{"name":"io.github.yessGlory17/jobverify","slug":"yessglory17-jobverify","title":null,"description":"Detect fake-recruiter and job-offer scams using free OSINT. No API keys.","url":"https://mcp.market/server/yessglory17-jobverify","rating":null,"grade":"A","score":88,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":26,"stars":8,"forks":2,"downloads_week":24,"last_push_at":"2026-07-03T15:21:12.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/yessGlory17/job-verify","website":null,"version":"0.1.0","remotes":[],"packages":[{"registryType":"pypi","registryBaseUrl":"https://pypi.org","identifier":"jobverify-mcp","version":"0.1.0","transport":{"type":"stdio"}}],"tools":[{"name":"check_certificate_transparency","description":"Look up a domain's SSL certificate history via crt.sh (no key). A cert first seen only days ago = fresh phishing infrastructure; a long history and many subdomains = established. Complements check_domain (RDAP age).","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_crypto_address","description":"Check a BTC/EVM crypto address against open scam databases (no key). Any request to pay or receive crypto for a job is itself a major red flag; a listed address is a strong fraud signal.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_domain","description":"Look up domain registration via RDAP and assess its age. Freshly registered domains posing as established companies are a strong scam signal.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_domain_auth","description":"Check a domain's SPF and DMARC DNS records (no key). A domain with no SPF and weak/absent DMARC (p=none) is trivially spoofable — so a 'recruiter' email from it is easy to fake. Strong DMARC + SPF means hard to impersonate.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_email","description":"Assess a recruiter's email: disposable domain, free provider, MX records, and (if given) whether it matches the claimed company's domain.","write_action":true,"price_micros":0,"input_schema":null},{"name":"check_email_footprint","description":"Check an email's public Gravatar profile & linked social accounts (no key). An established identity is a mild legitimacy signal; a throwaway scam address usually has none. Corroborate the linked accounts against the recruiter.","write_action":true,"price_micros":0,"input_schema":null},{"name":"check_github_org","description":"Verify a company's GitHub organization (no key): whether it exists, its age, repo count, and whether its website matches the company domain. A real tech company usually has a GitHub org linking back to its site; a scam rarely does.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_ip","description":"Check an IP against local blocklists (FireHOL abuse aggregate + Tor exit list) and identify its ASN/org/country (iptoasn) with a hosting/datacenter heuristic. No API key. Blocklisted or datacenter IPs are red flags.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_phone","description":"Validate a phone number (offline, libphonenumber): validity, type (mobile/VoIP/premium), region, carrier. VoIP/invalid numbers are red flags.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_scam_patterns","description":"Scan message text for known recruiter/job-scam tactics (offline, no key): advance fee, fake check, equipment purchase, task scam, reshipping, crypto payment, personal-docs-early, off-platform push, urgency, no-interview offer.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_typosquatting","description":"Detect lookalike / typosquatting / homograph domains (offline, no key): brand embedded with extra words ('google-careers'), near-miss typos ('linkedln'), IDN/punycode confusables, and high-abuse TLDs ('.top').","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_url","description":"Check a URL/domain against local phishing + malware blocklists — no API key. Uses Phishing.Database (~390k phishing domains) and the URLhaus recent feed (malware URLs). Any hit means high risk.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_username","description":"Check a username/handle across GitHub, Reddit and Keybase (no key). Reveals online history and (via GitHub) account age. A handle that exists nowhere is a sock-puppet signal. For broader coverage, also web-search the username.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_wayback","description":"Check the Internet Archive history of a URL (e.g. a LinkedIn profile or company site). A missing or very recent first snapshot suggests a new page. This is the legal proxy for 'account age' since LinkedIn hides creation dates.","write_action":false,"price_micros":0,"input_schema":null},{"name":"extract_entities","description":"Parse a raw recruiter message into structured entities (offline, no key): emails, domains, URLs, LinkedIn URLs, phone numbers, IPs, crypto addresses, and off-platform (WhatsApp/Telegram) mentions. Run this FIRST, then feed each entity to the specific check_* tools so nothing is missed.","write_action":false,"price_micros":0,"input_schema":null},{"name":"fetch_archived_page","description":"Fetch the archived TEXT of a page from the Internet Archive (no key). This is the legal way to read a LinkedIn profile/company page — it reads the web.archive.org snapshot, NOT LinkedIn live. Returns the extracted text plus the snapshot date so you can evaluate the recruiter's headline/company or a company page's about text.","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_lookalike_domains","description":"Generate typo/homoglyph/TLD permutations of a REAL brand domain and return the ones that actually resolve in DNS (no key). Live look-alikes are prime fake-recruiter / phishing infrastructure.","write_action":false,"price_micros":0,"input_schema":null},{"name":"parse_email_headers","description":"Analyze raw email headers for spoofing (offline, no key): SPF/DKIM/DMARC results, From vs Return-Path vs Reply-To mismatches (reply-hijacking), and the real originating IP (feed it to check_ip).","write_action":true,"price_micros":0,"input_schema":null},{"name":"search_company_news","description":"Search regional/local news for a company via Google News RSS (no key). Especially useful for SMALL companies that GLEIF/SEC don't cover: a real firm usually has some press footprint in its region, and any headline flagging it as a scam/fraud is decisive.","write_action":false,"price_micros":0,"input_schema":null},{"name":"verify_address","description":"Geocode a physical address via OpenStreetMap (no key) and assess whether it resolves and is a business vs residential location. A company 'HQ' that does not resolve, or resolves to a house, is a red flag.","write_action":false,"price_micros":0,"input_schema":null},{"name":"verify_company","description":"Search the global LEI database (GLEIF, no API key) for a company name. A match with ACTIVE status is strong evidence the entity is real. Note that only entities with an LEI are listed, so 'no match' is weak evidence.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":88,"grade":"A","scanned_at":"2026-09-26T11:37:27.532Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-26T11:37:27.631Z","components":{"code":{"score":25,"max":25,"notes":["29 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":12,"max":15,"notes":["last push 85 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"jobverify-mcp","version":"0.1.0","found":true,"weeklyDownloads":24,"license":"MIT","dependencyCount":5,"publishedAt":"2026-07-03T14:36:15.164157Z","repositoryUrl":"https://github.com/yessGlory17/job-verify"}],"repo":{"found":true,"owner":"yessGlory17","repo":"job-verify","archived":false,"pushedAt":"2026-07-03T15:21:12Z","stars":8,"forks":2,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/52113663?v=4","ownerCreatedAt":"2019-06-22T21:07:20Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/52113663?v=4&s=128","source":"github"},"presence":{"stars":8,"forks":2,"downloadsWeek":24,"license":"MIT","lastPushAt":"2026-07-03T15:21:12.000Z","score":26}}}},"grade_history":[],"reviews":[]}