
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
interviewer-mcp
Advanced tools
MCP server that teaches you your own GitHub repos, then mock-interviews you on them — and remembers your weak spots across sessions.
A technical interviewer that has actually read your repos — teaches you your own code, drills you on it, and remembers every answer you flubbed.
Install · Demo · Tools · Architecture · llms.txt
AI agents / LLMs: read /llms.txt for a machine-readable index of this project.
Interviewers ask about your projects: why this library, what happens when this request fails, walk me through the auth flow. LeetCode can't prep you for that, and a plain chat session forgets everything between sessions. Interviewer MCP indexes your GitHub repo into a teachable code map, walks you through it Socratically, mock-interviews you in character — and keeps a persistent, per-section record of what you couldn't explain, so the next session re-attacks exactly those spots. It teaches and tests, and the test gets smarter every time. Not a stateless quiz.
"Walk me through this function." Every candidate has frozen on that question about code they wrote months ago — or that AI wrote for them. This makes sure it never happens in the real interview.
You Test me again on soundofspace — last week went badly.
Claude [get_progress] Welcome back. Coverage: 9/14 sections. Three questions
logged weak, the worst: "why is the JWT verified server-side?"
Let's start exactly there. [get_code_section auth.ts:verifyToken]
Here's your own code. Line 12 verifies the signature before touching
the payload. Why can't the client just send the decoded claims?
You Because... the client could edit them?
Claude Right instinct — be precise. What stops an attacker who edits the
payload AND re-signs it? Where does the signing secret live?
[log_interview_result: okay — "knows tampering risk, fuzzy on
why the secret never leaves the server"]
Two ways to run it — pick per surface:
claude mcp add interviewer -- npx -y interviewer-mcp
# optional: private repos + 5,000 req/hr instead of 60
claude mcp add interviewer --env GITHUB_TOKEN=github_pat_... -- npx -y interviewer-mcp
Claude Desktop — add to the config file instead:
{
"mcpServers": {
"interviewer": {
"command": "npx",
"args": ["-y", "interviewer-mcp"],
"env": { "GITHUB_TOKEN": "github_pat_optional_but_recommended" }
}
}
}
Both classic and fine-grained tokens work (read-only Contents permission is enough). Then:
Prep me for my interview — my repo is github.com/you/your-project
Agent-driven install: point Claude at SETUP_GUIDE.md and it configures everything itself.
SKILL.md, put it in a folder named interview-prepper/, zip the folderThe honest difference: the MCP server keeps a durable local database of your coverage and weak spots — return in three weeks and it remembers. The Skill runs entirely inside claude.ai: it clones your repo per session and recalls prior sessions via conversation search, which is best-effort, not guaranteed. Same curriculum and teaching format either way; the MCP path is the one that makes "it remembered" a hard promise.
~/.interviewer-mcp/ and every returning session opens from your weakest point.Five phases, picked in your order from a menu: ① company briefing → ② concept bootcamp (JD ∪ CV ∪ repo stack) → ③ code deep-dive → ④ mock interview → ⑤ debrief.
ingest_repo ──▶ briefing ──▶ bootcamp ──▶ code deep-dive ──▶ mock interview ──▶ debrief
▲ │
└──── "test me again" (days later)
the interviewer REMEMBERS ◀┘
| Tool | What it does |
|---|---|
ingest_repo | Fetch + index a GitHub repo into a teachable code map |
list_sections | Sections in teaching order, with covered status + weakness scores |
get_code_section | One section's code with file context |
mark_covered | Mark a section learned (only after you explain it back) |
get_interview_targets | Probe-worthy code, weakest spots first |
log_interview_result | Score an answer; powers cross-session memory |
set_job_description | Store JD + company + CV; powers briefing, bootcamp, and gap questions |
get_progress | Coverage, history, top weaknesses — the "welcome back" tool |
Great fit if you…
Skip it if you…
Local-first and dependency-light by design: plain TypeScript, native fetch, and a JSON store — no native modules, so npx interviewer-mcp boots on every OS with zero build tooling. Your code cache and interview history live in ~/.interviewer-mcp/ (override with INTERVIEWER_DATA_DIR) and never leave your machine; the only network calls are to GitHub. Sectioning is regex-based per language family (JS/TS, Python, Go, Java/C#/Kotlin) with chunking fallback — tree-sitter AST parsing is on the roadmap.
Full pipeline, store layout, and design-decision rationale: ARCHITECTURE.md.
PRs welcome — the core is small, pure, and tested (npm install && npm test). See CONTRIBUTING.md. Vulnerabilities: SECURITY.md.
MIT © Girik Chadha
FAQs
MCP server that teaches you your own GitHub repos, then mock-interviews you on them — and remembers your weak spots across sessions.
We found that interviewer-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.