registry / employed-mcp / 1.0.3

employed-mcp@1.0.3

MCP server + CLI for Employed by Guaq AI (jobs.guaqai.me) — thin Node launcher around the stdlib-only Python client, so `npx employed-mcp` works with no manual download.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Source inspection found an ordinary Python launcher and API client aligned with the package’s job search purpose. Scanner similarity and evasion labels were not supported by the inspected behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Invoking an exposed CLI command or making an MCP tools/call request; OAuth runs through the login action.

Impact

No unrequested credential disclosure, account mutation, or other confirmed attack effect was established.

Mechanism

The client uses the configured API base, defaulting to the vendor service, and attaches the configured or saved API key to requests.

AI rationale

Source inspection found an ordinary Python launcher and API client aligned with the package’s job search purpose. Scanner similarity and evasion labels were not supported by the inspected behavior.

Network endpoints1

jobs.guaqai.me

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json lists only sync, prepack, and test scripts; it has no install lifecycle hook.
The launcher passes the selected bundled Python script, original arguments, and inherited environment to Python.
The shared client’s default API base is jobs.guaqai.me, and it sends the API key as bearer authorization to the configured request URL.
MCP calls pass caller-supplied tool names and arguments to the defined tool dispatcher; no automatic account-changing action was identified.
The OAuth flow is invoked from the CLI login action.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.67 KB of source, external domains: python.org

Source & flagged code

6 flagged

bin/_run.jsView file

Lines 1-54javascript

1#!/usr/bin/env node

2"use strict";

3// Shared launcher for both bins: this package is a thin wrapper, not a rewrite.

4// guaq_mcp.py / guaq_cli.py / guaq_client.py are deliberately stdlib-only Python (see

5// their own docstrings) so anyone can `curl` them onto a locked-down machine with zero

6// installs — this npm package exists ONLY to make `npx employed-mcp` / `npx employed` fetch and

7// run that same code without the user finding and copying the raw files themselves.

8// Requires a Python 3 interpreter on PATH; it does not, and cannot, ship one.

9const { spawnSync } = require("child_process");

10const path = require("path");

11const fs = require("fs");

13function findPython() {

14 const candidates = process.platform === "win32"

15 ? ["python", "python3", "py"]

16 : ["python3", "python"];

17 for (const cmd of candidates) {

18 const probe = spawnSync(cmd, ["--version"], { stdio: "ignore" });

19 if (probe.status === 0) return cmd;

20 }

21 return null;

22}

24function run(scriptName) {

25 const python = findPython();

26 if (!python) {

27 process.stderr.write(

28 "employed-mcp: no Python 3 interpreter found on PATH.\n" +

29 "This package wraps a Python client (see the README) — install Python 3.8+ " +

30 "from https://python.org and make sure `python3` (or `python` on Windows) " +

31 "resolves, then try again.\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/_run.jsView on unpkg · L8

32 );

33 process.exit(1);

34 }

35 let scriptPath = path.join(__dirname, "..", "py", scriptName);

36 if (!fs.existsSync(scriptPath)) {

37 const monoPath = path.join(__dirname, "..", "..", "..", scriptName);

38 if (fs.existsSync(monoPath)) {

39 scriptPath = monoPath;

40 } else {

41 process.stderr.write(`employed-mcp: bundled script missing: ${scriptPath}\n` +

42 "This is a packaging bug, not a config problem — please open an issue.\n");

43 process.exit(1);

44 }

45 }

46 const result = spawnSync(python, [scriptPath, ...process.argv.slice(2)], {

47 stdio: "inherit",

48 env: process.env,

49 });

50 process.exit(result.status === null ? 1 : result.status);

Low

Ai Review Evidence

The launcher passes the selected bundled Python script, original arguments, and inherited environment to Python.

bin/_run.jsView on unpkg · L46

51}

53module.exports = { run };

•matchType = normalized_sha256 matchedPackage = employed-mcp@1.2.1 matchedPath = bin/_run.js matchedIdentity = npm:ZW1wbG95ZWQtbWNw:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/_run.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 35bcf46affea3b42 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = employed-mcp@1.2.1 matchedPath = bin/_run.js matchedIdentity = npm:ZW1wbG95ZWQtbWNw:1.2.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/_run.jsView on unpkg

py/guaq_mcp.pyView file

•path = py/guaq_mcp.py kind = build_helper sizeBytes = 15728 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

py/guaq_mcp.pyView on unpkg

package.jsonView file

Lines 20-46json

20 "smithery.yaml"

21 ],

22 "engines": {

23 "node": ">=16"

24 },

25 "os": [

26 "darwin",

27 "linux"

Source & flagged code

6 flagged · loading source

bin/_run.jsView file

8// Requires a Python 3 interpreter on PATH; it does not, and cannot, ship one. L9: const { spawnSync } = require("child_process"); L10: const path = require("path"); ... L13: function findPython() { L14: const candidates = process.platform === "win32" L15: ? ["python", "python3", "py"] ... L26: if (!python) { L27: process.stderr.write( L28: "employed-mcp: no Python 3 interpreter found on PATH.\n" + L29: "This package wraps a Python client (see the README) — install Python 3.8+ " + L30: "from https://python.org and make sure `python3` (or `python` on Windows) " + L31: "resolves, then try again.\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/_run.jsView on unpkg · L8

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/_run.jsView on unpkg

Findings

3 High3 Medium6 Low

HighSandbox Evasion Gated Capabilitybin/_run.js

HighKnown Malware Source Similaritybin/_run.js

HighKnown Malware Source Fingerprint Signaturebin/_run.js

MediumEnvironment Vars

MediumShips Build Helperpy/guaq_mcp.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencebin/_run.js

Affected versions and remediation

This report applies to employed-mcp@1.0.3.

See all versions of employed-mcp for other recorded verdicts.

Review the evidence and your use of employed-mcp@1.0.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 00:12:39.057Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.