Jobverify

io.github.yessGlory17由 GitHub 账号 yessGlory17 发布v0.1.0更新于 Oct 24, 2026

Detect fake-recruiter and job-offer scams using free OSINT. No API keys.

概览

AI 生成的概览

JobVerify 用免费公开信息核查招聘消息、公司、链接、邮箱、电话和加密钱包,帮助识别招聘与职位诈骗。

可以做什么
从粘贴的消息中提取邮箱、链接、电话、钱包地址和个人主页链接,比对已知诈骗话术,并提供一键 analyze 提示完成提取、核查、结论全流程。核查公司注册信息、新闻与地址真实性,以及邮箱可达性、电话有效性、用户名和 GitHub 组织。检查域名年龄、注册商与可伪造性,查找仿冒域名,并用钓鱼与恶意软件黑名单检测网址和 IP。读取证书透明度记录和原始邮件头,判断来源及 SPF/DKIM/DMARC 是否不符。在已知诈骗数据库中查询加密钱包地址,并通过 Internet Archive 查看网站或个人主页的历史。
适用场景
当你收到主动上门的职位邀请或招聘方消息,想在回复、提供个人信息或付款之前快速了解风险时适用。也适合核查随邀请附带的公司名称、申请链接、邮箱地址或钱包地址。
运行要求
以 PyPI 包 jobverify-mcp 通过 stdio 在本地运行,用 uvx 启动,因此需要先安装 uv 工具。无需账号、API 密钥或环境变量;核查依赖免费公开来源,需要网络访问。
安装前请注意
结果是概率性的决策参考,并非对真实个人或机构的定论,可能不完整或有误。你粘贴的消息(含邮箱、电话、钱包地址)会被发送给第三方公开来源和服务(如 Internet Archive)进行核查。它不会登录或抓取 LinkedIn。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Jobverify,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only,通过 STDIO。 STDIO 服务会启动本地进程,因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

[JobVerify]

Check whether a recruiter or job offer is real — before you reply.

[MCP server] [No API keys] [Free OSINT] [Works with Claude] [No setup — runs from GitHub]


You get a message: "We loved your profile and want to offer you a great remote job." It sounds real. The company has a logo. The recruiter has a photo. But something feels off.

JobVerify helps you find out — in seconds — whether it's genuine or a scam.

You paste the recruiter's message (or a company name, a link, or an email) and ask your AI assistant. JobVerify quietly runs the same background checks a professional investigator would, then gives you a plain-English answer: looks legit, be careful, or this is almost certainly a scam — and why.


❌ Without JobVerify

Fake recruiter and job-offer scams are everywhere, and they're convincing. On your own, you're left guessing:

  • ❌ Is this company real, or a name someone invented last week?
  • ❌ Is this "recruiter" a real person, or a stolen photo and a throwaway account?
  • ❌ Is that application link safe, or a look-alike site built to steal your data?
  • ❌ Why are they asking me to pay for equipment, or move the chat to WhatsApp/Telegram?

By the time you notice, your time, your personal details — or your money — may already be gone.

✅ With JobVerify

JobVerify cross-checks the offer against dozens of free, public information sources and combines the clues into one clear verdict:

  • ✅ Tells you if the company is a registered, real business — or nowhere to be found
  • ✅ Spots classic scam scripts (upfront fees, fake "task" jobs, crypto, "let's move off-platform")
  • ✅ Flags suspicious links, look-alike domains, and brand-new websites made to look official
  • ✅ Checks whether the email, phone, and photos actually belong to who they claim
  • ✅ Explains its reasoning in everyday language, so you can decide with confidence

No account, no sign-up, and none of your data is sold or stored. It simply helps you not get fooled.


🕵️ How it works

You don't need to learn anything technical. It's a three-step conversation:

  1. Paste it. Drop the recruiter's message, a company name, a job link, or an email into your AI chat.
  2. It investigates. JobVerify pulls out every detail — the company, links, email, phone, wallet addresses — and quietly checks each one against public records, scam databases, and website history.
  3. You get a verdict. A short, honest summary: how risky it looks, which signals are reassuring, which are red flags, and what to do next.

[!NOTE] JobVerify never logs into or scrapes LinkedIn. It only looks at information that is already public, and reads website history through the Internet Archive — the safe, legal way to check how long a profile or company page has really existed (scammers rely on brand-new throwaway accounts).


🔎 What it looks at

Think of it as a checklist a careful friend — who happens to be a fraud investigator — would run for you:

AreaThe question it answers
The messageDoes this match known scam playbooks (advance fees, fake tasks, crypto, urgency)?
The companyIs it a real, registered business? Any recent scam reports? Is the office address real?
The personIs the email real and deliverable? Is the phone valid? Are the photos/usernames reused elsewhere?
The linksIs the domain brand-new? A look-alike of a real brand? On any phishing/malware blocklist?
The moneyIs the crypto wallet they gave you already flagged in scam databases?
The historyHow long has this profile or website actually been online?

💬 Example

Ask your assistant something as simple as:

txt
Is this recruiter legit?
"Hi! I'm a talent partner at Example Corp. We loved your profile andwant to offer you a remote role at $45/hr. To get started, please purchase$200 of onboarding equipment through this link — you'll be fully reimbursedon day one. Let's continue on Telegram: @examplecorp_hr"

JobVerify will pick out Example Corp, the link, and the Telegram hand-off, check each one, and reply with something like: "⚠️ High risk — the company has no public registration, the link was registered 4 days ago, and asking you to pay upfront and move to Telegram are textbook scam signals."


🚀 Getting started

No cloning. No virtualenv. No manual install. JobVerify runs straight from GitHub — you only paste a few lines into your AI assistant's config, and it fetches and launches itself on demand.

[!NOTE] The only thing you need once is uv — a tiny, free helper that runs the tool for you:

  • macOS / Linux: curl -LsSf https://astral.sh/uv/install.sh | sh
  • Windows: powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Claude Desktop

Add this to your claude_desktop_config.json, then restart Claude:

json
{  "mcpServers": {    "jobverify": {      "command": "uvx",      "args": ["jobverify-mcp"]    }  }}

Claude Code

One line in your terminal:

bash
claude mcp add jobverify -- uvx jobverify-mcp

The first run takes a few seconds while it downloads the tool; after that it's instant.

Use it

Paste a suspicious message and ask "Is this offer legit?" — or run the built-in analyze prompt. That's it.


🔐 Privacy & honesty

  • Your data stays yours. No sign-up, no tracking, nothing you paste is stored or sold.
  • No API keys or costs. Every source is free and open — public business registries, DNS records, scam blocklists, the Internet Archive, and more.
  • Signals, not certainty. JobVerify gives you strong decision support, not a courtroom verdict. Treat the result as informed guidance about a message — never as a final judgment about a real person.

For the curious: the full toolbox

Under the hood, the AI assistant orchestrates these individual checks (all free, no keys):

ToolWhat it checks
extract_entitiesPulls emails, links, phones, wallets, and profile URLs out of a message
check_scam_patternsMatches text against known scam tactics
check_email / check_email_footprintEmail deliverability + linked social accounts
check_domain / check_domain_authDomain age, registrar, and whether it can be spoofed
check_typosquatting / find_lookalike_domainsLook-alike / imposter domains
check_url / check_ipPhishing & malware blocklists
check_certificate_transparencyA site's certificate & subdomain history
parse_email_headersOrigin, SPF/DKIM/DMARC, and mismatches in raw email headers
check_phonePhone number validity and region
check_crypto_addressKnown-scam crypto wallet databases
verify_company / search_company_news / verify_addressBusiness registration, press, and real address
check_github_org / check_usernameWhether an org/username really exists and how old it is
check_wayback / fetch_archived_pageInternet Archive history & content (the legal way to read a page)

There's also a single analyze prompt that runs the whole extract → check → verdict flow for you.


⚠️ Disclaimer

JobVerify is a decision-support tool. Its signals are probabilistic and may be incomplete or wrong. Always use your own judgment, and never treat a result as a definitive statement about any individual or organization.

License

MIT — use it, share it, and help people stay safe.

来源:README.md,提交 c74ddee

工具

0
SourceWeft 尚未在沙箱中启动过该软件包,因此其工具未知。

版本历史

1
  1. v0.1.0最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手;SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头,或保持端点能够响应探测,以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list,或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分