io.github.tanmayagrawal21由 GitHub 账号 tanmayagrawal21 发布v0.1.0更新于 Oct 30, 2026
Job search and form filling; dry run by default, real submits need your approval or consent.
本地 MCP 服务器：搜索招聘网站、规划并填写求职申请，仅在用户批准或开启同意窗口后才真正提交。
Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。
参照 仓库 中的启动说明。
An MCP server that finds jobs and fills applications for you, and stops before anything irreversible. It is modular (pluggable platforms, LLM providers, browser drivers), parallel, token-frugal (compact, paginated output) and local-first (routine form fields go to Ollama, LM Studio or MLX on your machine; only hard prose escalates). Works with any MCP client on macOS, Linux and Windows.
[!WARNING] Alpha. Field results from the first live dogfooding run (one user, one night, ~330 discovered postings): search, ranking, dedupe and planning work end to end, and the browser driver now fills and verifies complete Greenhouse and Lever forms, but no application has yet been submitted unattended. Most Greenhouse boards are reCAPTCHA-protected, so the tool fills the form and hands the final click to you (
handoff), which is the intended behaviour. Free-text questions needwriting.reviewer = "router"(local strict review) to go out without you. Expect rough edges; every irreversible step is gated, logged and never retried when the outcome is uncertain.
The repository is also a Claude Code plugin marketplace. The applywise plugin starts the MCP server for you
(pinned to a reviewed version) and adds a skill that tells Claude how to use the tools safely:
Then run init and doctor from the quickstart below in your own terminal, and check /mcp for
plugin:applywise:applywise. The same safety model applies: dry run by default, a human approves every real
submit, and visible CAPTCHAs always come back to you; logins, codes and account creation stay with you unless
you open a consent window yourself (safety model, items 7 and 8). To update, run
claude plugin update applywise@applywise. How releases and the version pin work: docs/release.md.
You need uv (or pipx). No clone required.
Then ask your assistant: "search jobs at greenhouse:examplecorp for data roles, plan the best one, and do a dry run."
Everything is a dry run until you set dry_run = false.
Install alternatives: pipx install git+https://github.com/tanmayagrawal21/job-apply-mcp (then the command is just
job-apply-mcp), or pip install into a virtualenv. After the first PyPI release, uvx applywise (the PyPI distribution is
applywise; the job-apply-mcp command stays as an alias).
Optional extras: [browser] (Playwright), [agent], [jobspy], [mlx], [hf], [litellm], [keyring].
Every posting in a run_applications / run_report result has exactly one status, with a why where useful
(ADR-0049):
max_applications (a whole number >= 1) caps the eligible postings a run handles (ready to submit, or needing you),
the same in dry and live mode; skipped and unsupported postings do not count. A dry run also returns
live_preview with what the current live quotas would allow. Live submits also count against the daily (25 per
rolling 24 h), per-platform (10) and per-run (10) limits; a user config can lower or raise them.
dry_run = true unless you change it; init always writes it.plan_application returns a token bound to a hash of the exact answers. A real submit
needs that token, so what you reviewed is what is sent (apply.auto_approve turns this off; do not).apply_enabled kill switch. Add your own
rules in controls.toml.policy.stop_phrases (for
example "no AI used") always return needs_human. They are not configurable away. Verification codes are
entered only when the USER types them, confirms a granted prefill (ADR-0026/0027), or consented to unattended
runs from a terminal (item 8). Account creation is off by default; it needs accounts.auto_create = true in your
own user config file AND an open credentials consent window (ADR-0046).[answers] autonomy in your own user config decides what the agent may assume
when you are not available: strict (default: every unresolved field waits for you), safe_default (decline
contact/marketing permission, the configured "how did you hear" default, "decline to self-identify"), or infer
(also skill/experience questions about a tool or technology, answered from your resume: Yes only when it
clearly says so, otherwise No; willingness, availability, location and terms questions are never inferred).
Authorization/visa/identity, background and other screening, accommodation, recording, attestations, legal
agreements and employment terms, salary without a policy, start date and location facts are never assumed. Every assumed answer is labelled (assumed, plan, evidence, run report); after
promote_after (3) assumptions of one question you are asked once and your answer is reused. A project file or
env var can only make the level stricter. init asks which level to use; control_status shows it.job-apply-mcp vault add <host> --username U, password prompted without echo). The browser fills them straight into the page; MCP exposes only
vault_status (hosts, never secrets). At most 2 sign-in attempts per host per run; a lockout or wrong password
stops that host (ADR-0046).job-apply-mcp consent --for 24h (or --per-run, --max N,
--scopes ...) is typed once, in a terminal, per period you choose. Inside the window submissions are approved
automatically (logged with the consent id), a page whose only bot check is an invisible widget is submitted
with one click, and an emailed code is read from the newest message of the expected sender and entered once.
Unattended codes stay off until verification.trusted_authserv_ids lists your own mail server's
Authentication-Results id (user config only), so a spoofed sender cannot supply a code.
You review the results afterwards (list_applications). consent --revoke ends it; consent_status (MCP) is
read-only and no tool can create one.optin:<channel> answer applies, and only
to a single, plain permission question. Otherwise they stay with you, or are declined (labelled assumed) at
answers.autonomy = "safe_default" or "infer" (item 5). Authorization and sponsorship come only from
structured per-country facts.[browser] final_click = "human" with
headless = false. The agent fills and verifies each form, brings the tab to the front, and never clicks
Submit. You click. A watcher reads the page every 3 s, for up to human_click_timeout_s (900 s by default), and
records the submission once the site shows its success page. run_applications then hands you one filled tab at
a time. The setting only tightens: any config layer can set human, and only your own user config can switch
it back to agent.Known limitation: Ashby with reCAPTCHA Enterprise. Ashby forms protected by reCAPTCHA Enterprise silently
reject or challenge automated submit clicks, even when the widget is invisible. Use final_click = "human" for
these postings.
HTTP binds loopback by default; any other address refuses to start without JOB_APPLY_MCP_TOKEN
(Authorization: Bearer ...). Use a TLS reverse proxy for network access. A Dockerfile is included
(no browser by default; --build-arg BROWSER=1 adds Playwright and Chromium).
Privacy scan: python scripts/privacy_scan.py --terms ~/.config/job-apply-mcp/privacy_terms.txt. Owner-accepted
findings go in ~/.config/job-apply-mcp/privacy_allow.txt (outside the repo, --allow FILE); see ADR-0051.
The committed .privacy-allow holds only fully anchored regexes for fictional fixtures and the public project
identity in manifests (ADR-0042); never add private terms or fingerprints to it.
MIT licensed. Contributions welcome under the Code of Conduct.
来源：README.md，提交 8e98ff2
Search postings across enabled platforms in parallel. Returns compact rows: ref, co, title, loc, pay, flags. The first call runs the whole search once; pass the returned `next` as `cursor` for more pages (instant).
limitqueryboardscursorlocationplatformssince_daysapply_policyProgress of a search_jobs session: status, boards done/total, rows, elapsed. Accepts a session id or cursor.
session_id必填Fetch one posting. Add 'description' to fields to include the (trimmed) description.
fieldsref_or_url必填Return the application form schema (keys, labels, kinds, required, options).
ref_or_url必填Run policy gates + duplicate check, fill answers from the profile and local LLMs, and list unresolved fields. Unresolved free-text fields come back as `client_tasks` for the calling agent to write. `src` names the source of every answer that is not "profile". A result too large for one response is paged: it carries `next` and `total`; call again with `cursor=next` to get the next page of the SAME plan (from memory, no re-plan) until `next` is null. Pages keep the shape (answers/src stay dicts) so they merge. The first call of a session may ask the user the top open profile questions (elicitation) before planning.
cursorref_or_url必填Draft the prose fields a plan left open (writing.mode="deferred", or ones that timed out): local writer + reviewer under writing.timeout_s. Returns the same shape as plan_application with a fresh approval_id, paged the same way (`cursor=next` pages the last draft from memory).
cursorref_or_url必填Submit using the best available path (platform API, else browser driver). Honors global dry_run; a per-call dry_run can only make it safer. `approval_id` is the server-issued id from plan_application. With approval_mode=human a person must approve (dialog, or `job-apply-mcp approve <id>`).
tokenanswersdry_runref_or_url必填approval_idThe user types the code they received (email/SMS) for a submission in status `awaiting_code`. Ask the USER; never try to read their mail or guess. Only the format is checked; the code is typed into the open page, the page's verify button is clicked once, then the normal confirmation check runs. One attempt per code; the application is never resubmitted; after `verification.code_ttl_s` it becomes a `handoff`.
code必填pending_id必填Plan + submit many applications concurrently. Returns one compact status row per ref. Open profile questions are asked once, before the batch starts (never mid-batch).
refs必填dry_runmax_parallelList recorded applications from the local store.
limitcursorstatusPropose (and, if a coder backend is configured, implement as a PR for human review) a change to this tool. kind: platform_adapter | control | config | new_tool | bug (auto-detected if omitted).
kinddescription必填Ranked improvement proposals learned from recent run failures (compact). Page with `cursor` (= `next`).
limitcursorRecord provenance for a text artifact (kind: resume_bullet|cover_letter|answer|profile_fact). origin: user_written | llm_generated (llm_generated needs `model`). `context` = job/question the text answers.
kind必填text必填modelorigin必填parentpromptcontextUser approves LLM text. Without edited_text -> user_verified; with it -> user_edited child plus diff.
id必填edited_textverified_byOrigin, model, prompt hash and ancestor chain for a text id.
id必填include_textReport enabled platforms, LLM providers and which local models are reachable.
无需输入参数。
Check a side-effecting action against the control layer. action: apply|submit|send_message| write_prose|merge. payload: ref, platform, company, dry_run, text, recipient, page_text, form_labels, attestations. Returns {decision: pass|block|needs_human, violations, warnings}.
action必填payloadActive mode, quotas used/remaining, enabled controls and recent blocks.
无需输入参数。
Local style-tuning state: backend, promoted/previous adapter, new user texts vs threshold, last run.
无需输入参数。
Train a LoRA on the user's own texts, gate it against the incumbent, promote only if better. trigger: manual | new_data (skips below the configured threshold) | rollback (restore previous adapter). wait=False starts in the background; poll tune_status.
waittriggerResume-first fact precedence: counts, profile/resume conflicts, and user-letter facts excluded because they conflict with or are outdated relative to the resume (with the reason and the resume's version).
无需输入参数。
Active human-issued grants (scope, seconds left, uses left). Read-only: only a human can create or revoke a grant, via `job-apply-mcp grant` in a terminal.
无需输入参数。
Active consent windows (mode, scopes, seconds left, submissions left). Read-only: only a human can consent, in a terminal: `job-apply-mcp consent --for 24h` or `--per-run`.
无需输入参数。
Which ATS hosts have a stored login (host and count only, never a username's password), whether the credentials consent window is open, accounts awaiting email verification, and this run's login flags (lockout, wrong_password, captcha). Read-only: logins are added by a human with `job-apply-mcp vault add`.
无需输入参数。
Record the user's own application-confirmation emails so those jobs are never re-applied to. Pass message summaries from the user's mail tool: [{sender, subject, date, snippet}] (snippet = first ~500 chars, optional). Read-only on mail; the server stores only company, title and date. Returns counts plus up to a few new matches. preview=true parses without writing.
previewmessages必填Pull confirmation emails from the configured read-only source (ingest.source: mbox or imap) for the last `since_days` days and record them as already applied. Never sends, moves, flags or deletes mail.
sourcepreviewsince_daysMatch open submissions (submitted/unknown/submitting/handoff) to confirmation emails and mark confident matches `confirmed` (evidence = email subject/date; never bodies). Checks run at ingest.reconcile_delays_min after each submit; force=true checks now. With the default client mail source and no `messages`, returns a `client_task`: fetch recent confirmation-email summaries and pass them here or to ingest_confirmations. An unknown with no match after the last window stays unknown and is listed under `unresolved`. Read-only on mail; never resubmits.
forcemessagesSeed dedupe from confirmation-email history (default ingest.seed_since_days=180) before a run, so no side files are needed. mbox/imap sources are read directly; with the client source and no `messages` this returns a `client_task` to fetch summaries and call it again with them.
previewmessagessince_daysApply from any mix of sources in one run: explicit `links` (or `links_file`, one URL per line), job links the user emailed to themselves (read-only mail; sender, recipient and label come from config only; `mail` may only narrow with {query, since, since_days}), and discovery (`discovery` = search_jobs arguments). Priority: links, then mail, then discovery. `sources` subsets ["links","mail","discovery"]. `max_applications` (whole number >= 1; default intake.max_applications or run_size feedback, capped at intake.max_applications_cap) caps the eligible postings handled, the same in dry and live mode; skipped and ineligible ones do not count. Every URL goes through adapter detection, plan, gates, dedupe and submit. Prose is deferred: jobs needing unapproved prose are skipped, not blocking. With the client mail source pass `messages` [{id, from, to, subject, date, body}]. Pending feedback is applied first (see plan_context). Returns the run report: one status per posting, each with `why`: submitted, confirmed, dry_run_ok (a live run would submit it), needs_human (the owner must act: unresolved fields, review gate, awaiting approval), quota_blocked (a live quota refused it), skipped (policy, duplicate, prose not approved, max_applications reached), unsupported_site, unknown (verify by hand), failed. A dry run adds `live_preview` (would_submit, quota_blocked, warning) from the live quotas.
maillinksdry_runsourcesmessagesdiscoverylinks_filemax_applicationsReport of a run (default: the latest): counts plus rows per status (submitted, confirmed, dry_run_ok, needs_human, quota_blocked, skipped, unsupported_site, unknown, failed; see run_applications), each with `why`. `category` shows one only (the old names handed_off and dry_run still work).
limitrun_idcategoryFeedback on a run (optionally on one `ref` of it), applied at the start of the next run. Structured: {"kind":"deny_company"|"deny_title", "pattern"?} (no pattern + ref = that item's company/title), {"kind":"answer","pattern","value"} for plain questions only; any authorization, demographic, consent, attestation, legal or AI-use question (or {"kind":"profile_answer","key"|"question","value","scope": "global|company|role_family","scope_value"}) goes to the profile builder's answer_profile_question. {"kind":"salary","salary_floor"|"base_salary"|"default_ask"|"expected"|"delta"|"percent"}: never below the configured floor, capped at intake.salary_max_multiple. {"kind":"run_size","value"|"delta"}. Free text is shown in the next run's plan_context. Answers given here (and pay changes in human approval mode) apply only after the USER confirms them on a terminal: `job-apply-mcp feedback --confirm <id>`.
refrun_id必填feedback必填Top open profile gaps (questions the tool could not answer, or answered with a default), ranked by frequency x impact (blocked applications weigh most). Ask the user these, then call answer_profile_question.
limitAsk the USER (MCP elicitation) to type the answer for a gap key from profile_questions. This tool takes no value: the answer comes only from the user's own input and is stored as user_written. If the client cannot elicit, nothing is stored; tell the user to run `job-apply-mcp profile ask`. Scope: global | company | role_family (+ scope_value, or 'company:Acme'). Demographics are never stored here.
key必填scopescope_value已满足适用检查项的 90%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。
claude plugin marketplace add tanmayagrawal21/job-apply-mcpclaude plugin install applywise@applywise# 1. Create config.toml, profile.toml, controls.toml (asks a few questions; --yes to skip them)uvx --from git+https://github.com/tanmayagrawal21/job-apply-mcp job-apply-mcp init
# 2. Put your real details in the profile it printed the path of, then check everythinguvx --from git+https://github.com/tanmayagrawal21/job-apply-mcp job-apply-mcp doctor
# 3. Add the printed snippet to your MCP client (guides for ten clients: docs/clients/)claude mcp add --transport stdio job-apply -- uvx --from git+https://github.com/tanmayagrawal21/job-apply-mcp job-apply-mcpjob-apply-mcp # stdio (what clients launch)job-apply-mcp --transport http --host 127.0.0.1 --port 8765 # http://127.0.0.1:8765/mcpJOB_APPLY_MCP_TOKEN=... job-apply-mcp --transport http --host 0.0.0.0 # non-local: token requiredgit clone https://github.com/tanmayagrawal21/job-apply-mcp && cd job-apply-mcpuv sync --extra devuv run ruff check . && uv run pytest -q # offline; live tests need JAM_LIVE=1uv run python scripts/gen_config_docs.py # after changing config.py