Workopia — Job Search
REMOTE · WORKOPIA.IO · SCANNED SEP 27
Search 6.3M+ live jobs from companies' own career pages, plus resume tailoring & cover letters.
Available components
Recent critical change
Authorization (27 Aug 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (tailor_resume_tool). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability55
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3111 tokens (~622/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage87
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 60% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the Workopia — Job Search MCP server?
Workopia — Job Search is a hosted endpoint at https://workopia.io/api/mcp-jobs, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · workopia.io
claude mcp add --transport http workopia-workopia-mcp 'https://workopia.io/api/mcp-jobs'
{
"mcpServers": {
"workopia-workopia-mcp": {
"url": "https://workopia.io/api/mcp-jobs"
}
}
} {
"servers": {
"workopia-workopia-mcp": {
"type": "http",
"url": "https://workopia.io/api/mcp-jobs"
}
}
} [mcp_servers.workopia-workopia-mcp] url = "https://workopia.io/api/mcp-jobs"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"workopia-workopia-mcp": {
"type": "remote",
"url": "https://workopia.io/api/mcp-jobs",
"enabled": true
}
}
} openclaw mcp add workopia-workopia-mcp --url 'https://workopia.io/api/mcp-jobs' --transport streamable-http
mcp_servers:
workopia-workopia-mcp:
url: "https://workopia.io/api/mcp-jobs" {
"McpServers": {
"workopia-workopia-mcp": {
"Transport": "http",
"Url": "https://workopia.io/api/mcp-jobs"
}
}
} assistant mcp add workopia-workopia-mcp -t streamable-http -u 'https://workopia.io/api/mcp-jobs'
{
"mcpServers": {
"workopia-workopia-mcp": {
"type": "http",
"url": "https://workopia.io/api/mcp-jobs"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Sept 26 0
- Stability: 0.97 → pass security
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 16 Sept 26 +3
- Stability: fail → pass ▲ security
- New tool “cover_letter_tool”, which the server declares destructive security
- Schema quality: 2498 → 3111 ▼ functional
- Tool coverage: 50% → 60% ▲ functional
- 1 Sept 26 −3
- Stability: pass → fail ▼ security
- A breaking change shipped without a version bump: still 2.0.0 ▼ security
- Tool “cover_letter_tool” was removed ▼ security
- Tool coverage: 60% → 50% ▼ functional
- Schema quality: 3111 → 2498 ▲ functional
- 27 Aug 26 0
- Authorization: unverified → fail ▼ critical
- Injection markers: unverified → pass ▲ security
- Stability: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Destructive annotations: pass functional
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 27 Sept 2026 · Probed https://workopia.io/api/mcp-jobs
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=workopia.io | CN=YE2,O=Let's Encrypt,C=US | 6 Sept 2026 | 5 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 54acb62a9666a6e65c6a504384fac5e7493 |
| SANs: *.workopia.io, workopia.io | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of workopia.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| workopia.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://workopia.io/api/mcp-jobs | Verified | 200 | |
| http (plaintext) | http://workopia.io/api/mcp-jobs | HTTPS enforced | 301 | https://workopia.io/api/mcp-jobs |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cover_letter_tool ~613
Write a cover letter for a SPECIFIC job — TWO steps. STEP 1 (default; action omitted or 'prepare'): the server returns the job's JD and the candidate's background, plus writing instructions. YOU (the model) then WRITE the cover letter (250–350 words, specific to the role, mapping the candidate's real achievements to the JD — never fabricate). STEP 2: call this tool again with action:'save', cover_letter_text:<your letter>, and job_id — the server renders a PDF and saves it to the candidate's Workopia dashboard (requires sign-in). Use whenever the user asks for a cover letter for a specific job. Resolving job_id (same rules as tailor_resume_tool / job_detail_tool): pass the **Job Id** value from the most recent prior search/refine result VERBATIM; no placeholders like 'JOB_1' or '#1'. For STEP 1 supply ONE of job_id (preferred — server fetches the JD from Mongo) OR job_description, plus the candidate's resume via resume_text / resume_content / json_resume / user_profile.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Omit or 'prepare' = STEP 1 (server returns JD + background + instructions for you to write). 'save' = STEP 2 (pass cover_letter_text; server renders a PDF and saves it to the dashboard; requires sign… |
| company | string | – | Optional; used in the confirmation line. |
| cover_letter | object | – | Optional wrapper containing the same fields above (legacy shape). |
| cover_letter_text | string | – | STEP 2 only: the cover letter you wrote (plain text). The server renders it to PDF and stores it on profile.applications[job_id].coverLetter. |
| job_description | string | – | Full JD text when the user pastes it directly (alternative to job_id). |
| job_id | string | – | ID of a job from a prior search/refine result. Use the **Job Id** value from the prior search result's content text VERBATIM. Server fetches full JD from Mongo. |
| job_title | string | – | Optional; used in the 'for <role> at <company>' confirmation line. |
| json_resume | object | – | Optional JSON Resume object (basics/work/skills). Takes precedence over resume_text when both present. |
| parameters | object | – | – |
| resume_content | string | – | – |
| resume_text | string | – | User's resume content (plain text or JSON Resume as string). |
| session_id | string | – | – |
| user_email | string | – | If provided, server fetches the full Workopia profile for the cover letter header + writes the generated cover letter back to profile.applications[jobId].coverLetter. |
| user_profile | object | – | Optional main-site profile object; used as a fallback source for summary/skills/experience and for the cover letter header (firstName, lastName, email, phone, city, country). |
No output schema declared.
No examples provided.
dashboard_tool ~116
Show the signed-in user's Workopia dashboard (saved, tailored, and applied jobs + latest resume). Requires OAuth. Default action is list; optional status_filter (all | saved | tailored | applied). Use whenever the user asks to recall their Workopia activity: 'my applications', 'what jobs have I saved / applied to / tailored', 'show my dashboard', 'where did I leave off'. Returns a secure link to open the full dashboard on the web.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | – |
| status_filter | string | – | – |
No output schema declared.
No examples provided.
job_detail_tool ~385
Render the full job-detail card for a specific job the user asks about. Use this whenever the user references a particular job from a prior search result — by number (#1, '1', 'first', 'the 3rd one', 'job 3'), by company name (partial or full, e.g. 'Morgan Stanley', 'Morstan'), by role/title phrase ('the analyst role', 'the credit risk one'), or by any 'show me this job' / 'tell me more about X' / 'view this role' style request. Resolving job_id from user reference: identify the right job from the most recent prior search/refine result (the numbered list you generated): (a) numeric/ordinal → the Nth job; (b) company name → substring match on Company field; (c) role/title phrase → substring match on Job Title field. Then pass that job's **Job Id** value from the prior search result's content text VERBATIM as job_id. Do NOT use a placeholder like 'JOB_1', '#1', or any synthetic id — only the real **Job Id** string from the prior result is server-valid. Required: job_id. OUTPUT BEHAVIOR: Render the response as a structured markdown card with the job's title (linked to the apply URL), company, location, salary, employment type, work mode, must-have skills, key requirements, highlights, and summary. Follow it with a brief next-step hint (e.g. 'Want to save it, find similar roles, ask about the company, or tailor your resume for this role?').
| Name | Type | Req | Description |
|---|---|---|---|
| get_job_detail | object | – | – |
| job_id | string | – | The id from a prior search result's job_cards[].card.id. Required. |
| parameters | object | – | – |
| user_email | string | – | – |
No output schema declared.
No examples provided.
job_tool ~1,237
Search jobs across 90+ countries by title, location, salary, remote/hybrid work mode, or employment type. Find roles in tech, finance, product, design, marketing, and every other vertical — aggregated from 1000+ ATS sources globally. Default action is search; use refine when the user asks for more matches or gives feedback on a prior result set; use save to bookmark a job for the signed-in user (requires OAuth). REFINE PROTOCOL (action=refine has THREE distinct modes): (1) Pure continuation / 'show me more' / 'next batch' / 'another set' / 'more like these': pass refine_recommendations.exclude_ids = the full array of **Job Id** values from the most recent search/refine result's content text (verbatim) + refine_recommendations.session_id = prior response's session_id if present. Server returns next 10 unique jobs. (2) 'Show me more like #N' / 'similar to the Atlassian one' / 'jobs like #2': pass refine_recommendations.liked_indexes = [N] (1-based position from prior numbered list) + exclude_ids + session_id. Equivalently you may pass refine_recommendations.liked_job_ids = [<that job's **Job Id** value verbatim>]. Server seeds the recommendation from that job's title/skills/company profile. (3) 'Less like #N' / 'no more N-style jobs' / 'avoid jobs like that': pass refine_recommendations.disliked_indexes = [N] (or disliked_job_ids = [<Job Id>]) + exclude_ids + session_id. Server suppresses similar jobs. All three modes: if you skip exclude_ids, the user sees duplicates — that's a failure. The handler layers exclude_ids with server-side AgentKit memory, so partial lists still work. NEVER invent 'JOB_1' / '#1' as job_id values — always use the real **Job Id** string from the prior result's content text. For detail requests (user asks about a specific job from the list, e.g. 'details for #1', 'show me this job', 'tell me more about <company>'), DO NOT call this tool — call job_detail_tool instead. That separate tool binds to the job-detail widget card so the full job car…
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Optional; omitted = search. refine = after results/feedback; save = bookmark a job for the signed-in user. |
| parameters | object | – | – |
| refine_recommendations | object | – | Refine args. Pass exclude_ids (array of Job Id strings from prior result) and session_id always. For 'more like #N': pass liked_indexes=[N] or liked_job_ids=[<Job Id>]. For 'less like #N': pass disli… |
| save_job | object | – | Save args. Required: job_id (from job_cards[].card.id in a prior search result). Optional: job_title, company, job_url. |
| search_jobs | object | – | Search args. Required: city. Optional filters surface only when the user explicitly mentions them — omit otherwise. job_title+city uses indexed snapshot; company+city (optional job_title) uses legacy… |
No output schema declared.
No examples provided.
tailor_resume_tool ~760
Tailor a resume to a SPECIFIC job — TWO steps. STEP 1 (default; action omitted or 'prepare'): the server returns the job's full JD, its must-have skills/requirements, and the candidate's current resume, plus tailoring instructions. YOU (the model) then WRITE the tailored resume as JSON Resume, following the instructions — weave JD keywords into existing bullets only where the candidate genuinely has the experience, never fabricate experience/titles/dates/employers, keep all dates and company names, and flag any keyword you couldn't honestly add. STEP 2: call this tool again with action:'save', tailored_resume:<your JSON Resume>, and job_id — the server renders a PDF and saves it to the candidate's Workopia dashboard (requires sign-in). Use whenever the user references a specific job to tailor for: 'tailor for #1', 'for Morgan Stanley', 'tailor my resume for this role: <JD>'. Resolving job_id (same rules as job_detail_tool): from the most recent prior search/refine result — (a) numeric/ordinal → the Nth job; (b) company name → Company-field match; (c) role/title phrase → Job-Title match — then pass that job's **Job Id** value VERBATIM. Do NOT use placeholders like 'JOB_1' or '#1'. For STEP 1 supply ONE of job_id (preferred — server fetches the JD from Mongo) OR job_description, plus the candidate's resume via resume_text / resume_content / resume_data. For general 'improve my resume' (no specific job), do NOT call this tool — call resume_tool action=improve instead. Note: the tailored resume is written by your AI client's own model — the assistant you are already using — so it works out of the box with nothing to configure; Workopia runs no LLM of its own and never charges for the AI.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Omit or 'prepare' = STEP 1 (server returns JD + resume + instructions for you to tailor). 'save' = STEP 2 (pass tailored_resume; server renders a PDF and saves it to the dashboard; requires sign-in). |
| company | string | – | – |
| customization_level | string | – | – |
| job_description | string | – | Full JD text when the user pastes it directly (alternative to job_id). |
| job_id | string | – | ID of a job from a prior search/refine result. Use the **Job Id** value from the prior search result's content text VERBATIM. Server fetches full JD from Mongo. |
| job_title | string | – | – |
| parameters | object | – | – |
| resume_content | string | – | – |
| resume_data | object | – | PREFERRED shape — structured resume per utils/tailor/types.ts ResumeTree. Server, widget, and main-site PDF template all consume this exact shape. Collect these fields from the user before calling wh… |
| resume_text | string | – | User's resume content (plain text or JSON Resume as string). Fallback when resume_data is not provided. |
| session_id | string | – | – |
| tailor_resume | object | – | Optional wrapper containing the same fields above (legacy shape). |
| tailored_resume | object | – | STEP 2 only: the tailored resume you generated, as a JSON Resume object (or a JSON string). The server renders it to PDF and stores it on profile.applications[job_id].resumeTailor. |
| user_email | string | – | – |
| user_profile | object | – | Optional main-site profile object; used as a fallback source for name/title/contact/experience when resume_data and resume_text are both absent. |
No output schema declared.
No examples provided.
What is the Workopia — Job Search MCP server?
Workopia — Job Search is an MCP server listed in the public MCP registry as io.github.workopia/workopia-mcp. Search 6.3M+ live jobs from companies' own career pages, plus resume tailoring & cover letters. This page covers its hosted endpoint (https://workopia.io/api/mcp-jobs).
Is the Workopia — Job Search MCP server safe to use?
Workopia — Job Search scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Workopia — Job Search MCP server expose?
Workopia — Job Search exposes 5 tools: tailor_resume_tool, cover_letter_tool, job_tool, job_detail_tool, dashboard_tool. Their descriptions and schemas cost roughly 3,111 tokens of context every time the server is loaded.
Does the Workopia — Job Search MCP server require authentication?
No. We connected to Workopia — Job Search without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Workopia — Job Search MCP server still maintained?
Workopia — Job Search is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.