Trackly CLI + MCP Server. Search jobs, track applications, and query your job hunt from the terminal, Claude Code, or OpenClaw.
- capability exposure inferred + 35
- tool safety inferred + 14
- trust mitigators mixed − 16
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 10h ago · see ecosystem CVEs →
- C · 38 → B · 33
- B · 25 → C · 38
- B · 33 → B · 25
- C · 44 → B · 33
- B · 32 → C · 44
- B · 25 → B · 32
- A · 3 → B · 25
No known CVEs for this server.
- high dangerous code
dynamic exec: eval() · obfuscated payload: dynamic require()/import()
- low exfiltration combo
sensitive read and network capabilities split across this server's tools
analyzed commit e6224f9 · analyzer v33 · 1d ago
skills & prompt files 5
- agent-rules trackly-app-trackly-cli-e6224f9/AGENTS.md
- agent-rules trackly-app-trackly-cli-e6224f9/CLAUDE.md
- skill trackly-app-trackly-cli-e6224f9/plugins/trackly/skills/trackly-apply/SKILL.md
- skill trackly-app-trackly-cli-e6224f9/plugins/trackly/skills/trackly/SKILL.md
- skill trackly-app-trackly-cli-e6224f9/skills/trackly-apply/SKILL.md
danger signals1
- dynamic code execution eval() trackly-app-trackly-cli-e6224f9/test/apply-contract.test.js :403
eval("APPLY_BATCH_CHECKPOINT_ACTION_MAP['review/manual_submit'].continuationAllowed = true");
[](https://mcpobservatory.com/servers/github:trackly-app/trackly-cli/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of trackly-app.