Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Workopia — Job Search

REMOTE · WORKOPIA.IO · SCANNED SEP 27

Search 6.3M+ live jobs from companies' own career pages, plus resume tailoring & cover letters.

Available components

0 this week 72 Trust /100

Recent critical change

Authorization (27 Aug 2026). See the changelog before you install this server.

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security57
Transport & Reachability100
Schema Quality & AI Usability55
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3111 tokens (~622/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage87
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 60% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Install

How do I install the Workopia — Job Search MCP server?

Workopia — Job Search is a hosted endpoint at https://workopia.io/api/mcp-jobs, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · workopia.io

# add to Claude Code
claude mcp add --transport http workopia-workopia-mcp 'https://workopia.io/api/mcp-jobs'
// .cursor/mcp.json
{
  "mcpServers": {
    "workopia-workopia-mcp": {
      "url": "https://workopia.io/api/mcp-jobs"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "workopia-workopia-mcp": {
      "type": "http",
      "url": "https://workopia.io/api/mcp-jobs"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.workopia-workopia-mcp]
url = "https://workopia.io/api/mcp-jobs"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "workopia-workopia-mcp": {
      "type": "remote",
      "url": "https://workopia.io/api/mcp-jobs",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add workopia-workopia-mcp --url 'https://workopia.io/api/mcp-jobs' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  workopia-workopia-mcp:
    url: "https://workopia.io/api/mcp-jobs"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "workopia-workopia-mcp": {
      "Transport": "http",
      "Url": "https://workopia.io/api/mcp-jobs"
    }
  }
}
# add to Vellum
assistant mcp add workopia-workopia-mcp -t streamable-http -u 'https://workopia.io/api/mcp-jobs'
// mcp.json
{
  "mcpServers": {
    "workopia-workopia-mcp": {
      "type": "http",
      "url": "https://workopia.io/api/mcp-jobs"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 26 Sept 26 0
    • Stability: 0.97 → pass security
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 16 Sept 26 +3
    • Stability: fail → pass ▲ security
    • New tool “cover_letter_tool”, which the server declares destructive security
    • Schema quality: 2498 → 3111 ▼ functional
    • Tool coverage: 50% → 60% ▲ functional
  • 1 Sept 26 −3
    • Stability: pass → fail ▼ security
    • A breaking change shipped without a version bump: still 2.0.0 ▼ security
    • Tool “cover_letter_tool” was removed ▼ security
    • Tool coverage: 60% → 50% ▼ functional
    • Schema quality: 3111 → 2498 ▲ functional
  • 27 Aug 26 0
    • Authorization: unverified → fail ▼ critical
    • Injection markers: unverified → pass ▲ security
    • Stability: unverified → pass ▲ security
    • First check of Judged manipulation: pass security
    • MCP protocol: unverified → fail ▼ functional
    • Tool coverage: unverified → 100 ▲ functional
    • First check of Destructive annotations: pass functional
  • 26 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 0
    • Stability: 0.97 → pass security
  • 11 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 27 Sept 2026 · Probed https://workopia.io/api/mcp-jobs

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=workopia.io CN=YE2,O=Let's Encrypt,C=US 6 Sept 2026 5 Dec 2026 ECDSA 256 ECDSA-SHA384 54acb62a9666a6e65c6a504384fac5e7493
SANs: *.workopia.io, workopia.io
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of workopia.io. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
io. present 57355 8 Verified
workopia.io. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://workopia.io/api/mcp-jobs Verified 200
http (plaintext) http://workopia.io/api/mcp-jobs HTTPS enforced 301 https://workopia.io/api/mcp-jobs
MCP tools · 5 exposed · ~3,111 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
cover_letter_tool ~613

Write a cover letter for a SPECIFIC job — TWO steps. STEP 1 (default; action omitted or 'prepare'): the server returns the job's JD and the candidate's background, plus writing instructions. YOU (the model) then WRITE the cover letter (250–350 words, specific to the role, mapping the candidate's real achievements to the JD — never fabricate). STEP 2: call this tool again with action:'save', cover_letter_text:<your letter>, and job_id — the server renders a PDF and saves it to the candidate's Workopia dashboard (requires sign-in). Use whenever the user asks for a cover letter for a specific job. Resolving job_id (same rules as tailor_resume_tool / job_detail_tool): pass the **Job Id** value from the most recent prior search/refine result VERBATIM; no placeholders like 'JOB_1' or '#1'. For STEP 1 supply ONE of job_id (preferred — server fetches the JD from Mongo) OR job_description, plus the candidate's resume via resume_text / resume_content / json_resume / user_profile.

NameTypeReqDescription
actionstring–Omit or 'prepare' = STEP 1 (server returns JD + background + instructions for you to write). 'save' = STEP 2 (pass cover_letter_text; server renders a PDF and saves it to the dashboard; requires sign…
companystring–Optional; used in the confirmation line.
cover_letterobject–Optional wrapper containing the same fields above (legacy shape).
cover_letter_textstring–STEP 2 only: the cover letter you wrote (plain text). The server renders it to PDF and stores it on profile.applications[job_id].coverLetter.
job_descriptionstring–Full JD text when the user pastes it directly (alternative to job_id).
job_idstring–ID of a job from a prior search/refine result. Use the **Job Id** value from the prior search result's content text VERBATIM. Server fetches full JD from Mongo.
job_titlestring–Optional; used in the 'for <role> at <company>' confirmation line.
json_resumeobject–Optional JSON Resume object (basics/work/skills). Takes precedence over resume_text when both present.
parametersobject––
resume_contentstring––
resume_textstring–User's resume content (plain text or JSON Resume as string).
session_idstring––
user_emailstring–If provided, server fetches the full Workopia profile for the cover letter header + writes the generated cover letter back to profile.applications[jobId].coverLetter.
user_profileobject–Optional main-site profile object; used as a fallback source for summary/skills/experience and for the cover letter header (firstName, lastName, email, phone, city, country).

No output schema declared.

No examples provided.

dashboard_tool ~116

Show the signed-in user's Workopia dashboard (saved, tailored, and applied jobs + latest resume). Requires OAuth. Default action is list; optional status_filter (all | saved | tailored | applied). Use whenever the user asks to recall their Workopia activity: 'my applications', 'what jobs have I saved / applied to / tailored', 'show my dashboard', 'where did I leave off'. Returns a secure link to open the full dashboard on the web.

NameTypeReqDescription
actionstring––
status_filterstring––

No output schema declared.

No examples provided.

job_detail_tool ~385

Render the full job-detail card for a specific job the user asks about. Use this whenever the user references a particular job from a prior search result — by number (#1, '1', 'first', 'the 3rd one', 'job 3'), by company name (partial or full, e.g. 'Morgan Stanley', 'Morstan'), by role/title phrase ('the analyst role', 'the credit risk one'), or by any 'show me this job' / 'tell me more about X' / 'view this role' style request. Resolving job_id from user reference: identify the right job from the most recent prior search/refine result (the numbered list you generated): (a) numeric/ordinal → the Nth job; (b) company name → substring match on Company field; (c) role/title phrase → substring match on Job Title field. Then pass that job's **Job Id** value from the prior search result's content text VERBATIM as job_id. Do NOT use a placeholder like 'JOB_1', '#1', or any synthetic id — only the real **Job Id** string from the prior result is server-valid. Required: job_id. OUTPUT BEHAVIOR: Render the response as a structured markdown card with the job's title (linked to the apply URL), company, location, salary, employment type, work mode, must-have skills, key requirements, highlights, and summary. Follow it with a brief next-step hint (e.g. 'Want to save it, find similar roles, ask about the company, or tailor your resume for this role?').

NameTypeReqDescription
get_job_detailobject––
job_idstring–The id from a prior search result's job_cards[].card.id. Required.
parametersobject––
user_emailstring––

No output schema declared.

No examples provided.

job_tool ~1,237

Search jobs across 90+ countries by title, location, salary, remote/hybrid work mode, or employment type. Find roles in tech, finance, product, design, marketing, and every other vertical — aggregated from 1000+ ATS sources globally. Default action is search; use refine when the user asks for more matches or gives feedback on a prior result set; use save to bookmark a job for the signed-in user (requires OAuth). REFINE PROTOCOL (action=refine has THREE distinct modes): (1) Pure continuation / 'show me more' / 'next batch' / 'another set' / 'more like these': pass refine_recommendations.exclude_ids = the full array of **Job Id** values from the most recent search/refine result's content text (verbatim) + refine_recommendations.session_id = prior response's session_id if present. Server returns next 10 unique jobs. (2) 'Show me more like #N' / 'similar to the Atlassian one' / 'jobs like #2': pass refine_recommendations.liked_indexes = [N] (1-based position from prior numbered list) + exclude_ids + session_id. Equivalently you may pass refine_recommendations.liked_job_ids = [<that job's **Job Id** value verbatim>]. Server seeds the recommendation from that job's title/skills/company profile. (3) 'Less like #N' / 'no more N-style jobs' / 'avoid jobs like that': pass refine_recommendations.disliked_indexes = [N] (or disliked_job_ids = [<Job Id>]) + exclude_ids + session_id. Server suppresses similar jobs. All three modes: if you skip exclude_ids, the user sees duplicates — that's a failure. The handler layers exclude_ids with server-side AgentKit memory, so partial lists still work. NEVER invent 'JOB_1' / '#1' as job_id values — always use the real **Job Id** string from the prior result's content text. For detail requests (user asks about a specific job from the list, e.g. 'details for #1', 'show me this job', 'tell me more about <company>'), DO NOT call this tool — call job_detail_tool instead. That separate tool binds to the job-detail widget card so the full job car…

NameTypeReqDescription
actionstring–Optional; omitted = search. refine = after results/feedback; save = bookmark a job for the signed-in user.
parametersobject––
refine_recommendationsobject–Refine args. Pass exclude_ids (array of Job Id strings from prior result) and session_id always. For 'more like #N': pass liked_indexes=[N] or liked_job_ids=[<Job Id>]. For 'less like #N': pass disli…
save_jobobject–Save args. Required: job_id (from job_cards[].card.id in a prior search result). Optional: job_title, company, job_url.
search_jobsobject–Search args. Required: city. Optional filters surface only when the user explicitly mentions them — omit otherwise. job_title+city uses indexed snapshot; company+city (optional job_title) uses legacy…

No output schema declared.

No examples provided.

tailor_resume_tool ~760

Tailor a resume to a SPECIFIC job — TWO steps. STEP 1 (default; action omitted or 'prepare'): the server returns the job's full JD, its must-have skills/requirements, and the candidate's current resume, plus tailoring instructions. YOU (the model) then WRITE the tailored resume as JSON Resume, following the instructions — weave JD keywords into existing bullets only where the candidate genuinely has the experience, never fabricate experience/titles/dates/employers, keep all dates and company names, and flag any keyword you couldn't honestly add. STEP 2: call this tool again with action:'save', tailored_resume:<your JSON Resume>, and job_id — the server renders a PDF and saves it to the candidate's Workopia dashboard (requires sign-in). Use whenever the user references a specific job to tailor for: 'tailor for #1', 'for Morgan Stanley', 'tailor my resume for this role: <JD>'. Resolving job_id (same rules as job_detail_tool): from the most recent prior search/refine result — (a) numeric/ordinal → the Nth job; (b) company name → Company-field match; (c) role/title phrase → Job-Title match — then pass that job's **Job Id** value VERBATIM. Do NOT use placeholders like 'JOB_1' or '#1'. For STEP 1 supply ONE of job_id (preferred — server fetches the JD from Mongo) OR job_description, plus the candidate's resume via resume_text / resume_content / resume_data. For general 'improve my resume' (no specific job), do NOT call this tool — call resume_tool action=improve instead. Note: the tailored resume is written by your AI client's own model — the assistant you are already using — so it works out of the box with nothing to configure; Workopia runs no LLM of its own and never charges for the AI.

NameTypeReqDescription
actionstring–Omit or 'prepare' = STEP 1 (server returns JD + resume + instructions for you to tailor). 'save' = STEP 2 (pass tailored_resume; server renders a PDF and saves it to the dashboard; requires sign-in).
companystring––
customization_levelstring––
job_descriptionstring–Full JD text when the user pastes it directly (alternative to job_id).
job_idstring–ID of a job from a prior search/refine result. Use the **Job Id** value from the prior search result's content text VERBATIM. Server fetches full JD from Mongo.
job_titlestring––
parametersobject––
resume_contentstring––
resume_dataobject–PREFERRED shape — structured resume per utils/tailor/types.ts ResumeTree. Server, widget, and main-site PDF template all consume this exact shape. Collect these fields from the user before calling wh…
resume_textstring–User's resume content (plain text or JSON Resume as string). Fallback when resume_data is not provided.
session_idstring––
tailor_resumeobject–Optional wrapper containing the same fields above (legacy shape).
tailored_resumeobject–STEP 2 only: the tailored resume you generated, as a JSON Resume object (or a JSON string). The server renders it to PDF and stores it on profile.applications[job_id].resumeTailor.
user_emailstring––
user_profileobject–Optional main-site profile object; used as a fallback source for name/title/contact/experience when resume_data and resume_text are both absent.

No output schema declared.

No examples provided.

Common questions

What is the Workopia — Job Search MCP server?

Workopia — Job Search is an MCP server listed in the public MCP registry as io.github.workopia/workopia-mcp. Search 6.3M+ live jobs from companies' own career pages, plus resume tailoring & cover letters. This page covers its hosted endpoint (https://workopia.io/api/mcp-jobs).

Is the Workopia — Job Search MCP server safe to use?

Workopia — Job Search scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Workopia — Job Search MCP server expose?

Workopia — Job Search exposes 5 tools: tailor_resume_tool, cover_letter_tool, job_tool, job_detail_tool, dashboard_tool. Their descriptions and schemas cost roughly 3,111 tokens of context every time the server is loaded.

Does the Workopia — Job Search MCP server require authentication?

No. We connected to Workopia — Job Search without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Workopia — Job Search MCP server still maintained?

Workopia — Job Search is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.