Session Persistence Strategy for MCP Job Agents: The Core Problem

Session persistence is how an MCP (Model Context Protocol) job agent keeps itself logged into LinkedIn, Indeed, ZipRecruiter, and other boards long enough to scrape fresh postings and auto-apply without being kicked out or flagged as a bot.

Most job boards authenticate via HTTP cookies or OAuth tokens. These are time-limited. LinkedIn sessions expire every 24–48 hours. Indeed refreshes every few days. If your agent loses the session, it has to log back in—a process that triggers CAPTCHA, email verification, or device confirmation, which kills automation speed. The goal: maintain valid, rotating sessions across 5+ boards simultaneously without collision or detection.

How MCP Agents Store and Validate Session State

Production-grade MCP agents use a stateful cookie store—a local or distributed database that holds:

  • Session tokens (JWT, bearer tokens, or encrypted auth cookies)
  • Expiration timestamps (when the token dies)
  • Refresh tokens (if the board supplies them)
  • Last validation time (when you last confirmed the session was live)
  • Board-specific metadata (CSRF tokens, device fingerprints, IP context)

Before every API call or scrape request, the agent checks: Is this token still valid? If it expires within the next hour, refresh it proactively. If it's already dead, re-authenticate.

This is why timing matters. An agent that waits until a session fails before refreshing loses hours. One that refreshes 6 hours before expiry keeps the flow going.

The Multi-Board Challenge: Token Isolation and Collision

Here's the operational friction: each job board has its own session requirements and anti-bot defenses.

  • LinkedIn requires rotating User-Agent strings and keeps detailed IP logs. Hitting it from the same IP with identical request patterns flags it as bot-like. Sessions are tied to device fingerprints.
  • Indeed uses simpler cookie auth but rotates CSRF tokens frequently. A stale CSRF token on a job application fails silently.
  • ZipRecruiter has looser session requirements but aggressive rate-limiting tied to session ID.

Collision happens when an agent tries to maintain too many sessions from the same context (same IP, same browser fingerprint, same request pattern) simultaneously. Job boards detect this as suspicious and revoke tokens across all sessions.

The fix: isolate sessions per board. Use separate proxy IPs or residential proxies for high-scrutiny platforms like LinkedIn. Stagger login times and requests across boards. Implement per-board request throttling (apply to LinkedIn every 2–3 minutes, Indeed every 1–2 minutes) so the pattern looks human.

Cookie Rotation and Refresh Token Flow

Most job boards use one of two patterns:

  1. Short-lived access token + long-lived refresh token: The agent gets a 1-hour access token and a 7-day refresh token. Before the access token expires, it uses the refresh token to grab a new one. No re-login needed. (LinkedIn, ZipRecruiter do this.)
  2. Session cookie only: A single encrypted cookie, no refresh. The agent must re-authenticate when it expires. (Indeed, some older systems.)

Smart agents prefer boards with refresh tokens because they can maintain persistence without repeated logins. If a board only offers session cookies, the agent must bake in proactive re-auth: login at 80% of session TTL (time-to-live) to stay ahead of expiry.

Here's the implementation pattern:

  1. Store the refresh token securely (encrypted, in a database or key vault).
  2. Before every request, check if the access token is valid. If it expires in less than 5 minutes, refresh.
  3. If refresh fails (e.g., refresh token is revoked), trigger full re-authentication.
  4. Log every token lifecycle event (login, refresh, revocation) for debugging and audit trails.

Failure Recovery: What Happens When a Session Dies

Sessions fail. Refresh tokens get revoked. IP gets blocked. Here's how production agents handle it:

  • Immediate retry: If a single request fails due to session death, try once with a fresh login. If it succeeds, continue.
  • Exponential backoff: If login fails multiple times, wait 30 minutes, then 2 hours, then 24 hours before retrying. This avoids hammering the board with failed auth attempts.
  • Dead session purge: If a session token has failed 3+ times in a row, delete it and re-establish from scratch on the next cycle.
  • Fallback board routing: If LinkedIn goes down or sessions are locked, the agent routes job applications through Indeed instead. This requires maintaining active sessions on 2–3 backup boards.

A robust agent doesn't crash when one session dies. It logs the failure, rotates to another board, and resumes work.

Why This Matters for Speed

Session persistence directly impacts application speed. If your agent has to re-login every time a session expires, you're looking at 20–30 seconds of overhead per board per day. Over a week of active job-searching, that compounds into hours of lost velocity.

Agents that maintain proactive, rotated sessions stay in the "first wave" of applicants—the ones recruiters see within hours of a posting going live, not days later.

For contractors running automated job search at scale, session persistence is infrastructure. Get it right and you're weeks ahead of manual applicants. Get it wrong and you're locked out of the best opportunities.