@pipeworx/mcp-ats-boards 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mojibake Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,188 @@
-# Temporary Holding Version
+# @pipeworx/ats-boards
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Public job-board postings across eight applicant-tracking systems (Greenhouse,
+Lever, Ashby, SmartRecruiters, Recruitee, BambooHR, Workday, Workable) — detect
+which ATS a company publishes its careers page on, then read any company's
+open roles without a key. This is NOT the `greenhouse`/`ashby` packs, which
+read the caller's OWN private hiring data with their own API key; this pack
+reads the same public board any browser can see, for any company.
+
+Part of [Pipeworx](https://pipeworx.io) — an MCP gateway connecting AI agents to 1743+ live data sources. This is an independent, unofficial integration — not affiliated with, endorsed by, or published by the upstream provider.
+
+## Tools
+
+- `ats_detect(domain | careers_url)` — find which ATS a company uses and its
+  board token, by scraping the careers page for an ATS link and, failing that,
+  slug-probing the domain name against each board API. Persists the discovery
+  so a repeat lookup for the same domain is instant.
+- `ats_jobs(ats, board_token, filters?)` — normalized job postings for a board
+  you already have `ats` + `board_token` for. Distinguishes an unknown board
+  (`found:false, reason:"board_not_found"`) from a real board with zero
+  current postings (`found:true, jobs:[]`) for every ATS except
+  SmartRecruiters, which cannot tell them apart (see below) — that case is
+  marked `ambiguous:true` instead of guessing.
+- `ats_company_jobs(domain, filters?)` — `ats_detect` + `ats_jobs` in one call.
+- `ats_new_postings(ats, board_token, since?)` — diffs current postings
+  against the last snapshot taken for that board. The first call for a board
+  has no prior snapshot, so it returns every current posting as new
+  (`snapshot_bootstrap:true`) instead of a misleadingly empty diff.
+
+## Auth
+
+Keyless. Every endpoint below is the same public board data a browser sees on
+a company's own careers page — no account, token or registration on any of
+the eight ATS vendors.
+
+The one exception is Workable: its public widget is currently blocked by
+Cloudflare from this platform's edge (see "Data sources" below) — not an auth
+wall, a transport failure. `ats_jobs`/`ats_company_jobs` throw a loud error
+naming the HTTP 429 and Cloudflare's block when asked for `ats:"workable"`,
+rather than returning an empty result.
+
+## Data sources
+
+- `https://boards-api.greenhouse.io/v1/boards/{board_token}/jobs?content=true` — Greenhouse's public board API.
+- `https://api.lever.co/v0/postings/{board_token}?mode=json` (`https://api.eu.lever.co/...` for `filters.region:"eu"`) — Lever's public postings API.
+- `https://api.ashbyhq.com/posting-api/job-board/{board_token}?includeCompensation=true` — Ashby's public job-board API (officially documented, includes comp bands where the employer publishes them).
+- `https://api.smartrecruiters.com/v1/companies/{board_token}/postings` — SmartRecruiters' public postings API.
+- `https://{board_token}.recruitee.com/api/offers/` — Recruitee's public offers API.
+- `https://{board_token}.bamboohr.com/careers/list` — BambooHR's public careers-widget endpoint.
+- `https://{tenant}.wd{N}.myworkdayjobs.com/wday/cxs/{tenant}/{site}/jobs` (POST) — Workday's public CXS jobs search. `board_token` encodes all three path parts as `"{tenant}.wd{N}/{site}"`, e.g. `"workday.wd5/Workday"` (read the tenant/wd-number/site straight off the company's own `myworkdayjobs.com` careers URL).
+- `https://apply.workable.com/api/v1/widget/accounts/{board_token}` — Workable's public widget API. **Currently unreachable from this platform's edge**, confirmed live via a throwaway `wrangler dev --remote` Worker on Pipeworx's production Cloudflare account: every one of 5+ attempts (two endpoint shapes — the v1 widget and the v3 `/api/v3/accounts/{account}/jobs`, with and without an `Accept` header, against several real account names, several minutes apart) returned HTTP 429 with `Content-Type: text/plain` and body `error code: 1015` — Cloudflare's OWN bot-mitigation, not a Workable application response. That reads as apply.workable.com's Cloudflare WAF specifically rate-limiting Cloudflare-Worker-to-Cloudflare traffic. The adapter is implemented per Workable's documented widget shape and is ready the moment this changes; until then every live call throws loud, naming the 429, rather than returning an empty board.
+
+### The silent-zero shape, per ATS (each measured live, not assumed from docs)
+
+Each ATS answers "no such board" differently, and three don't distinguish it
+from "real board, zero jobs right now" at all:
+
+| ATS | Unknown board | Real board, zero jobs |
+|---|---|---|
+| Greenhouse | HTTP 404 JSON `{"status":404,"error":"Job not found"}` | HTTP 200 `{"jobs":[]}` |
+| Lever | HTTP 404 JSON `{"ok":false,"error":"Document not found"}` | HTTP 200 `[]` (confirmed live: `api.lever.co/v0/postings/lever`) |
+| Ashby | HTTP 404, **plain text** `"Not Found"` (not JSON) | HTTP 200 JSON `{"jobs":[],"apiVersion":"1"}` (confirmed live: `vercel`, `deel`, `mercury`) |
+| SmartRecruiters | **Same shape as "zero jobs" — cannot tell them apart.** Both return HTTP 200 `{"totalFound":0,"content":[]}` | Same as unknown; this pack marks `ambiguous:true` rather than guessing |
+| Recruitee | HTTP 404 JSON `{"error":"Not Found"}` | Not independently confirmed live (not found within this build's time budget); expected HTTP 200 `{"offers":[]}` by analogy with every sibling ATS's 200-success-empty-array convention |
+| BambooHR | HTTP 200 (not 404!), `Content-Type: text/html` — BambooHR's own marketing homepage, byte-identical across different nonsense subdomains (a wildcard catch-all, not a per-company 404) | HTTP 200 JSON `{"meta":{"totalCount":0},"result":[]}` (confirmed live: `helpscout`, `pantheon`) |
+| Workday | HTTP 404 JSON `{"errorCode":"S21",...,"message":"not found: Job_Posting_Site_ID=..."}` | Not independently confirmed (every real tenant found had jobs); `limit` over 20 is HTTP 400, not an empty page; `offset` past 10,000 returns HTTP 200 with the SAME page as `offset:0` rather than erroring — this pack reports `capped:true` when either cap is hit |
+| Workable | Blocked (HTTP 429, Cloudflare) before any board-shaped answer is reachable from this platform | — |
+
+Treating any non-200 as "zero jobs," or SmartRecruiters' `totalFound:0` as a
+confirmed empty board, is the exact silent-zero failure this pack exists to
+avoid — see the header comment in `src/index.ts` for the full edge-probe
+evidence (status/length/first-400-bytes) behind every row above.
+
+### Persistence (KV, not module scope)
+
+The gateway injects its shared KV namespace as `_cacheKv` (`injectCacheKv` in
+`pack-manifest.json`), used for three things, each dated and each degrading
+cleanly to a live fetch if the binding is absent:
+
+1. A whole-board job-list cache, ~3h TTL — "poll each board no more than every
+   few hours."
+2. The `domain -> {ats, board_token}` discovery index `ats_detect` writes —
+   "the index grows with use."
+3. The job-key snapshot `ats_new_postings` diffs against.
+
+## Quick Start
+
+Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
+
+```json
+{
+  "mcpServers": {
+    "ats-boards": {
+      "url": "https://gateway.pipeworx.io/ats-boards/mcp"
+    }
+  }
+}
+```
+
+### What this endpoint actually serves
+
+`tools/list` at `https://gateway.pipeworx.io/ats-boards/mcp` returns the tools in the table
+above **plus the shared Pipeworx meta-tools** — `ask_pipeworx`,
+`discover_tools`, `search_within`, `remember`/`recall` and the rest of the
+gateway-wide set. So the tool count you see is larger than this table: a
+single-pack endpoint currently lists roughly 30 shared tools alongside the
+pack's own. The connection's `initialize` response states its exact scope, and
+is the authoritative answer for a given day.
+
+This is deliberate, not multiplexing by accident. The meta-tools are what let a
+scoped connection answer a question this pack does not cover — via
+`ask_pipeworx`, which routes across the whole catalog — without you adding a
+second MCP server. There is currently no way to mount a pack endpoint without
+them; if the extra schemas cost you more context than the routing is worth,
+connect to the full gateway once rather than to several pack endpoints.
+
+Or connect to the full Pipeworx gateway to get every pack's tools listed
+directly, instead of just this one's:
+
+```json
+{
+  "mcpServers": {
+    "pipeworx": {
+      "url": "https://gateway.pipeworx.io/mcp"
+    }
+  }
+}
+```
+
+Both URLs reach the same gateway and the same 1743+ data sources. The
+only difference is which pack's tools are listed **directly**; `ask_pipeworx`
+reaches all of them from either one.
+
+## No MCP client? Call it over HTTP
+
+```bash
+curl -X POST https://gateway.pipeworx.io/v1/tools/ats_detect \
+  -H 'Content-Type: application/json' \
+  -d '{"domain":"ramp.com"}'
+```
+
+No account needed for the first calls. Inspect any tool: `GET https://gateway.pipeworx.io/v1/tools/ats_detect`. Find one: `POST https://gateway.pipeworx.io/v1/tools/search_packs` with `{"query":"..."}`.
+
+## Standalone (no gateway account)
+
+This package also runs as a local stdio MCP server — no Pipeworx account, no
+gateway round-trip:
+
+```json
+{
+  "mcpServers": {
+    "ats-boards": {
+      "command": "npx",
+      "args": ["-y", "@pipeworx/mcp-ats-boards"]
+    }
+  }
+}
+```
+
+Or run it directly to confirm it starts:
+
+```bash
+npx -y @pipeworx/mcp-ats-boards
+```
+
+It speaks MCP over stdin/stdout and answers `initialize`/`tools/list`/`tools/call`
+for **only** this pack's tools — none of the shared meta-tools the gateway
+connection above adds. Same source, same tools, no ask_pipeworx routing.
+
+## Using with ask_pipeworx
+
+Instead of calling tools directly, you can ask questions in plain English —
+this works on the pack endpoint above as well as on the full gateway:
+
+```
+ask_pipeworx({ question: "your question about Ats Boards data" })
+```
+
+The gateway picks the right tool and fills the arguments automatically.
+
+## More
+
+- [Docs and guides](https://pipeworx.io/docs)
+- [pipeworx.io](https://pipeworx.io)
+
+## License
+
+MIT

package/bin/cli.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+//
+// Entry point for `npx @pipeworx/mcp-<slug>`.
+//
+// Packs ship as raw TypeScript (no build step — see publish-pack.sh for why:
+// tsx sidesteps every extensionless-import / bare-JSON-import edge case a
+// per-pack tsc build would have to solve one pack at a time). This file
+// registers tsx's ESM loader programmatically, then hands off to src/server.ts,
+// which wraps the pack's {tools, callTool} export in a stdio MCP server.
+//
+// Copied verbatim into every published pack repo by scripts/publish-pack.sh —
+// edit this file, not a per-pack copy.
+import { register } from 'tsx/esm/api';
+
+register();
+
+await import('../src/server.ts');

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@pipeworx/mcp-ats-boards",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "ATS Boards MCP — public job-board postings across eight applicant-tracking",
+  "type": "module",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "bin": {
+    "mcp-ats-boards": "bin/cli.js"
+  },
+  "keywords": ["mcp", "mcp-server", "model-context-protocol", "pipeworx", "ats-boards"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pipeworx-io/mcp-ats-boards.git"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "tsx": "^4.19.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "@cloudflare/workers-types": "^4.20260405.1"
+  },
+  "pipeworx": {
+    "sourceHash": "v1-f753dcc7176ff4918049ee31348dcc9e4cb1da941f9b35885d7aa9475bc1417c",
+    "sourceCommit": "e369dfedd93d5fcbf521281559a146302c14e1a0"
+  }
+}

package/server.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.pipeworx-io/ats-boards",
+  "title": "Ats Boards",
+  "description": "ATS Boards MCP — public job-board postings across eight applicant-tracking",
+  "version": "0.1.0",
+  "websiteUrl": "https://pipeworx.io/packs/ats-boards",
+  "repository": {
+    "url": "https://github.com/pipeworx-io/mcp-ats-boards",
+    "source": "github"
+  },
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://gateway.pipeworx.io/ats-boards/mcp"
+    }
+  ]
+}