@pipeworx/mcp-ats-boards 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mojibake Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,210 @@
-# Temporary Holding Version
+# @pipeworx/ats-boards
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Public job-board postings across fifteen applicant-tracking systems
+(Greenhouse, Lever, Ashby, SmartRecruiters, Recruitee, BambooHR, Workday,
+Workable, Teamtailor, Personio, Jobvite, Breezy, Pinpoint, Rippling, iCIMS) —
+detect which ATS a company publishes its careers page on, then read any
+company's open roles without a key. This is NOT the `greenhouse`/`ashby`
+packs, which read the caller's OWN private hiring data with their own API
+key; this pack reads the same public board any browser can see, for any
+company.
+
+Part of [Pipeworx](https://pipeworx.io) — an MCP gateway connecting AI agents to 1807+ live data sources. This is an independent, unofficial integration — not affiliated with, endorsed by, or published by the upstream provider.
+
+Dover was evaluated and dropped: its public board is a client-rendered SPA
+behind a Cloudflare Turnstile challenge, and the underlying jobs API
+(`app.dover.com/api/v1/jobs`) answers HTTP 401 "Authentication credentials
+were not provided" for every query-param combination tried — there is no
+discoverable keyless endpoint.
+
+## Tools
+
+- `ats_detect(domain | careers_url)` — find which ATS a company uses and its
+  board token, by scraping the careers page for an ATS link and, failing that,
+  slug-probing the domain name against each board API. Persists the discovery
+  so a repeat lookup for the same domain is instant.
+- `ats_jobs(ats, board_token, filters?)` — normalized job postings for a board
+  you already have `ats` + `board_token` for. Distinguishes an unknown board
+  (`found:false, reason:"board_not_found"`) from a real board with zero
+  current postings (`found:true, jobs:[]`) for every ATS except
+  SmartRecruiters, which cannot tell them apart (see below) — that case is
+  marked `ambiguous:true` instead of guessing.
+- `ats_company_jobs(domain, filters?)` — `ats_detect` + `ats_jobs` in one call.
+- `ats_new_postings(ats, board_token, since?)` — diffs current postings
+  against the last snapshot taken for that board. The first call for a board
+  has no prior snapshot, so it returns every current posting as new
+  (`snapshot_bootstrap:true`) instead of a misleadingly empty diff.
+
+## Auth
+
+Keyless. Every endpoint below is the same public board data a browser sees on
+a company's own careers page — no account, token or registration on any of
+the fifteen supported ATS vendors.
+
+The one exception is Workable: its public widget is currently blocked by
+Cloudflare from this platform's edge (see "Data sources" below) — not an auth
+wall, a transport failure. `ats_jobs`/`ats_company_jobs` throw a loud error
+naming the HTTP 429 and Cloudflare's block when asked for `ats:"workable"`,
+rather than returning an empty result.
+
+## Data sources
+
+- `https://boards-api.greenhouse.io/v1/boards/{board_token}/jobs?content=true` — Greenhouse's public board API.
+- `https://api.lever.co/v0/postings/{board_token}?mode=json` (`https://api.eu.lever.co/...` for `filters.region:"eu"`) — Lever's public postings API.
+- `https://api.ashbyhq.com/posting-api/job-board/{board_token}?includeCompensation=true` — Ashby's public job-board API (officially documented, includes comp bands where the employer publishes them).
+- `https://api.smartrecruiters.com/v1/companies/{board_token}/postings` — SmartRecruiters' public postings API.
+- `https://{board_token}.recruitee.com/api/offers/` — Recruitee's public offers API.
+- `https://{board_token}.bamboohr.com/careers/list` — BambooHR's public careers-widget endpoint.
+- `https://{tenant}.wd{N}.myworkdayjobs.com/wday/cxs/{tenant}/{site}/jobs` (POST) — Workday's public CXS jobs search. `board_token` encodes all three path parts as `"{tenant}.wd{N}/{site}"`, e.g. `"workday.wd5/Workday"` (read the tenant/wd-number/site straight off the company's own `myworkdayjobs.com` careers URL).
+- `https://apply.workable.com/api/v1/widget/accounts/{board_token}` — Workable's public widget API. **Currently unreachable from this platform's edge**, confirmed live via a throwaway `wrangler dev --remote` Worker on Pipeworx's production Cloudflare account: every one of 5+ attempts (two endpoint shapes — the v1 widget and the v3 `/api/v3/accounts/{account}/jobs`, with and without an `Accept` header, against several real account names, several minutes apart) returned HTTP 429 with `Content-Type: text/plain` and body `error code: 1015` — Cloudflare's OWN bot-mitigation, not a Workable application response. That reads as apply.workable.com's Cloudflare WAF specifically rate-limiting Cloudflare-Worker-to-Cloudflare traffic. The adapter is implemented per Workable's documented widget shape and is ready the moment this changes; until then every live call throws loud, naming the 429, rather than returning an empty board.
+- `https://{board_token}.teamtailor.com/jobs.json` — Teamtailor's keyless JSON Feed (jsonfeed.org v1.1).
+- `https://{board_token}.jobs.personio.com/xml?language=en`, falling back to `.jobs.personio.de` on a 404 — Personio's public XML feed. A company lives on exactly one of the two TLDs with no redirect between them.
+- `https://jobs.jobvite.com/{board_token}` — Jobvite's server-rendered HTML board (no JSON API; the vendor's own feed is per-customer and off by default). Parsed by regex from the `jv-job-list-*` table markup.
+- `https://{board_token}.breezy.hr/json` — Breezy's keyless JSON array.
+- `https://{board_token}.pinpointhq.com/postings.json` — Pinpoint's keyless, officially documented postings JSON.
+- `https://ats.rippling.com/{board_token}/jobs` — Rippling has no separate JSON API (every guessed `/api/...` path 404s); the job list is parsed out of the page's `<script id="__NEXT_DATA__">` hydration data.
+- `https://{board_token}.icims.com/jobs/search?ss=1&in_iframe=1` — iCIMS's documented Talent-Cloud API is partner-gated, but the public career-search page itself is plain server-rendered HTML with no login; parsed by regex. `board_token` is the FULL subdomain label (e.g. `"careers-acme"`) — iCIMS customers don't share one fixed prefix.
+
+### The silent-zero shape, per ATS (each measured live, not assumed from docs)
+
+Each ATS answers "no such board" differently, and three don't distinguish it
+from "real board, zero jobs right now" at all:
+
+| ATS | Unknown board | Real board, zero jobs |
+|---|---|---|
+| Greenhouse | HTTP 404 JSON `{"status":404,"error":"Job not found"}` | HTTP 200 `{"jobs":[]}` |
+| Lever | HTTP 404 JSON `{"ok":false,"error":"Document not found"}` | HTTP 200 `[]` (confirmed live: `api.lever.co/v0/postings/lever`) |
+| Ashby | HTTP 404, **plain text** `"Not Found"` (not JSON) | HTTP 200 JSON `{"jobs":[],"apiVersion":"1"}` (confirmed live: `vercel`, `deel`, `mercury`) |
+| SmartRecruiters | **Same shape as "zero jobs" — cannot tell them apart.** Both return HTTP 200 `{"totalFound":0,"content":[]}` | Same as unknown; this pack marks `ambiguous:true` rather than guessing |
+| Recruitee | HTTP 404 JSON `{"error":"Not Found"}` | Not independently confirmed live (not found within this build's time budget); expected HTTP 200 `{"offers":[]}` by analogy with every sibling ATS's 200-success-empty-array convention |
+| BambooHR | HTTP 200 (not 404!), `Content-Type: text/html` — BambooHR's own marketing homepage, byte-identical across different nonsense subdomains (a wildcard catch-all, not a per-company 404) | HTTP 200 JSON `{"meta":{"totalCount":0},"result":[]}` (confirmed live: `helpscout`, `pantheon`) |
+| Workday | HTTP 404 JSON `{"errorCode":"S21",...,"message":"not found: Job_Posting_Site_ID=..."}` | Not independently confirmed (every real tenant found had jobs); `limit` over 20 is HTTP 400, not an empty page; `offset` past 10,000 returns HTTP 200 with the SAME page as `offset:0` rather than erroring — this pack reports `capped:true` when either cap is hit |
+| Workable | Blocked (HTTP 429, Cloudflare) before any board-shaped answer is reachable from this platform | — |
+| Teamtailor | HTTP 404, `Content-Type: application/json`, body EMPTY (0 bytes) | HTTP 200 JSON Feed `{"items":[...]}` (confirmed live: `career`, `arsenalfc`) |
+| Personio | HTTP 404 `text/html` on BOTH `.com` and `.de` | HTTP 200 XML `<workzag-jobs>` (confirmed live: `kertos` on `.de`, `1nce` on `.com`) |
+| Jobvite | HTTP 200 but 4 silent redirects to a DIFFERENT host (`www.jobvite.com/support/...?invalid=1`) — `fetch`'s default `redirect:'follow'` hides this unless you check `res.redirected` | HTTP 200, no redirect, server-rendered job table (confirmed live: `bagleybagelbites`, 65 rows) |
+| Breezy | HTTP 404, `Content-Type: text/html`, title "Career portal not found" | HTTP 200 JSON array (confirmed live: `breezy`, `duolingo`) |
+| Pinpoint | HTTP 404, `Content-Type: text/html` (Pinpoint's own 404 page) | Not independently confirmed (every real board found had postings); expected HTTP 200 `{"data":[]}` by the same convention |
+| Rippling | HTTP 404, Next.js's own 404 page, no `__NEXT_DATA__` job-posts query | HTTP 200 with a `job-posts` query present but `items:[]` — not independently confirmed (every real board found had postings) |
+| iCIMS | HTTP 404, title `"gone: {subdomain}.icims.com : dc409"` | Not independently confirmed (every real portal found had postings) |
+
+Treating any non-200 as "zero jobs," or SmartRecruiters' `totalFound:0` as a
+confirmed empty board, is the exact silent-zero failure this pack exists to
+avoid — see the header comment in `src/index.ts` for the full edge-probe
+evidence (status/length/first-400-bytes) behind every row above.
+
+### Persistence (KV, not module scope)
+
+The gateway injects its shared KV namespace as `_cacheKv` (`injectCacheKv` in
+`pack-manifest.json`), used for three things, each dated and each degrading
+cleanly to a live fetch if the binding is absent:
+
+1. A whole-board job-list cache, ~3h TTL — "poll each board no more than every
+   few hours."
+2. The `domain -> {ats, board_token}` discovery index `ats_detect` writes —
+   "the index grows with use."
+3. The job-key snapshot `ats_new_postings` diffs against.
+
+## Quick Start
+
+Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
+
+```json
+{
+  "mcpServers": {
+    "ats-boards": {
+      "url": "https://gateway.pipeworx.io/ats-boards/mcp"
+    }
+  }
+}
+```
+
+### What this endpoint actually serves
+
+`tools/list` at `https://gateway.pipeworx.io/ats-boards/mcp` returns the tools in the table
+above **plus the shared Pipeworx meta-tools** — `ask_pipeworx`,
+`discover_tools`, `search_within`, `remember`/`recall` and the rest of the
+gateway-wide set. So the tool count you see is larger than this table: a
+single-pack endpoint currently lists roughly 30 shared tools alongside the
+pack's own. The connection's `initialize` response states its exact scope, and
+is the authoritative answer for a given day.
+
+This is deliberate, not multiplexing by accident. The meta-tools are what let a
+scoped connection answer a question this pack does not cover — via
+`ask_pipeworx`, which routes across the whole catalog — without you adding a
+second MCP server. There is currently no way to mount a pack endpoint without
+them; if the extra schemas cost you more context than the routing is worth,
+connect to the full gateway once rather than to several pack endpoints.
+
+Or connect to the full Pipeworx gateway to get every pack's tools listed
+directly, instead of just this one's:
+
+```json
+{
+  "mcpServers": {
+    "pipeworx": {
+      "url": "https://gateway.pipeworx.io/mcp"
+    }
+  }
+}
+```
+
+Both URLs reach the same gateway and the same 1807+ data sources. The
+only difference is which pack's tools are listed **directly**; `ask_pipeworx`
+reaches all of them from either one.
+
+## No MCP client? Call it over HTTP
+
+```bash
+curl -X POST https://gateway.pipeworx.io/v1/tools/ats_detect \
+  -H 'Content-Type: application/json' \
+  -d '{"domain":"ramp.com"}'
+```
+
+No account needed for the first calls. Inspect any tool: `GET https://gateway.pipeworx.io/v1/tools/ats_detect`. Find one: `POST https://gateway.pipeworx.io/v1/tools/search_packs` with `{"query":"..."}`.
+
+## Standalone (no gateway account)
+
+This package also runs as a local stdio MCP server — no Pipeworx account, no
+gateway round-trip:
+
+```json
+{
+  "mcpServers": {
+    "ats-boards": {
+      "command": "npx",
+      "args": ["-y", "@pipeworx/mcp-ats-boards"]
+    }
+  }
+}
+```
+
+Or run it directly to confirm it starts:
+
+```bash
+npx -y @pipeworx/mcp-ats-boards
+```
+
+It speaks MCP over stdin/stdout and answers `initialize`/`tools/list`/`tools/call`
+for **only** this pack's tools — none of the shared meta-tools the gateway
+connection above adds. Same source, same tools, no ask_pipeworx routing.
+
+## Using with ask_pipeworx
+
+Instead of calling tools directly, you can ask questions in plain English —
+this works on the pack endpoint above as well as on the full gateway:
+
+```
+ask_pipeworx({ question: "your question about Ats Boards data" })
+```
+
+The gateway picks the right tool and fills the arguments automatically.
+
+## More
+
+- [Docs and guides](https://pipeworx.io/docs)
+- [pipeworx.io](https://pipeworx.io)
+
+## License
+
+MIT

package/bin/cli.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+//
+// Entry point for `npx @pipeworx/mcp-<slug>`.
+//
+// Packs ship as raw TypeScript (no build step — see publish-pack.sh for why:
+// tsx sidesteps every extensionless-import / bare-JSON-import edge case a
+// per-pack tsc build would have to solve one pack at a time). This file
+// registers tsx's ESM loader programmatically, then hands off to src/server.ts,
+// which wraps the pack's {tools, callTool} export in a stdio MCP server.
+//
+// Copied verbatim into every published pack repo by scripts/publish-pack.sh —
+// edit this file, not a per-pack copy.
+import { register } from 'tsx/esm/api';
+
+register();
+
+await import('../src/server.ts');

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@pipeworx/mcp-ats-boards",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "ATS Boards MCP — public job-board postings across eight applicant-tracking systems (keyless).",
+  "type": "module",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "bin": {
+    "mcp-ats-boards": "bin/cli.js"
+  },
+  "keywords": ["mcp", "mcp-server", "model-context-protocol", "pipeworx", "ats-boards"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pipeworx-io/mcp-ats-boards.git"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "tsx": "^4.19.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "@cloudflare/workers-types": "^4.20260405.1"
+  },
+  "pipeworx": {
+    "sourceHash": "v1-9e7d256f25a7cd59758e98b7272d9697ce44231a57bd7488b6dea1142ee97a44",
+    "sourceCommit": "8dbe088fb6f9d2c88f934173742329b4e20a67d6"
+  }
+}

package/server.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.pipeworx-io/ats-boards",
+  "title": "Ats Boards",
+  "description": "ATS Boards MCP — public job-board postings across eight applicant-tracking systems (keyless).",
+  "version": "0.1.1",
+  "websiteUrl": "https://pipeworx.io/packs/ats-boards",
+  "repository": {
+    "url": "https://github.com/pipeworx-io/mcp-ats-boards",
+    "source": "github"
+  },
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://gateway.pipeworx.io/ats-boards/mcp"
+    }
+  ]
+}