
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@careermax/agent-toolkit
Advanced tools
Connect AI agents to CareerMax -- job tracking, resume review, cover letters, interview prep, and more.
export CAREERMAX_API_KEY="cmx_live_..."
npx @careermax/agent-toolkit jobs list
cmx_live_)| Variable | Required | Description |
|---|---|---|
CAREERMAX_API_KEY | Yes | Your API key from CareerMax |
CAREERMAX_API_URL | No | Override the API URL (defaults to CareerMax production) |
CAREERMAX_LOG_LEVEL | No | Log verbosity (debug, info, warn, error) |
The toolkit includes an MCP (Model Context Protocol) server that lets AI assistants interact with your CareerMax account directly.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"careermax": {
"command": "npx",
"args": ["-y", "@careermax/agent-toolkit", "mcp"],
"env": {
"CAREERMAX_API_KEY": "cmx_live_..."
}
}
}
}
Config file locations:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonAdd to .cursor/mcp.json in your project root:
{
"mcpServers": {
"careermax": {
"command": "npx",
"args": ["-y", "@careermax/agent-toolkit", "mcp"],
"env": {
"CAREERMAX_API_KEY": "cmx_live_..."
}
}
}
}
Any MCP-compatible client can connect. Run the server with:
CAREERMAX_API_KEY="cmx_live_..." npx @careermax/agent-toolkit mcp
The server communicates over stdio using the standard MCP protocol.
export CAREERMAX_API_KEY="cmx_live_..."
Or install globally:
npm install -g @careermax/agent-toolkit
Get an overview of what CareerMax can do:
careermax info
List jobs in your pipeline:
careermax jobs list
careermax jobs list --status applied
careermax jobs list --json
Review your resume with AI:
careermax resume review
careermax resume review --job-id <id> # tailor feedback to a specific job
Generate a cover letter:
careermax cover-letter generate --job-id <id>
Create a mock interview session:
careermax interviews create --role "Software Engineer" --company Stripe
careermax interviews list
Check your credit balance:
careermax credits
| Flag | Description |
|---|---|
--json | Output raw JSON instead of formatted tables |
--yes | Skip confirmation prompts (useful in scripts) |
--api-key <key> | Override the CAREERMAX_API_KEY env var |
--verbose | Enable detailed logging |
These tools are exposed via the MCP server and can be called by any connected AI agent.
| Tool | Description |
|---|---|
careermax_info | Get an overview of CareerMax capabilities and the user's account |
jobs_list | List all jobs in the user's pipeline, with optional status filter |
jobs_get | Get full details for a specific job |
jobs_add | Add a new job to the pipeline |
jobs_update | Update a job's status, notes, or other fields |
resume_review | Run an AI review of the user's resume, optionally tailored to a job |
cover_letter_generate | Generate a cover letter for a specific job |
interviews_create | Create a new mock interview session for a given role and company |
interviews_list | List past and upcoming interview sessions |
credits_get | Check the user's current credit balance and plan tier |
AI Agent (Claude, GPT, etc.)
|
v
MCP Server / CLI
| (HTTP + Bearer auth)
v
Convex Backend (api/v1/*)
|
v
Same AI pipeline as the CareerMax web app
The toolkit is a thin client. All heavy lifting -- AI resume analysis, cover letter generation, interview simulation -- happens server-side on the same Convex backend that powers the CareerMax web app. Your data stays in your account.
MIT
FAQs
MCP server and CLI for connecting AI agents to CareerMax
We found that @careermax/agent-toolkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.