Dreamwork
NPM · @DREAMWORKHQ/MCP · 2 COMPONENTS
Job search, application materials, and application tracking for AI assistants.
Available components
Last scanned (16 hours ago)
Scores higher than 58% of npm servers
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 1.31.0, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 31 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to dreamworkhq/mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 9282 tokens (~130/item across 71 items; 71 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 70% of tool parameters carry a description.Partial
- Structured output schemas are declared (77% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 72 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Oct 26 +21
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.85 ▲ functional
- 21 Oct 26 −5
- Known CVEs: fail → unverified ▼ security
- Dependency health: 0.85 → unverified ▼ functional
- Package version: 1.9.0 → 1.9.1 functional
- 20 Oct 26 −19
- CVE-2026-111767 affects this package: high ▼ security
- CVE-2026-111769 affects this package: high ▼ security
- CVE-2026-111771 affects this package: high ▼ security
- CVE-2026-111768 affects this package: high ▼ security
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → fail ▼ security
- Package version: 1.8.1 → 1.9.0 functional
- 19 Oct 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.10 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 1.8.0 → 1.8.1 functional
- 18 Oct 26 +2
- Stability: unverified → 0.10 ▲ functional
- Package version: 1.7.0 → 1.8.0 functional
- 15 Oct 26 +42
- CVE-2026-104850 no longer affects this package ▲ security
- Injection markers: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → 100 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Dependency health: unverified → 0.85 ▲ functional
- First check of Tool coverage: 70 functional
- First check of Tool coverage: 77 functional
- First check of Schema quality: fail functional
- First check of Schema quality: good functional
- First check of Destructive annotations: 100 functional
- First check of Schema quality: fail functional
- 14 Oct 26 −6
- Known CVEs: fail → unverified ▼ security
- Provenance: pass → unverified ▼ security
- CVE-2026-104850 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- Dependency health: 0.85 → unverified ▼ functional
- Package version: 1.5.2 → 1.7.0 functional
- Package version: 1.5.2 → 1.6.0 functional
- 12 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Analysed npm/@dreamworkhq/mcp@1.9.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | dreamworkhq/mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/dreamworkhq/mcp/.github/workflows/publish-registry.yml@refs/tags/mcp-v1.9.1 |
| Rekor log index | 3346568502 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:d4b35fa32261573714689a5e4f1a70f02e2cc95340399fc2ad969bea1fe9897adab6a4d05f80c4004fe1a809be8eada265d9db2f98e78aa7c29601214 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 4 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-22jm-h49p-29qw | CVE-2026-111767 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L | yes |
| GHSA-46jr-4wx8-v453 | CVE-2026-111768 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
| GHSA-6prh-2h8m-c8cw | CVE-2026-111769 | medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N | yes |
| GHSA-rvq5-wwqv-78pq | CVE-2026-111771 | medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
mark_applied_offsite Record an application made elsewhere ~266
Records an application the account holder submitted outside Dreamwork. Exactly one of matchId, listingId or url names the role; a role not yet in the pipeline is added in Applied without generating materials, and an unlisted URL is imported in the background. appliedAt (YYYY-MM-DD or ISO 8601, not in the future) is the reported application date and defaults to now; repeating the call with a new appliedAt corrects it. attestation:true is required and represents the person's confirmation that submission occurred. Recorded roles are excluded from matches and Autopilot. Applications Dreamwork is still sending are refused. There is no undo. This call does not send an application.
| Name | Type | Req | Description |
|---|---|---|---|
| appliedAt | – | – | When they applied, as YYYY-MM-DD or an ISO 8601 timestamp. Not in the future. Omitted means now. |
| attestation | boolean | yes | The person stated they applied to this role themselves. Never assumed. |
| listingId | string | – | Dreamwork listing id, from `list_matches` or `get_job`. The role does not have to be saved. |
| matchId | string | – | Board card id from `get_pipeline`. |
| url | string | – | The job posting's URL, for a role Dreamwork does not list. |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
mark_messages_read Mark recruiter messages read ~83
Marks the specified recruiter messages read within one thread. Message ids identify the exact messages presented to the account holder; other messages remain unread. The change has no undo.
| Name | Type | Req | Description |
|---|---|---|---|
| messageIds | array | yes | Ids of the messages the person was shown. |
| threadId | string | yes | The thread the messages were shown from, as `get_inbox` gave it. |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
move_pipeline Move a pipeline card ~102
Moves one role's board card to the requested column using the account holder's reported state. No employer is contacted. APPLIED records an application rather than submitting one; INTERVIEWING creates a durable interview record. WITHDRAWN removes the card from the active board. Closing a role can remove its listing from the feed. A receipt offers undo only when reversible.
| Name | Type | Req | Description |
|---|---|---|---|
| matchId | string | yes | Board card id from `get_pipeline`. |
| status | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
parse_preferences_text Set several preferences from one sentence ~56
Parses a sentence describing job preferences, applies supported fields and returns applied values and unparsed fragments. Compensation and seniority are not set by this parser and remain unparsed.
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | The person's sentence, verbatim. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | object | yes | – |
| unparsed | array | yes | Fragments no preference key could carry. |
No examples provided.
prepare_applications Prepare applications for several roles ~101
Saves and prepares materials for up to ten specified roles sequentially without submitting applications. Unsaved roles consume the daily save allowance; generation for saved roles consumes pack allowance. Finished or in-flight preparation is reused, and person-edited materials are preserved. Each role returns its own outcome.
| Name | Type | Req | Description |
|---|---|---|---|
| assets | array | – | Subset to write for every role. Omit for all three. |
| jobIds | array | yes | Listing or private-job ids, each once. |
| Name | Type | Req | Description |
|---|---|---|---|
| allowance | object | yes | – |
| receipt | object | yes | – |
| results | array | yes | – |
No examples provided.
remember_hypothesis Remember a guess about the person ~70
Stores an unconfirmed career hypothesis separately from established facts. At most twenty hypotheses may be pending; further writes are refused at that limit. The statement does not change matching preferences or become a confirmed profile fact.
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | The belief, in one sentence, phrased as a guess. |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
reopen_application_materials Edit materials for a safe retry ~53
Opens a new editable material revision only after the API establishes that a failed application cannot still submit. Access is restricted to the Applications rollout cohort admitted by the API.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | yes | Failed application ID |
| Name | Type | Req | Description |
|---|---|---|---|
| materials | object | yes | Revisioned, per-application material selection. Revision zero is the legacy fallback view; an Apply confirmation must persist a positive revision. |
No examples provided.
replace_application_document Use the person's own document for one application ~158
Replaces one application's resume or cover letter with the person's supplied text or raw-base64 PDF, DOCX, TXT or MD. The stored content is not rewritten by a model. A resume becomes the selected tailored copy; a letter becomes included. PDF resumes retain their original file, while other formats are rendered from extracted text. expectedRevision is required; locked or sent applications are refused. The account's main resume is unaffected.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | yes | – |
| document | string | yes | – |
| expectedRevision | integer | yes | The `revision` from get_application_documents or get_application_materials. |
| file | object | – | – |
| text | string | – | The whole document as the person wrote it. Send this or `file`. |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
reply_to_recruiter Reply to a recruiter ~178
Sends the supplied reply text to one existing recruiter conversation under the account holder's identity. Sending requires explicit consent and an unambiguous thread; otherwise the result is a confirmation hold containing the draft. Sent mail cannot be recalled. Threads whose ids begin with inbound: cannot receive replies through this endpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | The full reply text, as it will be sent. |
| confirmationToken | string | – | Echo the token from a previous `held` result to carry out the act it described, and only after the person has seen that result's summary and agreed to it. Send identical arguments: the token is bound… |
| threadId | string | yes | – |
No output schema declared.
No examples provided.
restore_match Restore a dismissed match ~101
Reverses the dismissal of a role, every listing with the same employer and title, so it can return to the account's match feed, job alerts and Autopilot. Restoring a listing that is not dismissed returns a no-op receipt. Restoring does not save the listing. A closed listing stays out of the feed.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | yes | Listing id, as `dismiss_match` and `list_dismissed_matches` give it. |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
restore_material Put a document back the way it was ~159
Restores a cover letter, tailored resume or answer to a recorded pre-edit version within its undo window. Arguments must match the recorded edit; arbitrary replacement text is refused. Resume restoration uses resumeRevisionId and restores the application's sendable copy.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | yes | – |
| asset | string | yes | Which asset the edit changed. |
| question | string | – | The answer's question text; required for `answers`. |
| resumeRevisionId | string | – | The tailored-resume revision to put back, from the `edit_resume` receipt. Required for `resume`. |
| text | string | – | The text that stood before the edit, from its receipt. Required for `coverLetter` and `answers`; a resume restore names a revision instead. |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
save_application_answers Save the person's application answers ~113
Saves person-stated application-answer and contact groups through onboarding validation, then rechecks readiness and completes setup when no requirements remain. statedByPerson:true attests that supplied values came from the person. eligibility.countries replaces the stored list. An empty answer set can finish otherwise-complete onboarding. Returns ready and stillMissing; no application is sent.
| Name | Type | Req | Description |
|---|---|---|---|
| answers | object | – | – |
| contact | object | – | – |
| statedByPerson | boolean | yes | The person gave every value here in this conversation. Never assumed. |
| Name | Type | Req | Description |
|---|---|---|---|
| ready | boolean | yes | – |
| receipt | object | yes | – |
| stillMissing | array | yes | – |
No examples provided.
save_job Save a job ~67
Saves one role to the account's pipeline at SAVED as a bookmark. No application is submitted or queued until apply is called. Application materials may start preparing in the background. An already saved role returns a no-op receipt.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | yes | Listing id or private-job id. |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
set_autopilot Turn Autopilot on or off ~161
Sets Autopilot on or off after explicit consent. On authorizes recurring real employer submissions under the account holder's name without per-application approval. Off stops sending and keeps the minimum match, resume choice and queue; paused is accepted and means off. Daily and monthly limits remain determined by the plan.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmationToken | string | – | Echo the token from a previous `held` result to carry out the act it described, and only after the person has seen that result's summary and agreed to it. Send identical arguments: the token is bound… |
| state | string | yes | – |
No output schema declared.
No examples provided.
start_checkout Start checkout ~214
Returns a checkout URL for the requested plan change after explicit consent. A confirmation hold precedes checkout creation. This call does not charge the account; payment details and payment confirmation occur on the billing page.
| Name | Type | Req | Description |
|---|---|---|---|
| billingInterval | string | – | How often to invoice, only when the person named one; omitted means monthly. Quarterly is one invoice every three months at about 15% less than three monthly ones. A promo code prices a monthly invoi… |
| confirmationToken | string | – | Echo the token from a previous `held` result to carry out the act it described, and only after the person has seen that result's summary and agreed to it. Send identical arguments: the token is bound… |
| plan | string | yes | The plan the person asked for. |
| promoCode | string | – | Only when the person supplied one. |
No output schema declared.
No examples provided.
strengthen_application Strengthen a whole application ~124
Improves an application's existing materials against its role and recorded career evidence, spending one refine allowance per changed asset. emphasis adding numbers, titles, employers, dates or credentials requires evidenceIds. Unsupported resume entry headers are rejected; previously completed asset edits are retained if a later asset fails.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | yes | – |
| emphasis | string | – | What the person wants foregrounded, when they said. Omit otherwise. |
| evidenceIds | array | – | Ids of the person's work-vault documents, or of facts on them, that support a claim the emphasis adds. |
| Name | Type | Req | Description |
|---|---|---|---|
| diff | – | yes | – |
| receipt | object | yes | – |
No examples provided.
undo_last Undo the last thing that can be undone ~66
Reverses the latest action with an available undo, or the action identified by taskId. Sent applications, settled charges, expired undo windows and actions without a reversible outcome are refused with a reason.
| Name | Type | Req | Description |
|---|---|---|---|
| taskId | string | – | Undo this specific task instead of the most recent one. |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
update_application_materials Update application materials ~100
Updates an application's resume selection, resume or cover-letter contents or inclusion at the expected optimistic revision. Access is restricted to the Applications rollout cohort admitted by the API. Locked or conflicting revisions are refused.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | yes | Application ID |
| coverLetter | string | – | – |
| coverLetterIncluded | boolean | – | – |
| expectedRevision | integer | yes | – |
| resumeHtml | string | – | – |
| resumeVariant | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| materials | object | yes | Revisioned, per-application material selection. Revision zero is the legacy fallback view; an Apply confirmation must persist a positive revision. |
No examples provided.
update_autopilot_settings Change Autopilot settings ~171
Changes the minimum Matches score from 50 to 97, with null restoring 70, or the default-versus-tailored resume choice. Explicit consent is required. Changes apply to waiting applications and are rechecked before submission. This does not enable or resume Autopilot, recall sent applications or retry stopped applications.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmationToken | string | – | Echo the token from a previous `held` result to carry out the act it described, and only after the person has seen that result's summary and agreed to it. Send identical arguments: the token is bound… |
| resumeVariant | string | – | – |
| scoreFloor | – | – | – |
No output schema declared.
No examples provided.
update_communication_preferences Change email preferences ~107
Changes the supplied optional email categories while preserving omitted settings. allOptionalEmailsOff:true must be supplied alone; conflicting category settings are refused. Disabling Autopilot result mail does not stop applications. Account, security, billing and essential employer mail are unaffected.
| Name | Type | Req | Description |
|---|---|---|---|
| allOptionalEmailsOff | boolean | – | Turn every optional email off. Send it on its own. |
| autopilotResults | string | – | – |
| jobAlerts | string | – | – |
| productUpdates | boolean | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
update_preferences Update job preferences ~142
Merges the supplied preference fields into the account's stored preferences and refreshes matching. compensation.kind is open or minimum; minimum requires minimumAmount, an ISO-4217 currency and an hour or year period. seniorities accepts one override level; an empty list restores resume-derived seniority. excludedCompanies, excludedPlaces and excludedSeniorities replace the lists of companies, places and levels hidden from matches, alerts and Autopilot; an excludedPlaces name that cannot be placed refuses the write. Autopilot never applies below the pay floor or outside the accepted work modes. Work modes and relocation are stored together, with omitted values preserved.
| Name | Type | Req | Description |
|---|---|---|---|
| patch | object | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| actionId | string | yes | – |
| cancel | – | yes | – |
| createdAt | string | yes | – |
| handoff | – | yes | – |
| object | – | yes | – |
| revisionAfter | – | yes | – |
| revisionBefore | – | yes | – |
| source | string | yes | – |
| status | string | yes | – |
| summary | string | yes | – |
| taskId | string | yes | – |
| undo | – | yes | – |
| webUrl | – | yes | – |
No examples provided.
update_profile Update profile ~180
Updates profile text fields such as name, email, phone and tone. Identity-bound changes require profileIdentityVersion matching the current profile snapshot. This endpoint does not upload a resume file.
| Name | Type | Req | Description |
|---|---|---|---|
| coverLettersEnabled | boolean | – | Whether generated application packs include a cover letter. false turns cover letters off; Autopilot then skips jobs that require one. |
| string | – | – | |
| expectedProfileIdentityVersion | integer | – | Exact profileIdentityVersion from the prior get_profile snapshot used to prepare identity-bound changes; omit for a tone-only update. |
| name | string | – | – |
| phone | string | – | – |
| tailoredResumesEnabled | boolean | – | Whether each application gets a resume rewritten for the role, on manual applies and Autopilot. false sends the default resume unless an application picked a version itself. |
| tonePreferences | string | – | – |
No output schema declared.
No examples provided.
upload_resume Upload resume ~137
Uploads original resume-file bytes encoded as base64 with PDF, DOCX, TXT, MD, PNG, JPG, JPEG or WEBP format and the current profileIdentityVersion. The server parses text, performs image OCR and generates PDF output. This replaces the account's main resume; stale identity versions are refused.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | Base64-encoded file content. Send the raw file bytes, not converted text. |
| expectedProfileIdentityVersion | integer | – | Exact profileIdentityVersion from the prior get_profile snapshot used to choose this resume. |
| filename | string | – | Original filename |
| format | string | yes | File format |
No output schema declared.
No examples provided.
How do I install the Dreamwork MCP server?
Dreamwork runs locally as an npm package, launched with npx -y @dreamworkhq/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @dreamworkhq/mcp
claude mcp add dreamworkhq-dreamwork -- npx -y @dreamworkhq/mcp
What is the Dreamwork MCP server?
Dreamwork is an MCP server listed in the public MCP registry as io.github.dreamworkhq/dreamwork. Job search, application materials, and application tracking for AI assistants. This page covers its npm package (@dreamworkhq/mcp).
Is the Dreamwork MCP server safe to use?
Dreamwork scores 79 out of 100 on VerifyMCP. We recorded 4 known advisories against it as of 23 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Dreamwork MCP server expose?
Dreamwork exposes 71 tools: list_matches, get_job, save_job, dismiss_match, restore_match, and 66 more. Their descriptions and schemas cost roughly 8,100 tokens of context every time the server is loaded.
Is the Dreamwork MCP server still maintained?
Dreamwork is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Dreamwork MCP server under?
Dreamwork declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.