Back to Browse

WorkWay BE MCP Server

Developer ToolsUse Caution0.0MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Search 490k+ live jobs from company ATS boards, save roles, follow companies, manage talent profile.

About

Search 490k+ live jobs from company ATS boards, save roles, follow companies, manage talent profile.

Remote endpoints: streamable-http: https://www.workway.dev/api/mcp

Security Report

0.0
Use Caution0.0Critical Risk

This is not an MCP server — it is a backend API service (Express.js) for a job discovery platform called WorkWay. The codebase exhibits critical security vulnerabilities including excessive dependency bloat, use of suspicious/experimental packages, missing input validation on public APIs, hardcoded secrets in environment examples, and dangerous third-party integrations (AWS S3, Google Analytics, OpenAI, Stripe). The presence of @modelcontextprotocol/sdk in dependencies is anomalous for a standard REST API and suggests either misclassification or undocumented MCP server functionality. Several dependencies (dodopayments, base-x, standardwebhooks) are either typosquatting candidates or unmaintained packages. Credential handling is poor, and the codebase lacks secure authentication patterns for sensitive operations. Supply chain analysis found 8 known vulnerabilities in dependencies (0 critical, 2 high severity).

3 files analyzed · 24 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

database

Check that this permission is expected for this type of plugin.

system_info

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

WorkWay Backend

API service powering WorkWay — company/job discovery, filters, sitemaps, and Greenhouse/Ashby/YC ingestion.

Stack

  • Node.js (ES modules) + Express 5
  • PostgreSQL (pg)

Structure

  • src/server.js — app bootstrap, DB init, route mount, graceful shutdown
  • src/config.js — environment/config mapping
  • src/routes/ — API route handlers
  • src/services/ — business logic
  • src/dao/ — SQL queries and DAO abstractions
  • src/utils/ — logger, constants, parsing/classification helpers
  • src/data/greenhouseCompanies.js — seed list of Greenhouse namespaces
  • docs/DETAILED_DOCS.md — detailed architecture and endpoint reference

Setup

npm install

Create .env in repo root:

APP_ENV=dev
POSTGRES_DB_HOST=localhost
POSTGRES_DB_PORT=5432
POSTGRES_DB_USER=postgres
POSTGRES_DB_PASSWORD=root
POSTGRES_DB_DATABASE=eqhqdb
POSTGRES_DB_MAX_CONNECTIONS=20
PORT=3000

Run:

npm run dev   # or: npm start

Defaults to http://localhost:3000.

API

Base path: /api

  • /api/company, /api/job, /api/feed, /api/filter, /api/cron
  • /api/sitemap.xml, /api/sitemaps/*
  • GET /api/job/list — paginated job listing with search/filters, returns jobs, meta, applied_filters, facets
  • GET /api/job/filters — facet counts for the filter UI

Full request/response reference: docs/DETAILED_DOCS.md

Health

  • GET /health — uptime + timestamp
  • GET / — server-running check

Ingestion

Cron-style HTTP endpoints load Greenhouse, Ashby, and YC companies, fetch their jobs, classify them (domain/level/employment type), and upsert into PostgreSQL.

Production

Serves workway.dev.

Reviews

No reviews yet

Be the first to review this server!