MCP server

Maestro Career Studio

mcp:seinun-ai/maestro-career-studio

Tailor resumes, score them against job posts and track applications, all on your own machine.

awesome-mcp-servers Glama MCP Registry

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 29, 2026, 16:09 UTC at d0cd097

findings

—

highest severity

threat classes

2,087

files scanned

0/43,922

checks satisfied

package advisories

Why this verdict

mcp-server . Inconclusive

inconclusive: gap dynamic_metadata at backend/mcp_server/http.py
inconclusive: gap dynamic_metadata at backend/mcp_server/tests/test_http.py
inconclusive: gap glob_budget_exceeded at extension/panel/panel.js
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_applications_router.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_autofill_step.py
inconclusive: gap no_dataflow_for_dynamic_code at extension/content/fill-base.js
inconclusive: gap no_dataflow_for_dynamic_code at frontend/components/render-harness.mjs
inconclusive: gap no_dataflow_for_dynamic_code at scripts/update.sh
inconclusive: gap parse_error at frontend/lib/api.ts
inconclusive: gap pass_skipped
inconclusive: judge runs incomplete or invalid
inconclusive: ledger 0/14750 checks satisfied

mcp-server backend Inconclusive

inconclusive: gap dynamic_metadata at backend/mcp_server/http.py
inconclusive: gap dynamic_metadata at backend/mcp_server/tests/test_client_coach.py
inconclusive: gap dynamic_metadata at backend/mcp_server/tests/test_http.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/scripts/native/common.sh
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/browser/test_panel_preview.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/browser/test_spike_background_fill.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/maestro_cs/test_supervisor.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_applications_router.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_autofill_step.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_health_evaluation_migration.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_jobs_country_code_migration.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_llm_openai_compat.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_memory_budget.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_memory_profile.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_tailoring_prompt_resync.py
inconclusive: gap no_dataflow_for_dynamic_code at backend/tests/test_voice_prompt_resync.py
inconclusive: gap no_dataflow_for_dynamic_code at frontend/components/render-harness.mjs
inconclusive: gap no_dataflow_for_dynamic_code at scripts/update.sh
inconclusive: gap parse_error at frontend/lib/api.ts
inconclusive: gap pass_skipped
inconclusive: judge runs incomplete or invalid
inconclusive: ledger 0/29172 checks satisfied

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below.

Execution chain 161

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 48

_CS_BLANK

backend/tests/test_config.py:127 · write

_CS_REAL

backend/tests/test_config.py:129 · write

_CS_SPACES

backend/tests/test_config.py:128 · write

backend/mcp_server/tests/test_profiles.py:152 · passthrough

backend/scripts/db_copy.py:118 · write

ALLOWED_HOSTS

backend/tests/conftest.py:55 · read

API_PROXY_BACKEND

frontend/app/api/[...path]/route.ts:13 · read

BACKEND_URL

frontend/app/api/[...path]/route.ts:14 · read

BASE_RESUMES_DIR

backend/scripts/template_parity.py:777 · read

BASH

backend/scripts/native/common.sh:68 · read

backend/tests/browser/conftest.py:36 · read

CLAUDECODE

scripts/setup-mcp.sh:212 · read

COMPOSE_PROJECT_NAME

scripts/update.sh:226 · read

data_dir

backend/tests/maestro_cs/test_home.py:280 · read

DATA_DIR

backend/scripts/db_copy.py:37 · read

database_url

backend/tests/maestro_cs/test_home.py:280 · read

DATABASE_URL

backend/scripts/db_copy.py:112 · write

FASTEMBED_CACHE_PATH

backend/tests/ats/test_embeddings_out_of_process.py:337 · read

HTTPS_PROXY

backend/tests/test_http_client.py:109 · read

INTERNAL_API_URL

frontend/lib/api.ts:69 · read

KEEP_ME

backend/tests/maestro_cs/test_home.py:267 · read

LOGS_DIR

backend/scripts/health_golden.py:100 · read

MAESTRO_CS_EXTENSION_IDS

backend/tests/conftest.py:61 · read

MAESTRO_HOME

backend/scripts/native/setup.sh:11 · read

MAESTRO_INSTALL

backend/tests/maestro_cs/test_home.py:266 · read

MAESTRO_PORT

backend/scripts/native/start.sh:59 · read

MAESTRO_SKIP_SLOW

backend/tests/ats/test_embeddings_out_of_process.py:332 · read

MAESTRO_TEST_DB_MINTED

backend/tests/conftest.py:19 · read

MAESTRO_WEB_PORT

scripts/smoke_uv_install.py:210 · read

MARKER

backend/tests/maestro_cs/test_connect.py:505 · read

NATIVE_BACKEND

backend/scripts/native/setup.sh:25 · read

NATIVE_LAUNCHER

backend/scripts/native/start.sh:58 · read

NATIVE_PYTHON

backend/scripts/native/setup.sh:18 · read

NEXT_PUBLIC_API_DIRECT

frontend/lib/api.ts:59 · read

NEXT_PUBLIC_API_URL

frontend/lib/api.ts:62 · read

NEXT_PUBLIC_APP_VERSION

frontend/lib/version.ts:1 · read

no_proxy

backend/tests/test_http_client.py:151 · read

NO_PROXY

backend/tests/test_http_client.py:108 · read

NODE_ENV

frontend/app/error.tsx:39 · read

OPENAI_API_KEY

backend/tests/maestro_cs/test_connect.py:487 · read

PATH

backend/tests/maestro_cs/test_bridge.py:393 · read

PYTEST_XDIST_WORKER

backend/tests/conftest.py:18 · read

PYTHON

backend/scripts/native/setup.sh:12 · read

SETTINGS_DIR

backend/tests/test_eval_fill_cases.py:657 · read

STALE_FROM_SHELL

backend/tests/maestro_cs/test_home.py:268 · read

SYNC_KEY_FILE

backend/scripts/native/sync.sh:48 · read

SYSTEMROOT

backend/tests/maestro_cs/test_bridge.py:394 · read

TEST_DATABASE_URL

backend/scripts/apply_template_sources.py:100 · read

Commands run 50

__import__("copy")

backend/tests/test_applications_router.py:784 · dynamic_code

__import__("httpx")

backend/tests/test_llm_openai_compat.py:258 · dynamic_code

__import__("re")

backend/tests/test_autofill_step.py:566 · dynamic_code

__import__(f"migrations.versions.{REVISION}_jobs_country_code")

backend/tests/test_jobs_country_code_migration.py:82 · dynamic_code

--bogus

backend/tests/test_native_scripts.py:1426 · via:run_sync

--db

backend/tests/test_eval_reason.py:173 · via:_script

--now

backend/tests/test_native_scripts.py:1137 · via:run_sync

--pair

backend/tests/test_native_pairing.py:67 · via:run_with

--version

scripts/smoke_uv_install.py:287 · via:maestro

"$1/health.sh" >/dev/null 2>&1 || "$1/start.sh" --watchdog

backend/tests/test_native_scripts.py:885 · via:run_native

"$1/health.sh" >/dev/null 2>&1 || "$1/start.sh" --watchdog; "$1/health.sh" >/dev/null 2>&1 || "$1/start.sh" --watchdog

backend/tests/test_native_scripts.py:1032 · via:run_native

[[ "$NATIVE_PID_ARGS" == "$home/venv/bin/python -m uvicorn app.main:app"* || "$NATIVE_PID_ARGS" == "$home/venv/bin/python -c $NATIVE_LAUNCHER app.main:app"* ]]

backend/scripts/native/common.sh:135 · dynamic_code

backend/mcp_server/tests/test_http.py:35 · via:run

app/automations/page.tsx

frontend/components/automations/automations-page.test.mjs:8 · via:load

app/today/page.tsx

frontend/components/today/today-page.test.mjs:13 · via:load

backup

scripts/smoke_uv_install.py:436 · via:maestro

bash -c {…} watchdog {…}

backend/tests/test_native_scripts.py:760 · process

bash -c exec -a "$0" sleep 60 {…}

backend/tests/test_native_scripts.py:909 · command

bash -c source "$1"; native_free_port native-port-probe {…}

backend/tests/test_native_scripts.py:576 · command

bash -c source "$1"; native_load_env; "$2" -c 'from native_test_support import record; record("load_env")' probe {…} {…}

backend/tests/test_native_scripts.py:425 · command

bash -c source "$1"; native_load_env; printf %s "${SYNC_KEY_FILE-unset}" probe {…}

backend/tests/test_native_scripts.py:1430 · process

bash -c source "$1"; native_read_pid native-pid-probe {…}

backend/tests/test_native_scripts.py:528 · command

bash -c source "$1/common.sh" && printf %s "$NATIVE_LAUNCHER" x {…}

backend/tests/test_native_scripts.py:901 · process

bash -n {…}

backend/tests/test_native_scripts.py:367 · process

bash {…}

backend/tests/test_native_scripts.py:206 · process

bash {…} --bogus

backend/tests/test_native_scripts.py:791 · process

bash {…} --no-pause

backend/tests/test_native_scripts.py:800 · process

bash {…} --pair --code {…}

backend/tests/sync/test_pairing_process.py:55 · process

bash {…} --unpause

backend/tests/test_native_scripts.py:963 · process

bash {…} --unpause --watchdog

backend/tests/test_native_scripts.py:1001 · process

bash {…} --watchdog

backend/tests/test_native_scripts.py:815 · process

bash {…} {…}

backend/tests/test_native_pairing.py:59 · process

bogus

backend/tests/test_native_scripts.py:1559 · via:run_key_cli

check

backend/tests/maestro_cs/test_maintenance.py:484 · via:run_cli

components/automations/automations-page.test.mjs

backend/tests/test_frontend_automations.py:205 · via:run_node_test

components/automations/recent-runs.tsx

frontend/components/inbox-simplify.test.mjs:9 · via:load

components/charts/heatmap-chart.test.mjs

backend/tests/test_frontend_jobs_honest_analytics.py:70 · via:run_node_test

components/charts/heatmap-chart.tsx

frontend/components/charts/heatmap-chart.test.mjs:8 · via:load

components/inbox-simplify.test.mjs

backend/tests/test_frontend_job_page_simplify.py:251 · via:run_node_test

components/job-knockout-card.tsx

frontend/components/inbox-simplify.test.mjs:10 · via:load

components/job-ownership.test.mjs

backend/tests/sync/test_frontend_ownership.py:43 · via:run_node_test

components/job-ownership.tsx

frontend/components/job-ownership.test.mjs:6 · via:load

components/profile/profile-view.test.mjs

backend/tests/test_frontend_profile_tiles.py:243 · via:run_node_test

components/profile/profile-view.tsx

frontend/components/profile/profile-view.test.mjs:8 · via:load

components/profile/use-autofill-query.test.mjs

backend/tests/test_frontend_profile_tiles.py:145 · via:run_node_test

components/profile/use-autofill-query.ts

frontend/components/profile/use-autofill-query.test.mjs:15 · via:load

components/proposals/cap-today.tsx

frontend/components/inbox-simplify.test.mjs:7 · via:load

components/proposals/inbox-counts.tsx

frontend/components/inbox-simplify.test.mjs:6 · via:load

components/proposals/inbox-run-notice.tsx

frontend/components/inbox-simplify.test.mjs:8 · via:load

Signature

backend/tests/test_extension_consent_forms.py:156 · via:_policy_verdicts

Files read 50

--print-only: skipping Claude Code registration and .mcp.json

scripts/setup-mcp.sh:175 · sensitive

.env

backend/tests/maestro_cs/test_home.py:301 · literal

.env keys match .env.example

scripts/update.sh:109 · sensitive

.env.example

backend/tests/test_settings_paths_in_words.py:51 · literal

.env.production

backend/tests/test_wheel_scripts.py:194 · literal

.github/workflows/ci.yml

backend/tests/test_frontend_job_page_simplify.py:295 · literal

.mcp.json

scripts/setup-mcp.sh:294 · sensitive

/etc/passwd

backend/tests/sync/test_profile_bundle.py:773 · literal

backend/mcp_server/tests/test_client_filled_answers.py:41 · read

$REPO/.env

scripts/setup-mcp.sh:67 · sensitive

$REPO/.env.example

scripts/update.sh:95 · sensitive

$REPO/.mcp.json

scripts/setup-mcp.sh:177 · sensitive

Accept all cookies

backend/tests/test_extension_page_kind.py:532 · literal

acme_phone_country.html

backend/tests/browser/test_adaptive_step.py:634 · via:fixture_html

acme_role_detail.html

backend/tests/browser/test_posting_read.py:367 · via:fixture_html

acme_upload_swap.html

backend/tests/browser/test_attach.py:446 · via:fixture_html

address_autocomplete.html

backend/tests/browser/test_live2_address.py:27 · via:fixture_html

adversarial_recipe_poison.html

backend/tests/browser/test_fixture_fidelity.py:527 · via:fixture_html

adversarial_revert.html

backend/tests/browser/test_fill_core_fields.py:246 · via:fixture_html

adversarial_same_text.html

backend/tests/browser/test_adaptive_step.py:132 · via:fixture_html

adversarial_search_headers.html

backend/tests/browser/test_adversarial.py:171 · via:fixture_html

adversarial_trusted_only.html

backend/tests/browser/test_fixture_fidelity.py:569 · via:fixture_html

adversarial_virtual_same_text.html

backend/tests/browser/test_adversarial.py:55 · via:fixture_html

antd_readonly_select.html

backend/tests/browser/test_live2_widgets.py:13 · via:fixture_html

app/.env

backend/tests/test_wheel_scripts.py:175 · literal

app/analytics/page.tsx

backend/tests/test_frontend_analytics_page.py:124 · via:_read

app/api/[...path]/route.ts

backend/tests/test_frontend_error_words.py:171 · via:_read

app/applications/job-bulk.tsx

backend/tests/test_frontend_agent_inbox.py:430 · via:_read

app/applications/page.tsx

backend/tests/test_frontend_agent_inbox.py:28 · via:_read

app/applications/use-tracker-filters.ts

backend/tests/test_frontend_jobs_page_words.py:99 · via:_read

app/automations/page.tsx

backend/tests/test_frontend_agent_dashboard.py:25 · via:_read

app/base-resumes/page.tsx

backend/tests/test_frontend_dialog_drafts.py:47 · via:_read

app/career/page.tsx

backend/tests/test_frontend_design_tokens.py:657 · via:_read

app/error.tsx

backend/tests/test_frontend_settings_assistant_words.py:501 · via:_read

app/global-error.tsx

backend/tests/test_frontend_leave_guard.py:105 · via:_read

app/globals.css

backend/tests/test_frontend_agent_inbox.py:200 · via:_read

app/jobs/[id]/page.tsx

backend/tests/test_frontend_agent_inbox.py:25 · via:_read

app/jobs/[id]/tailor/[sessionId]/page.tsx

backend/tests/sync/test_frontend_ownership.py:64 · via:_source

app/layout.tsx

backend/tests/test_frontend_sticky_lists.py:52 · via:_read

app/new/page.tsx

backend/tests/test_frontend_first_run.py:132 · via:_read

app/page.tsx

backend/tests/test_frontend_today.py:25 · via:_read

app/profile/page.tsx

backend/tests/test_frontend_profile_tiles.py:58 · via:_src

app/proposals/page.tsx

backend/tests/test_frontend_agent_dashboard.py:20 · via:_read

app/providers.tsx

backend/tests/test_frontend_leave_guard.py:111 · via:_read

app/referrals/page.tsx

backend/tests/test_frontend_color_roles.py:704 · via:_read

app/routers/career_kb.py

backend/tests/test_frontend_sticky_lists.py:470 · via:_backend_fn

app/routers/jobs.py

backend/tests/test_frontend_sticky_lists.py:386 · via:_backend_fn

app/settings/page.tsx

backend/tests/test_frontend_one_filled_button.py:216 · via:_read

app/templates/[id]/page.tsx

backend/tests/test_frontend_color_roles.py:311 · via:_read

The .mcp.json above covers sessions opened in this repo. To reach the

scripts/setup-mcp.sh:217 · sensitive

Files written 13

scripts/setup-mcp.sh:296 · write

)

scripts/setup-mcp.sh:130 · write

backend/mcp_server/tests/test_client_frugality.py:375 · write

$dump

scripts/update.sh:291 · write

$envbak

scripts/update.sh:377 · write

$log

backend/scripts/native/start.sh:55 · write

$MAESTRO_HOME/backend.pid

backend/scripts/native/start.sh:63 · write

$marker

backend/scripts/native/common.sh:199 · write

backend/scripts/native/common.sh:85 · write

backend/scripts/native/common.sh:96 · write

backend/scripts/native/setup.sh:25 · write

2>/dev/null

backend/scripts/native/common.sh:39 · write

backend/scripts/native/common.sh:270 · write

Coverage gaps 36

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

docs/assets/brand/icons/favicon.ico

glob_budget_exceeded reference source exceeds 262144 characters

extension/panel/panel.js

parse_error tree-sitter typescript parse has errors; extraction may be partial

frontend/lib/api.ts

dynamic_metadata line 116: prompt (computed name) name depends on unsupported construct (unsupported): 'list_prompts' has no call site in the artifact: async def list_prompts(self) -> list[Prompt]: return [ Prompt(name=c["id"], title=c.get("title"), description=c.get("su…

backend/mcp_server/http.py

dynamic_metadata line 116: prompt (computed name) title depends on unsupported construct (unsupported): 'list_prompts' has no call site in the artifact: async def list_prompts(self) -> list[Prompt]: return [ Prompt(name=c["id"], title=c.get("title"), description=c.get("su…

backend/mcp_server/http.py

dynamic_metadata line 116: prompt (computed name) description depends on unsupported construct (unsupported): 'list_prompts' has no call site in the artifact: async def list_prompts(self) -> list[Prompt]: return [ Prompt(name=c["id"], title=c.get("title"), description=c.get("su…

backend/mcp_server/http.py

dynamic_metadata line 191: tool (computed name) registration depends on unsupported construct (unsupported): server object plain handed to mcp_http.McpEndpoint(): tools may be registered out of sight

backend/mcp_server/tests/test_http.py

dynamic_metadata line 290: tool (computed name) registration depends on unsupported construct (unsupported): server object scratch handed to mcp_http.offload_tools(): tools may be registered out of sight

backend/mcp_server/tests/test_http.py

dynamic_metadata line 292: tool (computed name) registration depends on unsupported construct (unsupported): server object scratch handed to mcp_http.offload_tools(): tools may be registered out of sight

backend/mcp_server/tests/test_http.py

no_dataflow_for_dynamic_code line 829: invoked code is not structurally extracted

backend/tests/test_applications_router.py

no_dataflow_for_dynamic_code line 1127: invoked code is not structurally extracted

backend/tests/test_applications_router.py

no_dataflow_for_dynamic_code line 1172: invoked code is not structurally extracted

backend/tests/test_applications_router.py

no_dataflow_for_dynamic_code line 1215: invoked code is not structurally extracted

backend/tests/test_applications_router.py

no_dataflow_for_dynamic_code line 566: invoked code is not structurally extracted

backend/tests/test_autofill_step.py

no_dataflow_for_dynamic_code line 567: invoked code is not structurally extracted

backend/tests/test_autofill_step.py

no_dataflow_for_dynamic_code line 119: invoked code is not structurally extracted

extension/content/fill-base.js

no_dataflow_for_dynamic_code line 32: invoked code is not structurally extracted

frontend/components/render-harness.mjs

no_dataflow_for_dynamic_code line 78: invoked code is not structurally extracted

scripts/update.sh

no_dataflow_for_dynamic_code line 135: invoked code is not structurally extracted

scripts/update.sh

pass_skipped 386 passes skipped (judge 379, vision 7): pass budget: 602 more passes after 0 would exceed the cap of 100

dynamic_metadata line 32: tool (computed name) registration depends on unsupported construct (unsupported): module object is handed to other code

backend/mcp_server/tests/test_client_coach.py

dynamic_metadata line 339: tool (computed name) name depends on unsupported construct (unsupported): '_scratch_answer' has no call site in the artifact: def _scratch_answer(raised: Exception, name: str = "refused") -> dict: """What an agent reads when a scratch tool raise…

backend/mcp_server/tests/test_http.py

no_dataflow_for_dynamic_code line 30: invoked code is not structurally extracted

backend/tests/browser/test_panel_preview.py

no_dataflow_for_dynamic_code line 20: invoked code is not structurally extracted

backend/tests/browser/test_spike_background_fill.py

no_dataflow_for_dynamic_code line 88: invoked code is not structurally extracted

backend/tests/maestro_cs/test_supervisor.py

no_dataflow_for_dynamic_code line 55: invoked code is not structurally extracted

backend/tests/test_health_evaluation_migration.py

no_dataflow_for_dynamic_code line 82: invoked code is not structurally extracted

backend/tests/test_jobs_country_code_migration.py

no_dataflow_for_dynamic_code line 91: invoked code is not structurally extracted

backend/tests/test_jobs_country_code_migration.py

no_dataflow_for_dynamic_code line 258: invoked code is not structurally extracted

backend/tests/test_llm_openai_compat.py

no_dataflow_for_dynamic_code line 259: invoked code is not structurally extracted

backend/tests/test_llm_openai_compat.py

no_dataflow_for_dynamic_code line 38: invoked code is not structurally extracted

backend/tests/test_memory_budget.py

no_dataflow_for_dynamic_code line 28: invoked code is not structurally extracted

backend/tests/test_memory_profile.py

no_dataflow_for_dynamic_code line 26: invoked code is not structurally extracted

backend/tests/test_tailoring_prompt_resync.py

no_dataflow_for_dynamic_code line 30: invoked code is not structurally extracted

backend/tests/test_voice_prompt_resync.py

no_dataflow_for_dynamic_code line 135: invoked code is not structurally extracted

backend/scripts/native/common.sh

pass_skipped 401 passes skipped (judge 397, vision 4): pass budget: 602 more passes after 0 would exceed the cap of 100