gunio-mcp

A local-only, Docker-packaged MCP server (and a thin read CLI) for gun.io, authenticated with your own browser session — the same host-side cookie-broker + wrapper pattern as claudesync. It lets an MCP client (Claude Code, etc.) read your gun.io freelancer data — interviews, applications, jobs, profile — and perform a small set of gated writes.

Unofficial. No affiliation with gun.io. This talks to gun.io's private, undocumented API using your logged-in session. It is a personal automation tool; use it at your own risk and within gun.io's Terms of Service. No gun.io code is included in this repo.

How it works

Firefox session ──(host-side broker: rookie-cli)──▶ GUNIO_COOKIE ──▶ docker run ──▶ FastMCP server ──▶ app.gun.io/api/v2

• A cookie broker (scripts/lib/harvest-cookie.sh) reads your gun.io session (sessionid + csrftoken) from the browser, host-side. Nothing leaves your machine.

• A thin wrapper passes that cookie into a container via the GUNIO_COOKIE env var and docker runs it per invocation.

• Inside the container, a Python/FastMCP server (gunio_mcp) calls gun.io's /api/v2 through a safety-guarded client (gunio_broker).

Related MCP server: Upwork MCP Server

Security model

• Reads need only the cookies. Writes echo the csrftoken as X-CSRFToken (Django CSRF), and are double-gated: a call previews unless confirm=true and the server env has GUNIO_MCP_WRITE_SCOPE set.

• Hard denylist in the client, enforced regardless of tool: auth/logout (a GET that kills your session), the entire /staff/ tree, DELETE on a freelancer (account deletion), complete-screening, and telemetry writes.

• Cookies are never logged or placed in exceptions.

• Local only. No data is sent anywhere except gun.io itself.

Install (once Docker image + installer land)

# bootstrap the broker + wrappers, pull the image
scripts/gunio-setup.sh install

# register the MCP server with Claude Code
claude mcp add --scope user gunio ~/.local/share/gunio/gunio-mcp-wrapper.sh

To enable writes, set GUNIO_MCP_WRITE_SCOPE=writes in the server env (see the wrapper). Without it, write tools only ever return a dry-run preview.

Develop

uv sync --extra dev
uv run --extra dev pytest -q          # full suite
uv run gunio me                       # thin CLI (needs GUNIO_COOKIE or a logged-in browser)
uv run gunio-mcp                      # run the MCP server over stdio

GUNIO_COOKIE is a sessionid=...; csrftoken=... string; the broker produces it, or set it by hand for local dev.

Layout

License

MIT.