Mmcp.market

Is JobMojito safe?

Yes, with the usual care.

B81/100grade B

Safe to use. Minor gaps such as a missing repository or slower maintenance.

What to know before installing
  • highWrite-action tools reachable without authentication

Public scan report

scanner v0.1.3 · 2026-09-19 · same rubric, same numbers if you re-run it

1 high1 low
  • Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 1448ms20/20
  • Tool poisoning29 tool descriptions checked13/15
  • Auth qualityopen endpoint exposes 7 write-action tools with no auth3/15
  • Maintenancelast push 3 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year; website matches verified namespace10/10

Findings (2)

  • highWrite-action tools reachable without authenticationauth.open-write
  • lowUnusually long tool description (over 2,000 characters)poison.long-description
    tool create_persona: …[Interviews] Create a role-play persona: an avatar that plays a defined role in a free-form conversation instead of a scored Q&A interview. FIRST CHOOSE `portal`, because it selects between two different products: `portal="interview"` builds a SIMULATED PERSONA a recruiter invites candidates to — scored, billed to merchant credits, and listed with the recruiter's other results; `portal="coaching"` (THE DEFAULT) builds a coaching persona learners start themselves from the catalogue, billed to their own coaching credits and never visible to recruiters. Pass `portal="interview"` explicitly for any hiring, screening or assessment use. Then set `persona_role_avatar`/`persona_role_user` for the roles and `opening_line` for the avatar's first spoken line (defaults to a generic 'Hello'). FIRST DECIDE `portal`. This endpoint creates two different products and the default is NOT the recruiter one: - `portal: "interview"` — an INTERVIEW ROLE-PLAY. Use this whenever the goal is to ASSESS or SCREEN candidates: hiring, assessments, sales role-plays for job applicants, anything a recruiter runs. Candidates are invited through the normal invitation flow, results appear in the recruiter's result list, it is billed against merchant credits, and attempts are capped via `interview_attempts` — exactly like an interview. - `portal: "coaching"` (THE DEFAULT) — a coaching persona for practice/training on the coaching portal. Consumed against the mentee's own coaching credits, self-started from the catalogue, and its results are NOT visible to recruiters. Omitting `portal` gives you this one, so pass `portal: "interview"` explicitly for any recruiting/assessment use case. The conversation itself behaves identically in both. The avatar plays a defined role in a free-form conversation instead of running a scored Q&A interview. No AI question/description generation runs; the persona role fields ARE the configuration. The session runs as: a welcome message → the avatar's OPENING LINE (the first thing it says, set via `opening_line`) → the candidate replies and the free-form role-play begins → a closing message. Because there is no question list, `opening_line` is how the avatar starts the scene — set it to a concrete in-character line; if omitted it defaults to a generic "Hello". Set `welcome_message` and `thank_you_message` too — omitting them leaves the generic platform defaults. Also set `candidate_expectations`: it is the yardstick the session is scored against. The four avatar prompts divide up as: `persona_avatar_who_is` (identity and what drives it), `persona_avatar_knowledge` (the private facts it may use), `persona_avatar_progress` (how the conversation is allowed to move forward, and what gates the later personal details), and `persona_avatar_end_conditions` (when to stop). Without `persona_avatar_progress` the avatar has no defined arc and tends to either concede immediately or never concede at all. Provisions the default conversational steps and optionally an embed key.…
Overall 81/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Full listing, tools and install

Is JobMojito MCP server safe? Grade B · mcp.market