Workopia — Jobs, Resumes & Career Advice

Search jobs, build professional resumes, and get career advice using Workopia's MCP server. Use when users ask about job searching, finding jobs, resume buil...

Security Scan

The skill's stated purpose (job search, resume building, career advice) matches what it asks you to do, but it instructs you to add an unauthenticated remote MCP server to your agent config and makes unverifiable privacy/logging claims — this requires explicit trust and caution before installing.

Purpose & Capability

Name and description align with the declared functionality (job_search, resume_builder, career_advisor). Requiring a remote MCP server is reasonable for an external job/resume service. However, the SKILL.md asks you to add a streamable-http MCP server hosted at workopia.io into your agent config (~/.openclaw/openclaw.json), which is a privileged integration and requires you to trust that external server.

Instruction Scope

The runtime instructions explicitly tell the user to add an external MCP endpoint (type: streamable-http, url: https://workopia.io/api/mcp-gpt) to the agent config. That allows the remote server to receive tool calls and send back responses that the agent will use. The SKILL.md does not provide technical limits on what the MCP responses can request the agent to do (for example, whether responses can ask the agent to access local files, environment variables, or other tools). The doc repeatedly asserts stateless processing and no logging, but those are operator claims that cannot be verified from this manifest. Because the skill delegates execution to an external server, there is a plausible risk that sensitive data sent to the server (e.g., resume text, job-search context) could be logged or otherwise retained contrary to the policy statements.

Install Mechanism

Instruction-only skill with no install spec and no code files. Nothing is written to disk by the skill itself. The only install-like action is a user edit to the OpenClaw config file to add the remote MCP server; that is explicit and visible to the user.

Credentials

The skill requires no environment variables, binaries, or config paths beyond the user editing their OpenClaw config. That's proportionate to a remote-service integration. Nevertheless, because the MCP endpoint is unauthenticated, any data you send (resume contents, job queries) will be transmitted to an external service — the skill's claims about no-logging and transient in-memory processing are operator assertions and should be treated cautiously.

Persistence & Privilege

The skill does not request always:true and is user-invocable, but autonomous model invocation is allowed by default. Combining autonomous invocation with a remotely-hosted MCP server increases risk: the remote server can shape tool responses and potentially cause the agent to request or transmit additional data. The SKILL.md does not describe safeguards (scoping, explicit user prompts before sending potentially sensitive data) or limits on what the remote MCP can ask the agent to do.

What to consider before installing

Before adding this skill, consider that you are trusting an external server (https://workopia.io/api/mcp-gpt) to process your queries and any resume text you provide. The manifest asserts no logging and transient processing, but those are claims you cannot verify from the SKILL.md alone. If you decide to proceed: (1) only enable the MCP server for explicit, user-initiated use (avoid allowing autonomous invocation to call it), (2) avoid sending highly sensitive data (full SSNs, passwords, private keys, corporate confidential text) to the service, (3) test with non-sensitive samples first to confirm behavior, (4) inspect the Workopia repository and privacy policy linked in the SKILL.md (https://github.com/workopia/workopia-mcp and https://workopia.io/privacy) for technical details and logging practices, (5) prefer authenticated endpoints or a vetted provider; if you need stronger assurance, contact the operator at the provided email to request an explicit data-handling statement and technical documentation. If you are not comfortable trusting an unauthenticated remote MCP, do not add the server to your OpenClaw config.

GitHub / Source: https://github.com/workopia/workopia-mcp

Workopia provides three AI-powered tools via MCP: job search, resume builder, and career advisor.

Setup

Add Workopia as a remote MCP server in your OpenClaw config (~/.openclaw/openclaw.json):

{
  "mcpServers": {
    "workopia": {
      "type": "streamable-http",
      "url": "https://workopia.io/api/mcp-gpt"
    }
  }
}

No API key or authentication required.

Available Tools

1. job_tool — Job Search

Search jobs sourced directly from employer career pages. Supports filters by title, location, company, and remote work.

Example prompts:

• "Find software engineer jobs in San Francisco"
• "Show me remote product manager positions"
• "Search for data scientist roles at Google"

Results include job title, company, location, salary (when available), and direct apply links to the employer's site.

2. resume_tool — Resume Builder

Improve resume content or generate a professional PDF with 6 templates:

• Workopia Classic — Clean, traditional layout
• Workopia Modern — Contemporary design
• Workopia Elegant — Refined, professional
• Workopia Creative — Bold, standout design
• Workopia Designer — European-inspired
• Workopia Flexbox — Print-optimized layout

Example prompts:

• "Improve my resume for a senior engineer role"
• "Generate a PDF resume with the Modern template"
• "Tailor my resume for this job posting"

Rate limit: 20 requests per hour per IP.

3. career_tool — Career Advisor

Get career transition advice, skill gap analysis, and personalized career planning.

Example prompts:

• "How do I transition from marketing to product management?"
• "What skills do I need for a data science career?"
• "Compare career paths in frontend vs backend engineering"

Data Sources — Where Job Data Comes From

• Employer career pages & ATS feeds — Jobs are sourced from official employer websites and ATS providers (e.g., Lever) via openly available job feeds and endpoints
• No scraping — Workopia does not scrape, copy, or host job content from third-party job boards (LinkedIn, SEEK, Indeed, etc.)
• Job metadata only — Workopia stores job title, company, location, posting URL, timestamps, and source identification for search and deduplication
• Direct apply links — Every job result links directly to the official employer posting. Users apply on the employer's site, not through Workopia
• AI-generated labels — Job summaries and key requirements are AI-generated and clearly labeled. Users are always directed to the original posting for the complete, unmodified description

Privacy & Data Handling

Full Privacy Policy: https://workopia.io/privacy — see Section 3.2 #3 "ChatGPT App Store & AI Agent Integrations" for MCP-specific data handling.

What Workopia does NOT store (MCP usage)

• No conversation logging — MCP tool calls (job searches, career advice queries, resume tailoring requests) are processed statelessly. Queries and responses are not logged or retained on our servers.
• Resume content handling via MCP — Resume text submitted through MCP is processed in-memory for the requested operation only (PDF generation or text tailoring). Resume content is not retained beyond the session. Generated PDFs use temporary session identifiers and are auto-deleted within 7 days.
• No persistent profile for MCP users — No login or account required. MCP usage does not create a user account, profile, or persistent record. The retention periods in our privacy policy Section 8 apply to web-site (authenticated) users only, not MCP-only users.
• No credentials stored — Workopia does not receive or store credentials from any third-party AI platform (ChatGPT, Claude, OpenClaw, etc.)
• IP addresses for rate limiting only — IP addresses on MCP endpoints are used only for rate limiting (resume_tool: 20 requests per hour per IP) and are not linked to any user profile or persistent analytics record.

What Workopia does NOT do with your data

• No selling — User data is never sold to third parties
• No advertising — User data is never used for ads or behavioral profiling
• No cross-platform tracking — No cookies, fingerprinting, or cross-context tracking

Security

• HTTPS only — All communication between your client and Workopia is encrypted via TLS
• Session-scoped MCP — Each MCP request is handled independently. Temporary session identifiers are used for file generation only and do not persist beyond the session.
• Rate limiting — resume_tool: 20 requests per hour per IP (prevents abuse). job_tool and career_tool: unlimited

Operator

• Company: HERAAI PTY LLC (Delaware, USA)
• Contact: [e-mail]
• Compliance: Privacy policy Section 3.2 covers AI processing and third-party AI integrations (ChatGPT, Claude, MCP agents)

Need more quota?

Workopia is free for everyone at launch — no API key, no sign-up, no payment. Default rate limits:

• job_tool, career_tool: unlimited
• resume_tool: 20 requests per hour per IP

If you need higher quota or a custom arrangement, email [e-mail] and we'll work with you directly.

Key Facts

• Jobs sourced from official employer career pages, not scraped from job boards
• Free to use, no subscription, no payment required
• AI-generated content is clearly labeled
• Also available on Claude Desktop, ChatGPT App Store, and MCP Registry