# Use your job search from Claude: the Zorlya MCP server > Zorlya runs an MCP server at mcp.zorlya.com. On the Pro plan, connect Claude, ChatGPT, Claude Code or Cursor, sign in once over OAuth, and the client can search your feed, read your matches and move applications, with only the access you approve. Source: https://zorlya.com/blog/zorlya-mcp-server By Zorlya. Published 2026-10-21, updated 2026-10-25. Using Zorlya. 5 min read. The Model Context Protocol, MCP, is a standard way for an AI client such as Claude to use another service's tools. Zorlya runs an MCP server, so the job feed, your match scores and your application board can be read and updated from the chat window you already work in. You ask in plain words. The client picks the tools. This post covers what the server offers, how signing in works, and what it will and will not do on your behalf. *Updated 18 October 2026: the server moved to `https://mcp.zorlya.com`, and sign-in now goes through a Connect page where you choose the account and the permission level. The older address, `zorlya.com/mcp`, no longer works.* ## Connecting The server lives at one address: `https://mcp.zorlya.com`. In Claude Desktop, open Settings, then Connectors, then Add custom connector, and paste that address. In Claude Code, run: ``` claude mcp add --transport http zorlya https://mcp.zorlya.com ``` Zorlya accepts the AI apps on its list: Claude, ChatGPT, Claude Code and Cursor. Each is given the address and finds the rest. For a job seeker account, connecting an AI app is part of the Pro plan: on Free or Plus the Connect page says so and no connection is made ([pricing](/pricing)). The first time the client calls the server, it opens a browser window. The Connect page shows the client's name, asks which of your Zorlya accounts it should use, and asks how much it may do: read only, which is the default, or read and change. You sign in to that account, and if you chose to let it change things, Zorlya asks you to sign in again with your password or a passkey. That is the whole setup. There is no API key to copy and nothing to paste back into the client. ## What happens when you approve Signing in follows OAuth 2.1, the same standard used when you let one app use another account of yours. 1. The client reads the server's published metadata and registers itself. 2. Your browser is sent to the Connect page. The client proves it is the same client that started the request using PKCE, a one-time check that stops anyone who intercepts the redirect from using it. 3. Approving issues a code that works once and expires after 60 seconds. The client swaps it for an access token that lasts 1 hour and a refresh token that lasts 30 days. 4. Every refresh issues a new refresh token and retires the old one, so a stolen refresh token stops working the next time the real client uses its own. Tokens are stored on our side only as hashes, and each one works only on `mcp.zorlya.com`. The connection belongs to your account, not to a user id the client sends: no tool takes an account as an argument, so a client can only ever see the account that approved it. ## Read and write access There are two levels for a job seeker. Read only lets a client read your jobs, matches, profile, saved jobs, applications and notifications. Read and change lets it change a small set of things on top of that. Behind the levels are scopes named by area and action, such as `applications:write`; `zorlya:read` and `zorlya:write` still work as shortcuts for every area. Read only is the default. A client that only has read access is never shown the write tools at all, so it cannot try them. ## The tools A job seeker account has 20 tools: 15 that read and 5 that write. Hiring, support and staff accounts have their own sets, 55 tools in all, and a client sees only the tools of the account you chose. The read tools cover the feed and your own data. `search_jobs` searches by title, company or description, with filters for location, remote only and a minimum score. `top_matches` returns your highest scoring jobs, best first. `get_job` returns one job in full with its score broken down by part, and `similar_jobs` finds the postings closest in meaning to one you name. For your own side there are `get_profile`, `search_resume`, `list_applications`, `application_timeline`, `pipeline_analytics`, `list_saved_jobs`, `list_notifications`, `list_documents` and `list_tracks`. Two describe the feed itself: `list_sources` and `ingest_stats`. The write tools are deliberately small. `save_job` and `unsave_job` manage bookmarks. `track_application` starts tracking a job or moves it to another stage on your board. `add_application_note` adds a note to an application's history. `mark_notifications_read` clears your notifications. Nothing on that list sends an email, applies to a job or deletes anything. (Hiring accounts have a tool that moves a candidate to another stage and emails them, so for those accounts keep the connection read only unless you mean otherwise.) Applying stays your decision, made in Zorlya or on the employer's site. The server also offers five resources a client can attach as context: `zorlya://profile`, `zorlya://resume`, `zorlya://tracks`, `zorlya://sources`, and `zorlya://job/{job_id}` for any one posting. ## Four prompts to start from Clients that support prompts will show four ready-made ones: - **review_matches** reads your strongest matches above a score you choose and gives a verdict on each: apply, maybe or skip. It is told to be direct about weak ones, because a list where everything is a strong match is no use to you. - **assess_fit** takes one job and sets out how well it fits and where the gaps are. - **pipeline_review** reads your application board and says what needs attention. - **find_roles** searches for roles matching a description, with optional location and remote filters, and shortlists the best. ## Limits Each account can make 120 reads, 30 changes and 5 deletes a minute. These numbers are not there to meter use. A model caught in a retry loop can call the same tool hundreds of times, and the limit makes that visible instead of letting it run. A call over the limit returns an error that says how long to wait. Signing in and registering a client are limited separately, to 10 a minute from one address. Zorlya also logs the requests an AI app makes for you, with their contents, so you can see what an app did. The [privacy policy](/privacy#ai-requests) says what is kept and for how long. ## What it looks like in use A typical exchange: you ask Claude to find remote backend roles that fit you this week. It calls `search_jobs` with your words and a remote filter, then `top_matches` to rank what it found by your scores, and comes back with a short list and the reason for each. You say the second one looks right. It calls `get_job` to read the full posting and breakdown, and, if you ask, `track_application` to put it on your board as applied. At no point did the client need your password, and at no point could it do more than the scope you approved. ## Disconnecting Every client you have approved is listed in Zorlya under Settings, Integrations, and the email you get when you connect has a link to your connections on `mcp.zorlya.com`. Disconnecting one revokes its tokens at once. The next call it makes fails, and it has to ask you again. The developers page has the full tool reference, with every argument each tool takes.