registry / Malware / employed-mcp / 1.2.0

employed-mcp@1.2.0

MCP server + CLI for Employed by Guaq AI (jobs.guaqai.me) - thin Node launcher around the stdlib-only Python client, so `npx employed-mcp` works with no manual download.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The explicit reviewer-targeted comments are evidence of malicious intent under the review policy. The inspected runtime behavior does not establish a separate attack chain, but the review manipulation warrants blocking publication.

Static reason

One or more suspicious static signals were detected.

Trigger

A reviewer or scanner inspects py/guaq_mcp.py.

Impact

The comments attempt to influence the security assessment; no user-data impact was established.

Mechanism

Comments refer directly to OpenAI and ChatGPT review behavior and discuss content that review flags or rejects.

Attack narrative

Comments in the MCP server source address automated review behavior, indicating an attempt to steer the assessment. The inspected account-write path runs through a named tool call with supplied arguments; no separate runtime attack was established.

AI rationale

Evidence

py/guaq_mcp.py

Decision evidence

public snapshot

AI called this Malicious at 88.0% confidence as Malware with low false-positive risk.

Evidence for block

Source comments explicitly address automated review and describe what content it flags, showing an attempt to steer the review.
The ordinary account-write path is invoked through a named MCP tool call with supplied arguments.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.66 KB of source, external domains: python.org

Source & flagged code

6 flagged

bin/_run.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2"use strict";

3// Shared launcher for both bins: this package is a thin wrapper, not a rewrite.

4// guaq_mcp.py / guaq_cli.py / guaq_client.py are deliberately stdlib-only Python (see

5// their own docstrings) so anyone can `curl` them onto a locked-down machine with zero

6// installs - this npm package exists ONLY to make `npx employed-mcp` / `npx employed` fetch and

7// run that same code without the user finding and copying the raw files themselves.

8// Requires a Python 3 interpreter on PATH; it does not, and cannot, ship one.

9const { spawnSync } = require("child_process");

10const path = require("path");

11const fs = require("fs");

13function findPython() {

14 const candidates = process.platform === "win32"

15 ? ["python", "python3", "py"]

16 : ["python3", "python"];

17 for (const cmd of candidates) {

18 const probe = spawnSync(cmd, ["--version"], { stdio: "ignore" });

19 if (probe.status === 0) return cmd;

20 }

21 return null;

22}

24function run(scriptName) {

25 const python = findPython();

26 if (!python) {

27 process.stderr.write(

28 "employed-mcp: no Python 3 interpreter found on PATH.\n" +

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/_run.jsView on unpkg · L8

py/guaq_mcp.pyView file

Lines 40-80text

40import sys

41import traceback

43from guaq_client import Guaq, GuaqError

45# Newest first. initialize echoes the client's version when we know it, else our newest, as

46# the MCP lifecycle spec requires; the stdio server and the remote /mcp endpoint share this.

47SUPPORTED_PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"]

48PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0]

49# icons/websiteUrl (MCP Implementation fields): without them a client falls back to a favicon

50# lookup, and Claude looks up the registrable domain guaqai.me, which is the Guaq AI company

51# mark rather than Employed's.

Source & flagged code

6 flagged · loading source

bin/_run.jsView file

8// Requires a Python 3 interpreter on PATH; it does not, and cannot, ship one. L9: const { spawnSync } = require("child_process"); L10: const path = require("path"); ... L13: function findPython() { L14: const candidates = process.platform === "win32" L15: ? ["python", "python3", "py"] ... L26: if (!python) { L27: process.stderr.write( L28: "employed-mcp: no Python 3 interpreter found on PATH.\n" + L29: "This package wraps a Python client (see the README) - install Python 3.8+ " + L30: "from https://python.org and make sure `python3` (or `python` on Windows) " + L31: "resolves, then try again.\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/_run.jsView on unpkg · L8

py/guaq_mcp.pyView file

60OpenAI's review reads this field and flags anything beyond describing this server). INSTRUCTIONS = ( "Employed indexes live job postings read from about 5,000 employers' own "

High

Ai Review Evidence

Source comments explicitly address automated review and describe what content it flags, showing an attempt to steer the review.

py/guaq_mcp.pyView on unpkg · L60

Findings

5 High3 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/_run.js

HighAi Review Evidencepy/guaq_mcp.py

MediumEnvironment Vars

MediumShips Build Helperpy/guaq_mcp.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to employed-mcp@1.2.0.

See all versions of employed-mcp for other recorded verdicts.

Avoid installing employed-mcp@1.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-13 00:30:46.895Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code