Jobverify

io.github.yessGlory17由 GitHub 帳號 yessGlory17 發布v0.1.0更新於 Oct 24, 2026

Detect fake-recruiter and job-offer scams using free OSINT. No API keys.

概覽

AI 產生的概覽

JobVerify 以免費公開資訊查核招募訊息、公司、連結、電子郵件、電話與加密錢包,協助辨識求職與職缺詐騙。

可以做什麼
從貼上的訊息擷取電子郵件、連結、電話、錢包地址與個人頁面網址,比對已知詐騙話術,並提供一鍵 analyze 提示完成擷取、查核、結論的完整流程。查核公司登記、新聞與地址真實性,以及電子郵件可送達性、電話有效性、使用者名稱與 GitHub 組織。檢查網域年齡、註冊商與可偽造性,尋找仿冒網域,並以釣魚與惡意軟體黑名單檢測網址和 IP。讀取憑證透明度記錄與原始郵件標頭,判斷來源及 SPF/DKIM/DMARC 是否不符。在已知詐騙資料庫查詢加密錢包地址,並透過 Internet Archive 檢視網站或個人頁面的歷史。
適用情境
當你收到主動上門的職缺邀請或招募方訊息,想在回覆、提供個人資料或付款前快速了解風險時適用。也適合查核隨邀請附上的公司名稱、申請連結、電子郵件地址或錢包地址。
執行需求
以 PyPI 套件 jobverify-mcp 透過 stdio 在本機執行,並以 uvx 啟動,因此需先安裝 uv 工具。不需帳號、API 金鑰或環境變數;查核依賴免費公開來源,需要網路連線。
安裝前請注意
結果屬機率性的決策參考,並非對真實個人或機構的定論,可能不完整或有誤。你貼上的訊息(含電子郵件、電話、錢包地址)會傳送給第三方公開來源與服務(如 Internet Archive)進行查核。它不會登入或擷取 LinkedIn。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Jobverify,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only,透過 STDIO。 STDIO 服務會啟動本機處理程序,因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

[JobVerify]

Check whether a recruiter or job offer is real — before you reply.

[MCP server] [No API keys] [Free OSINT] [Works with Claude] [No setup — runs from GitHub]


You get a message: "We loved your profile and want to offer you a great remote job." It sounds real. The company has a logo. The recruiter has a photo. But something feels off.

JobVerify helps you find out — in seconds — whether it's genuine or a scam.

You paste the recruiter's message (or a company name, a link, or an email) and ask your AI assistant. JobVerify quietly runs the same background checks a professional investigator would, then gives you a plain-English answer: looks legit, be careful, or this is almost certainly a scam — and why.


❌ Without JobVerify

Fake recruiter and job-offer scams are everywhere, and they're convincing. On your own, you're left guessing:

  • ❌ Is this company real, or a name someone invented last week?
  • ❌ Is this "recruiter" a real person, or a stolen photo and a throwaway account?
  • ❌ Is that application link safe, or a look-alike site built to steal your data?
  • ❌ Why are they asking me to pay for equipment, or move the chat to WhatsApp/Telegram?

By the time you notice, your time, your personal details — or your money — may already be gone.

✅ With JobVerify

JobVerify cross-checks the offer against dozens of free, public information sources and combines the clues into one clear verdict:

  • ✅ Tells you if the company is a registered, real business — or nowhere to be found
  • ✅ Spots classic scam scripts (upfront fees, fake "task" jobs, crypto, "let's move off-platform")
  • ✅ Flags suspicious links, look-alike domains, and brand-new websites made to look official
  • ✅ Checks whether the email, phone, and photos actually belong to who they claim
  • ✅ Explains its reasoning in everyday language, so you can decide with confidence

No account, no sign-up, and none of your data is sold or stored. It simply helps you not get fooled.


🕵️ How it works

You don't need to learn anything technical. It's a three-step conversation:

  1. Paste it. Drop the recruiter's message, a company name, a job link, or an email into your AI chat.
  2. It investigates. JobVerify pulls out every detail — the company, links, email, phone, wallet addresses — and quietly checks each one against public records, scam databases, and website history.
  3. You get a verdict. A short, honest summary: how risky it looks, which signals are reassuring, which are red flags, and what to do next.

[!NOTE] JobVerify never logs into or scrapes LinkedIn. It only looks at information that is already public, and reads website history through the Internet Archive — the safe, legal way to check how long a profile or company page has really existed (scammers rely on brand-new throwaway accounts).


🔎 What it looks at

Think of it as a checklist a careful friend — who happens to be a fraud investigator — would run for you:

AreaThe question it answers
The messageDoes this match known scam playbooks (advance fees, fake tasks, crypto, urgency)?
The companyIs it a real, registered business? Any recent scam reports? Is the office address real?
The personIs the email real and deliverable? Is the phone valid? Are the photos/usernames reused elsewhere?
The linksIs the domain brand-new? A look-alike of a real brand? On any phishing/malware blocklist?
The moneyIs the crypto wallet they gave you already flagged in scam databases?
The historyHow long has this profile or website actually been online?

💬 Example

Ask your assistant something as simple as:

txt
Is this recruiter legit?
"Hi! I'm a talent partner at Example Corp. We loved your profile andwant to offer you a remote role at $45/hr. To get started, please purchase$200 of onboarding equipment through this link — you'll be fully reimbursedon day one. Let's continue on Telegram: @examplecorp_hr"

JobVerify will pick out Example Corp, the link, and the Telegram hand-off, check each one, and reply with something like: "⚠️ High risk — the company has no public registration, the link was registered 4 days ago, and asking you to pay upfront and move to Telegram are textbook scam signals."


🚀 Getting started

No cloning. No virtualenv. No manual install. JobVerify runs straight from GitHub — you only paste a few lines into your AI assistant's config, and it fetches and launches itself on demand.

[!NOTE] The only thing you need once is uv — a tiny, free helper that runs the tool for you:

  • macOS / Linux: curl -LsSf https://astral.sh/uv/install.sh | sh
  • Windows: powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Claude Desktop

Add this to your claude_desktop_config.json, then restart Claude:

json
{  "mcpServers": {    "jobverify": {      "command": "uvx",      "args": ["jobverify-mcp"]    }  }}

Claude Code

One line in your terminal:

bash
claude mcp add jobverify -- uvx jobverify-mcp

The first run takes a few seconds while it downloads the tool; after that it's instant.

Use it

Paste a suspicious message and ask "Is this offer legit?" — or run the built-in analyze prompt. That's it.


🔐 Privacy & honesty

  • Your data stays yours. No sign-up, no tracking, nothing you paste is stored or sold.
  • No API keys or costs. Every source is free and open — public business registries, DNS records, scam blocklists, the Internet Archive, and more.
  • Signals, not certainty. JobVerify gives you strong decision support, not a courtroom verdict. Treat the result as informed guidance about a message — never as a final judgment about a real person.

For the curious: the full toolbox

Under the hood, the AI assistant orchestrates these individual checks (all free, no keys):

ToolWhat it checks
extract_entitiesPulls emails, links, phones, wallets, and profile URLs out of a message
check_scam_patternsMatches text against known scam tactics
check_email / check_email_footprintEmail deliverability + linked social accounts
check_domain / check_domain_authDomain age, registrar, and whether it can be spoofed
check_typosquatting / find_lookalike_domainsLook-alike / imposter domains
check_url / check_ipPhishing & malware blocklists
check_certificate_transparencyA site's certificate & subdomain history
parse_email_headersOrigin, SPF/DKIM/DMARC, and mismatches in raw email headers
check_phonePhone number validity and region
check_crypto_addressKnown-scam crypto wallet databases
verify_company / search_company_news / verify_addressBusiness registration, press, and real address
check_github_org / check_usernameWhether an org/username really exists and how old it is
check_wayback / fetch_archived_pageInternet Archive history & content (the legal way to read a page)

There's also a single analyze prompt that runs the whole extract → check → verdict flow for you.


⚠️ Disclaimer

JobVerify is a decision-support tool. Its signals are probabilistic and may be incomplete or wrong. Always use your own judgment, and never treat a result as a definitive statement about any individual or organization.

License

MIT — use it, share it, and help people stay safe.

來源:README.md,提交 c74ddee

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包,因此其工具未知。

版本歷史

1
  1. v0.1.0最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手;SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭,或保持端點能夠回應探測,以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list,或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分