jobverify-mcp 0.1.0

Agentic MCP server for detecting fake LinkedIn recruiter / job-offer scams using free OSINT sources

Check whether a recruiter or job offer is real — before you reply.

---

You get a message: "We loved your profile and want to offer you a great remote job." It sounds real. The company has a logo. The recruiter has a photo. But something feels off.

JobVerify helps you find out — in seconds — whether it's genuine or a scam.

You paste the recruiter's message (or a company name, a link, or an email) and ask your AI assistant. JobVerify quietly runs the same background checks a professional investigator would, then gives you a plain-English answer: looks legit, be careful, or this is almost certainly a scam — and why.

---

❌ Without JobVerify

Fake recruiter and job-offer scams are everywhere, and they're convincing. On your own, you're left guessing:

• ❌ Is this company real, or a name someone invented last week?
• ❌ Is this "recruiter" a real person, or a stolen photo and a throwaway account?
• ❌ Is that application link safe, or a look-alike site built to steal your data?
• ❌ Why are they asking me to pay for equipment, or move the chat to WhatsApp/Telegram?

By the time you notice, your time, your personal details — or your money — may already be gone.

✅ With JobVerify

JobVerify cross-checks the offer against dozens of free, public information sources and combines the clues into one clear verdict:

• ✅ Tells you if the company is a registered, real business — or nowhere to be found
• ✅ Spots classic scam scripts (upfront fees, fake "task" jobs, crypto, "let's move off-platform")
• ✅ Flags suspicious links, look-alike domains, and brand-new websites made to look official
• ✅ Checks whether the email, phone, and photos actually belong to who they claim
• ✅ Explains its reasoning in everyday language, so you can decide with confidence

No account, no sign-up, and none of your data is sold or stored. It simply helps you not get fooled.

---

🕵️ How it works

You don't need to learn anything technical. It's a three-step conversation:

1. Paste it. Drop the recruiter's message, a company name, a job link, or an email into your AI chat.
2. It investigates. JobVerify pulls out every detail — the company, links, email, phone, wallet addresses — and quietly checks each one against public records, scam databases, and website history.
3. You get a verdict. A short, honest summary: how risky it looks, which signals are reassuring, which are red flags, and what to do next.

[!NOTE] JobVerify never logs into or scrapes LinkedIn. It only looks at information that is already public, and reads website history through the Internet Archive — the safe, legal way to check how long a profile or company page has really existed (scammers rely on brand-new throwaway accounts).

---

🔎 What it looks at

Think of it as a checklist a careful friend — who happens to be a fraud investigator — would run for you:

Area	The question it answers
The message	Does this match known scam playbooks (advance fees, fake tasks, crypto, urgency)?
The company	Is it a real, registered business? Any recent scam reports? Is the office address real?
The person	Is the email real and deliverable? Is the phone valid? Are the photos/usernames reused elsewhere?
The links	Is the domain brand-new? A look-alike of a real brand? On any phishing/malware blocklist?
The money	Is the crypto wallet they gave you already flagged in scam databases?
The history	How long has this profile or website actually been online?

---

💬 Example

Ask your assistant something as simple as:

Is this recruiter legit?

"Hi! I'm a talent partner at Example Corp. We loved your profile and
want to offer you a remote role at $45/hr. To get started, please purchase
$200 of onboarding equipment through this link — you'll be fully reimbursed
on day one. Let's continue on Telegram: @examplecorp_hr"

JobVerify will pick out Example Corp, the link, and the Telegram hand-off, check each one, and reply with something like: "⚠️ High risk — the company has no public registration, the link was registered 4 days ago, and asking you to pay upfront and move to Telegram are textbook scam signals."

---

🚀 Getting started

No cloning. No virtualenv. No manual install. JobVerify runs straight from GitHub — you only paste a few lines into your AI assistant's config, and it fetches and launches itself on demand.

[!NOTE] The only thing you need once is uv — a tiny, free helper that runs the tool for you:

• macOS / Linux: curl -LsSf https://astral.sh/uv/install.sh | sh
• Windows: powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Claude Desktop

Add this to your claude_desktop_config.json, then restart Claude:

{
  "mcpServers": {
    "jobverify": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/yessGlory17/job-verify", "jobverify-mcp"]
    }
  }
}

Claude Code

One line in your terminal:

claude mcp add jobverify -- uvx --from git+https://github.com/yessGlory17/job-verify jobverify-mcp

The first run takes a few seconds while it downloads the tool; after that it's instant.

Use it

Paste a suspicious message and ask "Is this offer legit?" — or run the built-in analyze prompt. That's it.

---

🔐 Privacy & honesty

• Your data stays yours. No sign-up, no tracking, nothing you paste is stored or sold.
• No API keys or costs. Every source is free and open — public business registries, DNS records, scam blocklists, the Internet Archive, and more.
• Signals, not certainty. JobVerify gives you strong decision support, not a courtroom verdict. Treat the result as informed guidance about a message — never as a final judgment about a real person.

---

For the curious: the full toolbox

Under the hood, the AI assistant orchestrates these individual checks (all free, no keys):

Tool	What it checks
extract_entities	Pulls emails, links, phones, wallets, and profile URLs out of a message
check_scam_patterns	Matches text against known scam tactics
check_email / check_email_footprint	Email deliverability + linked social accounts
check_domain / check_domain_auth	Domain age, registrar, and whether it can be spoofed
check_typosquatting / find_lookalike_domains	Look-alike / imposter domains
check_url / check_ip	Phishing & malware blocklists
check_certificate_transparency	A site's certificate & subdomain history
parse_email_headers	Origin, SPF/DKIM/DMARC, and mismatches in raw email headers
check_phone	Phone number validity and region
check_crypto_address	Known-scam crypto wallet databases
verify_company / search_company_news / verify_address	Business registration, press, and real address
check_github_org / check_username	Whether an org/username really exists and how old it is
check_wayback / fetch_archived_page	Internet Archive history & content (the legal way to read a page)

There's also a single analyze prompt that runs the whole extract → check → verdict flow for you.

---

⚠️ Disclaimer

JobVerify is a decision-support tool. Its signals are probabilistic and may be incomplete or wrong. Always use your own judgment, and never treat a result as a definitive statement about any individual or organization.

License

MIT — use it, share it, and help people stay safe.