MCP Observatory
6m ago Tracked 53,340 Last 6m ago 24h 2,739
github JavaScript re-analysis due

trackly-app/trackly-cli

github

Trackly CLI + MCP Server. Search jobs, track applications, and query your job hunt from the terminal, Claude Code, or OpenClaw.

maintainer
trackly-app
license
MIT
first seen
2026-06-11
last seen
2026-09-05
releases · 30d
9
short id

Drift inferred · capture-to-capture

tool count over time

06-13 10:36 08-11 18:43 now
10t
48t
55t
capabilities 58 tools
transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 58 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • get_more_tools
  • trackly_advance_apply_execution
  • trackly_approve_apply_batch_resume
  • trackly_approve_apply_execution_resume
  • trackly_ask
  • trackly_bind_apply_surface
  • trackly_cancel_apply_batch
  • trackly_certify_apply_batch_truth
  • trackly_checkpoint_apply_batch
  • trackly_claim_apply_batch
  • trackly_claim_apply_review_handoff
  • trackly_clear_apply_access_deferment
  • trackly_contacts_at_company
  • trackly_create_apply_batch
  • trackly_defer_apply_access
  • trackly_diagnose_local_path
  • trackly_get_active_apply_batch
  • trackly_get_active_apply_execution
  • trackly_get_application_profile
  • trackly_get_apply_batch
  • trackly_get_apply_evidence
  • trackly_get_apply_execution
  • trackly_get_apply_execution_snapshot
  • trackly_get_apply_protocol
  • trackly_get_apply_queue
  • trackly_get_company_workspace
  • trackly_get_job
  • trackly_get_job_brief
  • trackly_get_preferences
  • trackly_get_profile_onboarding
  • trackly_get_stats
  • trackly_lint_application_text
  • trackly_list_apply_access_deferments
  • trackly_list_apply_review_handoffs
  • trackly_list_companies
  • trackly_list_recoverable_apply_executions
  • trackly_prepare_resume
  • trackly_record_application_outcome
  • trackly_record_application_outcomes
  • trackly_record_apply_execution_dispositions
  • trackly_record_apply_submission_evidence
  • trackly_record_apply_surface_evidence
  • trackly_recover_exact_apply_members
  • trackly_report_apply_observation
  • trackly_report_apply_observations
  • trackly_request_company
  • trackly_resume_parked_apply_member
  • trackly_search_companies
  • trackly_search_jobs
  • trackly_start_apply_execution
  • trackly_start_apply_run
  • trackly_stop_apply_execution
  • trackly_update_application_profile
  • trackly_update_experience_limits
  • trackly_update_status
  • trackly_validate_apply_resume_upload
  • trackly_validate_apply_tab_keep_set
  • trackly_verify_prepared_resume
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e6224f9 · analyzer v33 · 11h ago

skills & prompt files 5

danger signals1

code evidence vv0.18.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 46

filesystem 30

  • fs trackly-app-trackly-cli-e6224f9/lib/agent.js :4 const fs = require('node:fs');
  • fs trackly-app-trackly-cli-e6224f9/lib/client.js :5 const fs = require('fs');
  • fs trackly-app-trackly-cli-e6224f9/lib/path-diagnostics.js :4 const fs = require('node:fs/promises');
  • fs (weak) trackly-app-trackly-cli-e6224f9/scripts/review-auth-contract-ast.js :6 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/scripts/sync-public-metrics.js :4 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/scripts/verify-audit-exceptions.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/scripts/verify-hosted-contract.js :9 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/scripts/verify-review-auth-contract.js :7 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/agent.test.js :7 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/apply-batch.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/apply-contract.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/apply-deterministic-answering.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/apply-execution.test.js :4 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/apply-operational-checkpoints.test.js :7 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/apply-tab-reconciliation.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/apply-tab-set.test.js :145 const source = require('node:fs').readFileSync(require.resolve('../lib/apply-tab-set'), 'utf8');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/ci-runner-routing.test.js :9 const fs = require("node:fs");
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/cli-integration.test.js :14 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/cli.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/client.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/dependency-security.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/docs-coverage.test.js :19 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/helpers.js :7 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/mcp-schema.test.js :21 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/mcp-smoke.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/mcp-stdio-isolation.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/package-consumer.test.js :5 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/path-diagnostics.test.js :4 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/plugin-package.test.js :8 const fs = require('node:fs');
  • fs (weak) trackly-app-trackly-cli-e6224f9/test/public-metrics.test.js :2 const fs = require('node:fs');

shell / exec 16

  • shell trackly-app-trackly-cli-e6224f9/lib/agent.js :7 const { spawnSync } = require('node:child_process');
  • shell trackly-app-trackly-cli-e6224f9/lib/path-diagnostics.js :6 const { execFile } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/scripts/review-auth-contract-ast.js :4 const childProcess = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/scripts/verify-audit-exceptions.js :7 const { spawnSync } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/scripts/verify-hosted-contract.js :7 const childProcess = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/scripts/verify-review-auth-contract.js :6 const childProcess = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/agent.test.js :5 const { spawnSync } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/apply-contract.test.js :2512 const { spawnSync } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/apply-operational-checkpoints.test.js :5 const { spawn, spawnSync } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/cli-integration.test.js :8 // The harness uses ASYNC execFile (via runCli), never spawnSync: a sync child
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/cli.test.js :9 const { spawnSync } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/helpers.js :11 const { execFile } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/mcp-smoke.test.js :9 const { spawn } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/mcp-stdio-isolation.test.js :8 const { spawn } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/package-consumer.test.js :8 const { spawn, spawnSync } = require('node:child_process');
  • shell (weak) trackly-app-trackly-cli-e6224f9/test/plugin-package.test.js :6 const childProcess = require('node:child_process');

network 6

  • net trackly-app-trackly-cli-e6224f9/lib/client.js :3 const https = require('https');
  • net (weak) trackly-app-trackly-cli-e6224f9/test/cli.test.js :6 const http = require('node:http');
  • net (weak) trackly-app-trackly-cli-e6224f9/test/client.test.js :7 const http = require('node:http');
  • net (weak) trackly-app-trackly-cli-e6224f9/test/helpers.js :10 const http = require('node:http');
  • net (weak) trackly-app-trackly-cli-e6224f9/test/mcp-schema.test.js :22 const http = require('node:http');
  • net (weak) trackly-app-trackly-cli-e6224f9/test/mcp-smoke.test.js :8 const http = require('node:http');

secrets 8

  • secrets trackly-app-trackly-cli-e6224f9/lib/client.js :139 (process.env.TRACKLY_API_KEY || '').trim()
  • secrets (weak) trackly-app-trackly-cli-e6224f9/scripts/verify-hosted-contract.js :3230 "(process.env.JWT_SECRET || '').trim()",
  • secrets (weak) trackly-app-trackly-cli-e6224f9/scripts/verify-review-auth-contract.js :271 assert.ok(activeBindingMembers.has('process.env.MCP_REVIEW_LOGIN_PASSWORD'), 'The active binding helper must read MCP_REVIEW_LOGIN_PASSWORD');
  • secrets (weak) trackly-app-trackly-cli-e6224f9/test/apply-contract.test.js :1834 const jwtSecretFromEnv = (process.env.JWT_SECRET || '').trim();
  • secrets (weak) trackly-app-trackly-cli-e6224f9/test/mcp-analytics.test.js :54 apiKey: process.env.TRACKLY_API_KEY,
  • secrets (weak) trackly-app-trackly-cli-e6224f9/test/mcp-schema.test.js :346 const originalApiKey = process.env.TRACKLY_API_KEY;
  • secrets (weak) trackly-app-trackly-cli-e6224f9/test/mcp-smoke.test.js :195 TRACKLY_API_KEY: process.env.TRACKLY_API_KEY,
  • secrets (weak) trackly-app-trackly-cli-e6224f9/test/plugin-package.test.js :158 const reviewed = parse("const password = process.env.MCP_REVIEW_LOGIN_PASSWORD;\nexport function authenticate(value: string) { return value === password; }");

tool registrations 58

  • trackly_get_apply_queue trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :695
  • trackly_get_application_profile trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :711
  • trackly_get_profile_onboarding trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :736
  • trackly_update_application_profile trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :749
  • trackly_start_apply_execution trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :803
  • trackly_get_active_apply_execution trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :825
  • trackly_get_apply_execution trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :843
  • trackly_list_recoverable_apply_executions trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :862
  • trackly_recover_exact_apply_members trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :881
  • trackly_list_apply_review_handoffs trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :913
  • trackly_claim_apply_review_handoff trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :941
  • trackly_get_apply_execution_snapshot trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :977
  • trackly_resume_parked_apply_member trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1014
  • trackly_approve_apply_execution_resume trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1030
  • trackly_advance_apply_execution trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1050
  • trackly_record_apply_execution_dispositions trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1110
  • trackly_stop_apply_execution trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1124
  • trackly_list_apply_access_deferments trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1143
  • trackly_defer_apply_access trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1159
  • trackly_clear_apply_access_deferment trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1182
  • trackly_create_apply_batch trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1213
  • trackly_cancel_apply_batch trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1231
  • trackly_get_apply_batch trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1248
  • trackly_get_active_apply_batch trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1276
  • trackly_claim_apply_batch trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1303
  • trackly_checkpoint_apply_batch trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1323
  • trackly_approve_apply_batch_resume trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1342
  • trackly_bind_apply_surface trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1374
  • trackly_record_apply_surface_evidence trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1401
  • trackly_record_apply_submission_evidence trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1430
  • trackly_certify_apply_batch_truth trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1457
  • trackly_start_apply_run trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1481
  • trackly_get_apply_evidence trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1497
  • trackly_get_apply_protocol trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1514
  • trackly_report_apply_observation trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1521
  • trackly_report_apply_observations trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1548
  • trackly_record_application_outcome trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1587
  • trackly_record_application_outcomes trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1608
  • trackly_prepare_resume trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1637
  • trackly_lint_application_text trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1649
  • trackly_diagnose_local_path trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1668
  • trackly_validate_apply_tab_keep_set trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1678
  • trackly_validate_apply_resume_upload trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1696
  • trackly_verify_prepared_resume trackly-app-trackly-cli-e6224f9/mcp/apply-tools.js :1716
  • trackly_search_jobs trackly-app-trackly-cli-e6224f9/mcp/server.js :257
  • trackly_get_job trackly-app-trackly-cli-e6224f9/mcp/server.js :328
  • trackly_search_companies trackly-app-trackly-cli-e6224f9/mcp/server.js :339
  • trackly_list_companies trackly-app-trackly-cli-e6224f9/mcp/server.js :353
  • trackly_get_stats trackly-app-trackly-cli-e6224f9/mcp/server.js :368
  • trackly_get_preferences trackly-app-trackly-cli-e6224f9/mcp/server.js :377
  • trackly_update_experience_limits trackly-app-trackly-cli-e6224f9/mcp/server.js :387
  • trackly_update_status trackly-app-trackly-cli-e6224f9/mcp/server.js :433
  • trackly_ask trackly-app-trackly-cli-e6224f9/mcp/server.js :454
  • trackly_get_job_brief trackly-app-trackly-cli-e6224f9/mcp/server.js :490
  • trackly_contacts_at_company trackly-app-trackly-cli-e6224f9/mcp/server.js :501
  • trackly_get_company_workspace trackly-app-trackly-cli-e6224f9/mcp/server.js :515
  • trackly_request_company trackly-app-trackly-cli-e6224f9/mcp/server.js :526
  • get_more_tools trackly-app-trackly-cli-e6224f9/mcp/server.js :550

declared dependencies 9

  • @modelcontextprotocol/sdk@1.30.0
  • @posthog/mcp@0.11.0
  • fast-uri@3.1.7
  • hono@4.13.0
  • ip-address@10.4.0
  • posthog-node@5.48.1
  • zod@^3.23.0
  • @babel/parser@7.29.8
  • acorn@8.18.0

obfuscation 2

  • dynamic require()/import() trackly-app-trackly-cli-e6224f9/test/apply-contract.test.js :2537 require(${JSON.stringify(verifierPath)}).verifyHostedContract();
  • dynamic require()/import() trackly-app-trackly-cli-e6224f9/test/package-consumer.test.js :181 const agent = require(${JSON.stringify(path.join(installedCli, 'lib', 'agent.js'))});