Jobverify MCP server

by yessGlory17·io.github.yessGlory17/jobverify·v0.1.0·8 stars

No reviews yet

Detect fake-recruiter and job-offer scams using free OSINT. No API keys.

A88/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A88/100

full report

Adoption

Growing

8 stars24 downloads/wk

Reviews

Write one

Nobody has reviewed Jobverify yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Jobverify tools (21, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

check_certificate_transparency
Look up a domain's SSL certificate history via crt.sh (no key). A cert first seen only days ago = fresh phishing infrastructure; a long history and many subdomains = established. Complements check_domain (RDAP age).
check_crypto_address
Check a BTC/EVM crypto address against open scam databases (no key). Any request to pay or receive crypto for a job is itself a major red flag; a listed address is a strong fraud signal.
check_domain
Look up domain registration via RDAP and assess its age. Freshly registered domains posing as established companies are a strong scam signal.
check_domain_auth
Check a domain's SPF and DMARC DNS records (no key). A domain with no SPF and weak/absent DMARC (p=none) is trivially spoofable — so a 'recruiter' email from it is easy to fake. Strong DMARC + SPF means hard to impersonate.
check_emailwrite action
Assess a recruiter's email: disposable domain, free provider, MX records, and (if given) whether it matches the claimed company's domain.
check_email_footprintwrite action
Check an email's public Gravatar profile & linked social accounts (no key). An established identity is a mild legitimacy signal; a throwaway scam address usually has none. Corroborate the linked accounts against the recruiter.
check_github_org
Verify a company's GitHub organization (no key): whether it exists, its age, repo count, and whether its website matches the company domain. A real tech company usually has a GitHub org linking back to its site; a scam rarely does.
check_ip
Check an IP against local blocklists (FireHOL abuse aggregate + Tor exit list) and identify its ASN/org/country (iptoasn) with a hosting/datacenter heuristic. No API key. Blocklisted or datacenter IPs are red flags.
check_phone
Validate a phone number (offline, libphonenumber): validity, type (mobile/VoIP/premium), region, carrier. VoIP/invalid numbers are red flags.
check_scam_patterns
Scan message text for known recruiter/job-scam tactics (offline, no key): advance fee, fake check, equipment purchase, task scam, reshipping, crypto payment, personal-docs-early, off-platform push, urgency, no-interview offer.
check_typosquatting
Detect lookalike / typosquatting / homograph domains (offline, no key): brand embedded with extra words ('google-careers'), near-miss typos ('linkedln'), IDN/punycode confusables, and high-abuse TLDs ('.top').
check_url
Check a URL/domain against local phishing + malware blocklists — no API key. Uses Phishing.Database (~390k phishing domains) and the URLhaus recent feed (malware URLs). Any hit means high risk.
check_username
Check a username/handle across GitHub, Reddit and Keybase (no key). Reveals online history and (via GitHub) account age. A handle that exists nowhere is a sock-puppet signal. For broader coverage, also web-search the username.
check_wayback
Check the Internet Archive history of a URL (e.g. a LinkedIn profile or company site). A missing or very recent first snapshot suggests a new page. This is the legal proxy for 'account age' since LinkedIn hides creation dates.
extract_entities
Parse a raw recruiter message into structured entities (offline, no key): emails, domains, URLs, LinkedIn URLs, phone numbers, IPs, crypto addresses, and off-platform (WhatsApp/Telegram) mentions. Run this FIRST, then feed each entity to the specific check_* tools so nothing is missed.
fetch_archived_page
Fetch the archived TEXT of a page from the Internet Archive (no key). This is the legal way to read a LinkedIn profile/company page — it reads the web.archive.org snapshot, NOT LinkedIn live. Returns the extracted text plus the snapshot date so you can evaluate the recruiter's headline/company or a company page's about text.
find_lookalike_domains
Generate typo/homoglyph/TLD permutations of a REAL brand domain and return the ones that actually resolve in DNS (no key). Live look-alikes are prime fake-recruiter / phishing infrastructure.
parse_email_headerswrite action
Analyze raw email headers for spoofing (offline, no key): SPF/DKIM/DMARC results, From vs Return-Path vs Reply-To mismatches (reply-hijacking), and the real originating IP (feed it to check_ip).
search_company_news
Search regional/local news for a company via Google News RSS (no key). Especially useful for SMALL companies that GLEIF/SEC don't cover: a real firm usually has some press footprint in its region, and any headline flagging it as a scam/fraud is decisive.
verify_address
Geocode a physical address via OpenStreetMap (no key) and assess whether it resolves and is a business vs residential location. A company 'HQ' that does not resolve, or resolves to a house, is a red flag.
verify_company
Search the global LEI database (GLEIF, no API key) for a company name. A match with ACTIVE status is strong evidence the entity is real. Note that only entities with an LEI are listed, so 'no match' is weak evidence.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings

Code scan29 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 85 days ago12/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 88/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Jobverify compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 88/100; higher than 75% of 48,255 servers
Tools: 21; the typical server has 7
Tools that change things: 14%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 8; more than 86% of 28,688 servers
Downloads a week: 24; more than 10% of 12,191 servers with a package

What its tools let an agent do: 18 read · 3 change

Install Jobverify in Claude Code, Cursor or VS Code

claude mcp add jobverify -- uvx jobverify-mcp

Add to Cursor

What the publisher says

From the Jobverify repository's README, as published. We do not edit it. Read it on GitHub

Check whether a recruiter or job offer is real — before you reply.

You get a message: "We loved your profile and want to offer you a great remote job." It sounds real. The company has a logo. The recruiter has a photo. But something feels off.

JobVerify helps you find out — in seconds — whether it's genuine or a scam.

You paste the recruiter's message (or a company name, a link, or an email) and ask your AI assistant. JobVerify quietly runs the same background checks a professional investigator would, then gives you a plain-English answer: looks legit, be careful, or this is almost certainly a scam — and why.

❌ Without JobVerify

Fake recruiter and job-offer scams are everywhere, and they're convincing. On your own, you're left guessing:

❌ Is this company real, or a name someone invented last week?
❌ Is this "recruiter" a real person, or a stolen photo and a throwaway account?
❌ Is that application link safe, or a look-alike site built to steal your data?
❌ Why are they asking me to pay for equipment, or move the chat to WhatsApp/Telegram?

By the time you notice, your time, your personal details — or your money — may already be gone.

✅ With JobVerify

JobVerify cross-checks the offer against dozens of free, public information sources and combines the clues into one clear verdict:

✅ Tells you if the company is a registered, real business — or nowhere to be found
✅ Spots classic scam scripts (upfront fees, fake "task" jobs, crypto, "let's move off-platform")
✅ Flags suspicious links, look-alike domains, and brand-new websites made to look official
✅ Checks whether the email, phone, and photos actually belong to who they claim
✅ Explains its reasoning in everyday language, so you can decide with confidence

No account, no sign-up, and none of your data is sold or stored. It simply helps you not get fooled.

🕵️ How it works

You don't need to learn anything technical. It's a three-step conversation:

addresses — and quietly checks each one against public records, scam databases, and website history.

Paste it. Drop the recruiter's message, a company name, a job link, or an email into your AI chat.
It investigates. JobVerify pulls out every detail — the company, links, email, phone, wallet

which are red flags, and what to do next.

You get a verdict. A short, honest summary: how risky it looks, which signals are reassuring,

[!NOTE]

JobVerify never logs into or scrapes LinkedIn. It only looks at information that is already

public, and reads website history through the Internet Archive — the safe, legal way to check

how long a profile or company page has really existed (scammers rely on brand-new throwaway accounts).

🔎 What it looks at

Think of it as a checklist a careful friend — who happens to be a fraud investigator — would run for you:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Jobverify: common questions

Is Jobverify MCP server safe?: Yes, by our scan: it is graded A (88/100). Read the Jobverify safety report
How do I install Jobverify?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Jobverify need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Jobverify maintained?: The last commit was 124 days ago (2026-07-03). The latest release is v0.1.0.
How does Jobverify compare with other MCP servers?: safety score 88/100 (higher than 75% of 48,255 servers); tools 21 (the typical server has 7); tools that change things 14% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.