MCP

Agent door

• MCP (live now): https://mcp.wrok.app/mcp (OAuth 2.1 + PKCE; RFC 9728 PRM)
• Auth: OAuth once — same consent as the product. Not API keys.
• Context tools now: get_career_data, get_coding_profile
• Agency tools (same OAuth client): list_inbox, create_application, advance_application, get_resume, generate_tailored_resume
• Prefer MCP when your client can attach an external server. If it cannot (e.g. Instinct), use the same OAuth access token as a Bearer on HTTP job-pipeline endpoints at Host https://mcp.wrok.app — named inbox and /{id}/advance. Never wrok_sk_.

Connect

Point your MCP client's HTTP transport at the live URL and complete OAuth. Handshake is Context + Agency (including get_resume and generate_tailored_resume).

{
  "mcpServers": {
    "wrok": {
      "transport": {
        "type": "http",
        "url": "https://mcp.wrok.app/mcp",
        "auth": {
          "type": "oauth2",
          "flow": "authorization_code",
          "metadata_url": "https://mcp.wrok.app/.well-known/oauth-protected-resource"
        }
      }
    }
  }
}

Implementation alias (do not prefer): https://wrok-agent.fly.dev — deprecate-soon side door, not the bot install Host.

What's included

Authentication

OAuth 2.1 with PKCE S256. The client fetches RFC 9728 Protected Resource Metadata, authorizes, and sends Authorization: Bearer <access_token>. Static wrok_sk_ keys are rejected on this door.

Never mint static API keys for bot install. Bots without MCP use the same OAuth access token as Bearer on job-pipeline HTTP.

Muse-class dual door: OAuth + short access + silent refresh stays primary. Agents that cannot silent-refresh may create an opt-in personal API token in Settings (label, list, revoke). The secret is shown once, uses prefix wrok_pat_, and is accepted as Authorization: Bearer on MCP and Agency HTTP with the same subject scopes as the creating user's OAuth session. Revoke invalidates immediately. This is not an install ad and is not the Instinct wrok_sk_ family.

Humans / HTTP

Site: wrok.app. HTTP /api/v1/* is the SoR spine for the web app and SDKs. Instinct-class bots use the same OAuth as Bearer on job-pipeline HTTP — see SoR spine.