registry / Malware / employed-mcp

employed-mcp

MCP server + CLI for Employed by Guaq AI (jobs.guaqai.me) - thin Node launcher around the stdlib-only Python client, so `npx employed-mcp` works with no manual download.

This report shows the evidence for employed-mcp@1.2.1. 2 of 4 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The published source contains reviewer-directed references to specific AI review policies and outcomes, matching the reviewer-manipulation policy. This supports blocking for malicious review interference even though inspection found no install hook or separate runtime attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A security reviewer or AI inspects the published source.

Impact

The comments may bias review and interfere with accurate security enforcement.

Mechanism

Comments invoke specific OpenAI, Claude, and ChatGPT review decisions while framing the package's instructions and tool behavior.

Attack narrative

Comments in the published Python source refer to OpenAI, Claude, and ChatGPT review outcomes in explanations of server instructions and tool behavior. This source-level reviewer manipulation is evidence of malicious review-evasion intent; inspection did not establish a separate runtime attack.

AI rationale

Evidence

py/guaq_mcp.py

Decision evidence

public snapshot

AI called this Malicious at 90.0% confidence as Malware with low false-positive risk.

Evidence for block

The shipped Python source comments refer to OpenAI and Claude review decisions while discussing server instructions and tool descriptions, which is reviewer-directed manipulation.
Another source comment invokes ChatGPT review policy to explain tool reply behavior, reinforcing that the review references are deliberate.
The package manifest includes the Python source files in the published package.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.66 KB of source, external domains: python.org

Source & flagged code

7 flagged

bin/_run.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2"use strict";

3// Shared launcher for both bins: this package is a thin wrapper, not a rewrite.

4// guaq_mcp.py / guaq_cli.py / guaq_client.py are deliberately stdlib-only Python (see

5// their own docstrings) so anyone can `curl` them onto a locked-down machine with zero

6// installs - this npm package exists ONLY to make `npx employed-mcp` / `npx employed` fetch and

7// run that same code without the user finding and copying the raw files themselves.

8// Requires a Python 3 interpreter on PATH; it does not, and cannot, ship one.

9const { spawnSync } = require("child_process");

10const path = require("path");

11const fs = require("fs");

13function findPython() {

14 const candidates = process.platform === "win32"

15 ? ["python", "python3", "py"]

16 : ["python3", "python"];

17 for (const cmd of candidates) {

18 const probe = spawnSync(cmd, ["--version"], { stdio: "ignore" });

19 if (probe.status === 0) return cmd;

20 }

21 return null;

22}

24function run(scriptName) {

25 const python = findPython();

26 if (!python) {

27 process.stderr.write(

28 "employed-mcp: no Python 3 interpreter found on PATH.\n" +

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/_run.jsView on unpkg · L8

•matchType = normalized_sha256 matchedPackage = employed-mcp@1.2.0 matchedPath = bin/_run.js matchedIdentity = npm:ZW1wbG95ZWQtbWNw:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/_run.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 35bcf46affea3b42 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = employed-mcp@1.2.0 matchedPath = bin/_run.js matchedIdentity = npm:ZW1wbG95ZWQtbWNw:1.2.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/_run.jsView on unpkg

py/guaq_mcp.pyView file

Lines 40-80text

40import sys

41import traceback

43from guaq_client import Guaq, GuaqError

45# Newest first. initialize echoes the client's version when we know it, else our newest, as

46# the MCP lifecycle spec requires; the stdio server and the remote /mcp endpoint share this.

47SUPPORTED_PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"]

48PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0]

49# icons/websiteUrl (MCP Implementation fields): without them a client falls back to a favicon

50# lookup, and Claude looks up the registrable domain guaqai.me, which is the Guaq AI company

51# mark rather than Employed's.

package.jsonView file

Lines 1-37json

2 "name": "employed-mcp",

3 "mcpName": "me.guaqai.jobs/employed",

4 "version": "1.2.1",

5 "description": "MCP server + CLI for Employed by Guaq AI (jobs.guaqai.me) - thin Node launcher around the stdlib-only Python client, so `npx employed-mcp` works with no manual download.",

Source & flagged code

7 flagged · loading source

bin/_run.jsView file

8// Requires a Python 3 interpreter on PATH; it does not, and cannot, ship one. L9: const { spawnSync } = require("child_process"); L10: const path = require("path"); ... L13: function findPython() { L14: const candidates = process.platform === "win32" L15: ? ["python", "python3", "py"] ... L26: if (!python) { L27: process.stderr.write( L28: "employed-mcp: no Python 3 interpreter found on PATH.\n" + L29: "This package wraps a Python client (see the README) - install Python 3.8+ " + L30: "from https://python.org and make sure `python3` (or `python` on Windows) " + L31: "resolves, then try again.\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/_run.jsView on unpkg · L8

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/_run.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/_run.jsView on unpkg

py/guaq_mcp.pyView file

60OpenAI's review held the 2026-10-13 instructions for "further # review" over one such sentence, and Claude's directory makes the submitter attest that tool # descriptions carry no

High

Ai Review Evidence

The shipped Python source comments refer to OpenAI and Claude review decisions while discussing server instructions and tool descriptions, which is reviewer-directed manipulation.

py/guaq_mcp.pyView on unpkg · L60

699ChatGPT's review rejects upgrade prompts in a tool # reply. The account page is where the person manages their own plan. if e.payload.get("trial_exhausted")

High

Ai Review Evidence

Another source comment invokes ChatGPT review policy to explain tool reply behavior, reinforcing that the review references are deliberate.

py/guaq_mcp.pyView on unpkg · L699

•path = py/guaq_mcp.py kind = build_helper sizeBytes = 43530 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

py/guaq_mcp.pyView on unpkg

package.jsonView file

17"files": [ "bin", "py/*.py", "README.md", "smithery.yaml" ], "engines": { "node": ">=16" }, "os": [ "darwin", "linux", "win32" ], "keywo

High

Ai Review Evidence

The package manifest includes the Python source files in the published package.

package.jsonView on unpkg · L17

Findings

6 High3 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/_run.js

HighKnown Malware Source Similaritybin/_run.js

HighKnown Malware Source Fingerprint Signaturebin/_run.js

HighAi Review Evidencepy/guaq_mcp.py

HighAi Review Evidencepackage.json

MediumEnvironment Vars

MediumShips Build Helperpy/guaq_mcp.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to employed-mcp@1.2.1.

The versions list below shows the verdict for each recorded version.

Avoid installing employed-mcp@1.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-13 15:23:18.553Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

1.2.1latestshownMaliciousMalwareBlockPublishedOct 13, 2026, 3:19 PM 1.2.0MaliciousMalwareBlockPublishedOct 13, 2026, 12:20 AM 1.0.3Clean—AllowPublishedOct 8, 2026, 10:14 PM 1.0.0Clean—AllowPublishedSep 29, 2026, 9:35 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages