Naitei — an agent-native job-search operating system

Naitei turns a fragmented job search into one evidence-preserving workflow. A responsive board gives the job seeker a clear view of applications and next actions; an OAuth-protected Model Context Protocol server lets AI agents file updates, retain source material, research companies, produce stage-specific interview prep, and run grounded practice drills.

The production system deliberately keeps the board as the durable memory and the connected agent as the intelligence. That separation makes every stored fact inspectable, keeps model choice outside the application, and lets the workflow improve without migrating opaque AI state.

This repository is a sanitized, buildable snapshot of the system's MCP and data foundation. It contains no deployed hostname, Cloudflare account ID, D1/KV resource ID, OAuth key, database contents, or production route. The checked-in Wrangler identifiers are visibly inert placeholders. The production board and later workflow extensions remain private; WORKFLOW.md documents their architecture and product reasoning without claiming that unexported code is present here.

The workflow

job posting + tailored résumé
              │ exact snapshots
              ▼
      D1 application record ◀──── OAuth-protected MCP ──── AI agent
              │                                           │
              ├── stage history                           ├── research
              ├── recruiter context                       ├── prep dossier
              ├── next action                             └── live drill
              └── per-stage prep
                       │
                       ▼
              responsive human board

The result is not a résumé keyword generator. Prep is grounded in the exact job description, the exact résumé submitted to that employer, the complete context log, and earlier-stage prep. See the production workflow case study for the full capture → triage → prep → drill → debrief loop and its safety boundaries.

What to inspect

• src/index.ts: OAuth-protected MCP routing with a pinned resource origin.

• src/auth.ts: validated dynamic-client metadata, hardened consent HTML, rate-limited owner authentication, constant-time secret comparison, and safe OAuth error redirects.

• src/mcp.ts: a fresh MCP server per request, actionable tool errors, one agent-facing resource, and ten typed tools.

• src/tools.ts: Zod input contracts, parameterized D1 access, explicit stage-history writes, and destructive-operation guards.

• migrations: relational constraints and cascades for applications, history, context, and prep documents.

• test: Workers-runtime integration tests for MCP, schema, CRUD tools, resources, and token revocation.

• WORKFLOW.md: the production system's end-to-end job-search and interview-prep design.

Architecture

MCP client
    │ OAuth 2.1
    ▼
Cloudflare OAuthProvider ── KV (grants and tokens)
    │ authenticated /mcp
    ▼
MCP tool/resource layer ─── D1 (application board)

The board is intentionally a data surface, not an autonomous recruiter: clients read APPLICATION_BOARD_GUIDE.md, preserve source text, and decide what to do in their own interaction with the user.

Verify locally

Requires Node.js 22+.

npm ci
npm run typecheck
npm test
npm run build

The integration suite supplies an isolated test owner key and local D1/KV bindings. This snapshot intentionally pins OAuth metadata to a non-routable example origin, so it does not offer a copy-paste interactive deployment path.

Deployment boundary

Do not deploy this repository as-is. A real deployment must privately replace the placeholder origin and bindings, create D1/KV resources, store OWNER_KEY with wrangler secret put, and generate fresh binding types. Production configuration belongs outside this public snapshot.

Use

The source is published for portfolio review. It is not an open-source grant; see LICENSE.