
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@dreamworkhq/mcp
Advanced tools
MCP server for Dreamwork — the job-search intelligence layer for AI agents. Gives any MCP client (Claude Desktop, Cursor, the MCP Inspector, etc.) the long-term context to find roles, rank them, tailor applications, auto-apply, and track outcomes for a candidate over time.
This server is a thin gateway: it calls the Dreamwork API over HTTPS and holds no database access of its own. Transport is stdio — stdout carries only JSON-RPC frames.
No install step is required — MCP clients run it on demand with npx. The examples below use npx -y @dreamworkhq/mcp.
Add an entry to your claude_desktop_config.json
(~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"dreamwork": {
"command": "npx",
"args": ["-y", "@dreamworkhq/mcp"],
"env": {
"DREAMWORK_API_KEY": "sk_..."
}
}
}
}
Restart Claude Desktop after editing. Put credentials in the env block — don't
wrap command in a shell or an env-loader (dotenvx run -- …, etc.): on a stdio
server any banner such a wrapper prints to stdout will corrupt the JSON-RPC
stream and hang tool calls.
Any stdio MCP client works. Cursor uses the same config shown above — point the
command at npx -y @dreamworkhq/mcp and pass DREAMWORK_API_KEY in the
environment. To sanity-check with the Inspector:
DREAMWORK_API_KEY=sk_... npx @modelcontextprotocol/inspector npx -y @dreamworkhq/mcp
This package speaks stdio. HTTP-capable clients can instead use Dreamwork's
hosted streamable-HTTP endpoint at the API's /mcp route (no npx needed) — see
the Agents docs for the current URL and
availability.
Generate an agent key from your Dreamwork profile: sign in at
dreamworkhq.com, open your profile → Agent key
section (or use the Get your agent key button on the Agents page), then set it
as DREAMWORK_API_KEY (format sk_...).
Guest mode: with no key set, the server still starts and exposes the public,
read-only tools (browse_listings, get_listing, get_stats,
get_platform_context). Account tools return a short "Login required" message
until a key is provided.
| Variable | Required | Default | Purpose |
|---|---|---|---|
DREAMWORK_API_KEY | For account tools | — | Agent API key (sk_...). Unlocks pipeline, resume, apply, outreach, profile, interviews. |
DREAMWORK_API_URL | No | https://api.dreamworkhq.com | Override the API endpoint (local dev / self-host). |
JOBLESS_API_TOKEN and JOBLESS_API_URL are still accepted as backward-compatible
aliases for DREAMWORK_API_KEY and DREAMWORK_API_URL; prefer the DREAMWORK_
names for new configs.
The typical flow: browse the public index → save roles to the pipeline → tailor materials → auto-apply → track replies, interviews, and escalations.
Public (no key):
get_platform_context, browse_listings, get_listing, get_stats
browse_listings / get_listing search Dreamwork's public job index
(thousands of roles from Greenhouse, Lever, Ashby, Workday, and more).Pipeline & applications:
search_jobs, get_job, import_job, add_jobs, apply_to_job, skip_job,
list_applications, add_listing_to_pipeline
search_jobs lists jobs already in the user's pipeline (use
browse_listings to search the public index).apply_to_job runs the full auto-apply agent: it generates a cover letter and
tailored resume, launches a browser, fills the application form, solves
CAPTCHAs where possible, and submits (the job must have a URL).Resume & materials:
upload_resume, generate_resume, get_generated_resumes
Outreach & contacts:
add_contact, list_contacts, generate_outreach, send_outreach
Profile, interviews & escalations:
get_profile, update_profile, list_interviews, list_escalations,
resolve_escalation
Call get_platform_context first — it describes what Dreamwork can do so the
agent picks the right workflow.
command isn't wrapped in an
env-loader or shell that prints a banner, and update to the latest version
(npx -y @dreamworkhq/mcp@latest; clear the npx cache with rm -rf ~/.npm/_npx
if an old build is cached). stdout must carry only protocol frames — all server
logging goes to stderr.DREAMWORK_API_KEY isn't
reaching the process. Confirm it's in the env block of your client config.pnpm --filter @dreamworkhq/mcp check # typecheck
pnpm --filter @dreamworkhq/mcp build # emit dist/
pnpm --filter @dreamworkhq/mcp test # unit tests
The stdio entrypoint is src/stdio.ts; tool definitions live in
src/mcp.ts; the HTTP API client is src/client.ts.
MIT
FAQs
Dreamwork MCP server — AI job search agent with auto-apply
The npm package @dreamworkhq/mcp receives a total of 24 weekly downloads. As such, @dreamworkhq/mcp popularity was classified as not popular.
We found that @dreamworkhq/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.