What is Dossier?
Dossier keeps your career history in one profile and turns it into a tailored resume and cover letter for each job. You paste a posting, or start from one found through JSearch, Adzuna or FreeHire; it reads the requirements, shows which ones your profile covers and which are gaps, and drafts the documents in the tone you pick, in one of twelve themes and 21 built-in document languages. A chat refines them, every version is kept, and a board, a table and a dashboard track each application from draft to offer. A Startups screen lists hiring startups from YC job posts and Hacker News' monthly "Who is hiring?" thread.
The optional parts are switched off until you turn them on: a daily job agent that scores new postings and can prepare drafts but never sends or applies, a Gmail and Google Calendar connection through your own Google OAuth client, and an MCP connector that lets Claude or another MCP app search, score and save drafts. The model is your choice: Ollama, llama.cpp or LM Studio locally, or any OpenAI-compatible API, Anthropic or Mistral with your own key.
It is a Next.js 16 and PostgreSQL 18 app in TypeScript under AGPL-3.0, built for one user behind one password. The repository was created on 3 October 2026 by AienTech and has about 3,509 stars and 744 forks, with 19 releases from v1.0.0 that day to v1.11.0 on 31 October 2026. There is no hosted or paid edition; the project site offers installation and a sponsor link.
Is Dossier worth it?
Dossier's strongest point is not the drafting but the bookkeeping around it. Each posting is matched line by line against one profile, gaps are shown as gaps, and every resume and letter keeps its versions, its chat and its status, so twenty applications in a month stay legible. Its privacy documentation is the most precise we have read in a self-hosted app of this size: PRIVACY.md lists, task by task, what a hosted model receives. Writing a resume or letter sends your profile without contact details (name, headline, city, roles, companies, dates, bullet points, projects, education and your own facts) plus the posting, read up to 20,000 characters. Email, phone, address, date of birth, links, references and private notes stay out. The exception is importing a resume, which sends the whole file, contact details and references included.
The "never invents experience" promise has two layers, and only one is code. The prompts tell the model to use profile facts only; then, with Never invent experience on (the default), a fact guard in fact-guard.ts scans each generated section for capitalised names, acronyms, numbers, years, percentages and words such as "certified", and marks anything absent from the profile, the posting and the facts you added as "check this". It flags; it does not block. In our reading of the code, a vague claim with no name or number, such as "led cross-functional teams", passes untouched, and because the posting itself counts as a source, a tool the posting names can be attributed to you without a flag. The guard narrows the risk. Reading every draft before it goes out still carries the guarantee.
The Gmail connection asks Google for gmail.send, gmail.readonly, calendar.freebusy and calendar.events, plus your address. gmail.readonly lets the app read your whole mailbox; Dossier itself keeps only threads it sent and mail from companies you applied to, unless you choose Every new email, which also sends each new message outside Promotions and Social to the AI. It checks every 10 minutes by default and sends nothing without your confirmation. You must create your own Google Cloud OAuth client, click past an "unverified app" warning, and publish the consent screen, since Google ends testing-mode access after 7 days. Job search costs little: JSearch's free plan has 200 searches a month, OpenWeb Ninja lists $0.005 a request after that, Adzuna gives a free key good for about 250 a day, and FreeHire needs no key. The job agent is capped at three runs a day and one results page each, about 90 JSearch searches a month at most.
The security model fits a laptop better than the open internet. There is one password, stored as an argon2id hash, with no accounts and no second factor described, and behind it sit your profile, any Gmail read access and your provider keys. Sign-ins are rate-limited per IP and overall, but SECURITY.md warns not to expose port 3000 directly because the limiter trusts the last X-Forwarded-For entry, so a reverse proxy with TLS is mandatory, not optional. Using Claude on the web through the MCP connector needs that public HTTPS address too. The usage ping has been opt-in only since 1.8.0, and a daily update check to GitHub is on by default.
Maturity is the honest worry. The repository is four weeks old, the GitHub API lists two contributors and 25 commits on main, and 19 releases have shipped since 3 October 2026, with export formats that do not import into older versions. The 744 forks are high next to 3,509 stars, about one for every five, which may simply mean people fork to self-host. AGPL-3.0 lets you run and change it freely for yourself; a career coach running a modified copy for clients must offer them the source, becomes the GDPR controller for their data, and needs a FreeHire API plan. For one person's search on a home machine with a local model, it is a thoughtful tool; as an internet-facing service it needs more armour than it ships with.
Where it earns its place
A senior product designer in Berlin applying to 15 to 20 roles a month
Tailor a resume and cover letter to each posting without making anything up
Fill in the profile once, paste each posting and review the match and the "check this" flags before downloading the PDFs. With Anthropic or OpenAI the profile and posting go to that provider under your API terms; the board and dashboard track replies and interviews.
A software engineer under an NDA who will not send a resume to a cloud model
Run the whole search on my own laptop
Start the Compose file with the ai profile and pull qwen2.5:7b, which needs about 6 GB of memory. Nothing in the profile or documents leaves the machine, but on a CPU a new application takes several minutes rather than seconds.
A Claude Pro subscriber who prefers to work in chat
Ask Claude to find jobs, rank them against my profile and draft the best one
Turn on the MCP connector, put Dossier behind a public HTTPS proxy and add it as a custom connector. Claude's tools can search, score, read the profile and save drafts, but never send or delete; what Claude reads goes to Anthropic under your Claude account.
A graduate job hunter on a tight budget
Get a short list of new postings each morning without paying for an API
Pick FreeHire or Adzuna's free key, set one search, an hour and a minimum score in Settings, Job agent. It runs once a day, scores up to 15 new postings by default and can prepare up to 3 drafts that wait for approval.
Before you commit
- Setup
- Download compose.production.yml, generate POSTGRES_PASSWORD and DOSSIER_SECRET, hash a password with the image's hash-password command and run docker compose up -d. The image is about 1.7 GB and needs about 2 GB of free memory; on a server the docs ask for 2 vCPUs, 2 GB and a TLS reverse proxy.
- Integrations
- Ollama, llama.cpp, LM Studio, any OpenAI-compatible API (OpenRouter, DeepSeek, vLLM), Anthropic and Mistral; JSearch, Adzuna, FreeHire and an unofficial Bundesagentur für Arbeit source; Gmail and Google Calendar; an MCP connector for Claude, n8n and other MCP apps; Jev by TypeSafe for scoring.
- Data and privacy
- Everything is stored in your PostgreSQL database; keys and Google tokens are encrypted with DOSSIER_SECRET; nightly plain-JSON backups are kept 14 days by default. A hosted model receives your profile without contact details plus postings and, if Gmail is on, replies up to 8,000 characters. The usage ping is opt-in; the daily GitHub update check is on by default.
- Cost at scale
- No paid tier. A small server plus model usage: free with a local model, or your provider's per-token price for each read, match, draft and score. JSearch beyond 200 searches a month is pay-as-you-go at $0.005 a request; a coach hosting it for clients needs a FreeHire API plan.
- Limits
- Single user, single instance per database, desktop browsers only and an English interface. 19 releases in four weeks, and a 1.11.0 export cannot be imported into older versions. The fact guard is lexical and only flags. Six open issues at the time of writing.
What’s good
- Exact, task-by-task documentation of what a hosted model receives
- Fact guard flags names, numbers and credentials your profile does not back
- Free job-search tiers are enough for daily use, and the agent never applies
- Works fully offline with Ollama or LM Studio
What’s not
- One password, no accounts and no second factor described
- Fact guard only flags, and misses vague claims and terms taken from the posting
- Gmail read access covers the whole mailbox; you must run your own Google OAuth client
- Four weeks old with two listed contributors; desktop-only, English interface
Best for
One job seeker comfortable with Docker who wants tailored resumes, letters and application tracking on a home machine or private server, ideally with a local model.
Dossier: common questions
- Is Dossier worth it?
- Dossier is an unusually careful, well-documented job-search app whose honesty check is a useful net rather than a guarantee, and whose four-week history and single password argue for running it at home first. We rate it 3.8 out of 5.
- How much does Dossier cost?
- Free and open source (AGPL-3.0), self-hosted only. You pay for your own server, your AI provider if it is hosted, and any job-search API beyond the free tiers (JSearch's free plan has 200 searches a month; Adzuna's free key about 250 a day; FreeHire needs no key).
- What are the downsides of Dossier?
- One password, no accounts and no second factor described; fact guard only flags, and misses vague claims and terms taken from the posting; gmail read access covers the whole mailbox; you must run your own Google OAuth client; four weeks old with two listed contributors; desktop-only, English interface.
- Who is Dossier best for?
- One job seeker comfortable with Docker who wants tailored resumes, letters and application tracking on a home machine or private server, ideally with a local model.
- How much does Dossier cost for a team or in production?
- No paid tier. A small server plus model usage: free with a local model, or your provider's per-token price for each read, match, draft and score. JSearch beyond 200 searches a month is pay-as-you-go at $0.005 a request; a coach hosting it for clients needs a FreeHire API plan.
- Is Dossier safe for company data?
- Everything is stored in your PostgreSQL database; keys and Google tokens are encrypted with DOSSIER_SECRET; nightly plain-JSON backups are kept 14 days by default. A hosted model receives your profile without contact details plus postings and, if Gmail is on, replies up to 8,000 characters. The usage ping is opt-in; the daily GitHub update check is on by default.
Answers checked Oct 31, 2026.