Skip to content

v0.1.3 — production-readiness hardening (standalone desktop)

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Jul 01:26
· 29 commits to main since this release
v0.1.3
4d5bf0c

Job Application MCP v0.1.3

This is alpha software. Free community core only — Pro/hosted services are not yet enabled.

Production-readiness hardening (Cycle 2 audit)

  • Standalone desktop app. The Windows installer, macOS DMG, and Linux
    AppImage no longer require Node.js on your PATH. The HTTP bridge is bundled
    into a single self-contained file and run on Electron's own Node runtime.
  • Prompt-injection hardening. AI prompts treat job/CV content as
    untrusted (wrapped in <untrusted> delimiters); a malicious job
    description can no longer inject instructions.
  • Claude cost controls. AI calls measure usage/cost, enforce a monthly
    spend cap (JOB_MCP_AI_MONTHLY_LIMIT_USD, default $20), retry with backoff,
    rate-limit, and gracefully fall back to the local heuristic draft on
    failure — no debit, workflow continues.
  • Approval-gated submission recording. A submission can only be recorded
    (never performed) after a full validation gate and a short-lived single-use
    approval token. New tools request_approval and confirm_submission.
  • Local backup/restore (backup_data / list_backups / restore_data).
  • Entitlement-activity log; local data preserved across upgrade/downgrade/expiry.
  • Form-field classification is now a pure, tested module shared by the
    autofill tool and the extension.
  • Schema v3 (additive). Tool count 23 → 28. Test suite 40 → 72 (all green).

Downloads

  • Windows installer — Job.Application.MCP.Setup.0.1.3.exe (standalone; no Node.js install required)
  • macOS — Job.Application.MCP-0.1.3-arm64.dmg (standalone)
  • Linux — Job.Application.MCP-0.1.3.AppImage (standalone)
  • Chrome extension — job-application-mcp-extension.zip (load unpacked in chrome://extensions)
  • Core build — job-application-mcp-core-dist.zip (for stdio MCP clients)

Standalone desktop app. The installer bundles the HTTP bridge (a single
self-contained file) and runs it on Electron's own Node runtime — no system
Node.js is required. It only reads local data; submission stays manual.

See the README for setup.
See CHANGELOG.md for the full changelog.

Assets 10
Loading