industry | string | – | Optional industry. |
| jd_id | string | yes | The job description ID. |
| page_length | string | – | Defaults to 3_page. |
| paper_size | string | – | Save-side paper size. Defaults to letter. |
| persist | boolean | – | If true, persist and call export. |
| role_level | string | – | Optional role level. |
| template | string | – | Save-side template (e.g. tech). Defaults to tech. |
| template_type | string | – | CV template (e.g. modern, tech). Defaults to modern. |
No output schema declared.
No examples provided.
signup_url ~47
Generate a signup URL for a new user. Includes MCP attribution and client tracking parameters. No authentication required.
| Name | Type | Req | Description |
|---|---|---|---|
| utm_content | string | – | Optional UTM content tag for tracking specific campaigns. |
No output schema declared.
No examples provided.
track_job ~228
Add a job to the user's Job Tracker pipeline (the same tracker shown at /job-tracker, listed by list_tracked_jobs). Use after import_job_from_url / rewrite_cv_for_job to record that the user is pursuing a role. title and company are required; status defaults to "Saved" (valid: Saved, Applied, Interviewing, Offer, Not Offered, Accepted). Pass jd_id to link the imported JD and linkedCvId to link a generated CV/résumé. Returns the new tracker_id.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | yes | Company name. |
| jd_id | string | – | jd_id from import_job_from_url, to link the imported JD. |
| linkedCoverLetterId | string | – | Generated cover-letter id to link (camelCase key — matches the backend contract). |
| linkedCvId | string | – | Generated CV/résumé id to link (camelCase key — matches the backend contract). |
| source_url | string | – | Original job posting URL. |
| status | string | – | Pipeline status. Defaults to "Saved". |
| title | string | yes | Job title. |
No output schema declared.
No examples provided.
How do I install the com.rolnia/mcp server?
com.rolnia/mcp runs locally as an npm package, launched with npx -y @rolnia/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @rolnia/mcp
claude mcp add com-rolnia-mcp -- npx -y @rolnia/mcp
What is the com.rolnia/mcp server?
com.rolnia/mcp is listed in the public MCP registry as com.rolnia/mcp. Profile, CV, jobs, compensation & application-tracking tools for AI agents, by rolnia.com. This page covers its npm package (@rolnia/mcp).
Is the com.rolnia/mcp server safe to use?
com.rolnia/mcp scores 70 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.rolnia/mcp server expose?
com.rolnia/mcp exposes 18 tools: get_profile, import_resume_from_text, import_job_from_url, list_jobs, get_job, and 13 more. Their descriptions and schemas cost roughly 2,907 tokens of context every time the server is loaded.
Is the com.rolnia/mcp server still maintained?
com.rolnia/mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.