# com.aicandidatehub/mcp (npm · @aicandidatehub/mcp)

Profile, CV, jobs, compensation & application-tracking tools for AI agents, by aicandidatehub.com.

- Trust score: 58/100 (low)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@aicandidatehub/mcp`: 58/100 (this document), [markdown](https://verifymcp.io/servers/com-aicandidatehub-mcp/aicandidatehub-mcp.md), [page](https://verifymcp.io/servers/com-aicandidatehub-mcp/aicandidatehub-mcp)

## Channel facts

- Registry: `npm`
- Package: `@aicandidatehub/mcp`
- Version: `0.5.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (108 of 112), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 6/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: no license is declared.
  - Actively maintained (last published 9 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 62/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2907 tokens (~161/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add com-aicandidatehub-mcp -- npx -y @aicandidatehub/mcp
```

### Codex

```bash
codex mcp add com-aicandidatehub-mcp -- npx -y @aicandidatehub/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-aicandidatehub-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@aicandidatehub/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-aicandidatehub-mcp --command npx --arg -y --arg @aicandidatehub/mcp
```

### Hermes

```yaml
mcp_servers:
  com-aicandidatehub-mcp:
    command: "npx"
    args: ["-y", "@aicandidatehub/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "com-aicandidatehub-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@aicandidatehub/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 58, −1)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-03 (score 59, +30)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional regression] License: unverified → fail
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Stability: unverified → 0.27
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good

### 2026-08-01 (score 29, +9)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 20, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-28 (score 38, +19)

- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: unverified
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail

### 2026-07-27 (score 19)

First indexed and scored.

## MCP tools (18)

### `get_profile` (~31 tokens)

Fetch the authenticated user's candidate profile including about, experience, education, and skills. Safe for display to the user.

### `import_resume_from_text` (~102 tokens)

Import a resume (also called CV — terms interchangeable) from plain text. Parses the text and persists it as a new CV profile in the user's candidate-profiles library. Returns the new cv_profile_id for use with analyze_job_fit, generate_cover_letter, and rewrite_cv_for_job.

Input parameters:

- `cv_text` (string, required): The resume content as plain text.
- `profile_name` (string): Optional name for the saved CV profile (defaults to "Imported Resume").

### `import_job_from_url` (~91 tokens)

Import a job listing from a URL. The backend auto-detects LinkedIn vs other sources. Parses the JD, persists it to the Jobs Module library, and returns the new jd_id for use with analyze_compensation_for_job, analyze_job_fit, generate_cover_letter, and rewrite_cv_for_job.

Input parameters:

- `url` (string, required): URL to the job listing (LinkedIn or any direct JD URL).

### `list_jobs` (~83 tokens)

List your Jobs Module library as a summary view (id, title, company, location, brief summary). For full parsed_content / classification codes / salary bands, call get_job with the returned id. For active-pipeline rows with status, call list_tracked_jobs.

Input parameters:

- `limit` (integer): Number of jobs to return.
- `offset` (integer): Pagination offset.

### `get_job` (~111 tokens)

Fetch a single Job Description by id from the user's Jobs Module library. Returns the full parsed JD content (parsed_content, salary, classification codes). This is the canonical lookup used by analyze_job_fit, generate_cover_letter, and rewrite_cv_for_job. For Job Tracker pipeline entries (status/dates/notes), use get_tracked_job.

Input parameters:

- `id` (string, required): The Job Description ID (jd_id). Get from list_jobs, list_tracked_jobs (via jd_id field), or import_job_from_url.

### `list_cv_profiles` (~125 tokens)

List the user's CV profiles (CV and resume are interchangeable terms — this tool covers both) as a summary view (id, profile_name, display_name, headline, created_at). For full parsed_content (skills, experience, education), use the returned id with analyze_job_fit, generate_cover_letter, or rewrite_cv_for_job. Backend ordering is created_at DESC; if you omit cv_profile_id on downstream tools, the most-recent (index [0]) is used.

Input parameters:

- `limit` (integer): Optional client-side cap on returned profiles. Backend ordering is created_at DESC.

### `list_generated_cvs` (~172 tokens)

List the user's AI-rewritten CVs (also called resumes — terms interchangeable in this MCP) generated by rewrite_cv_for_job. Returns a summary view (id, name, original_cv_profile_id, jd_id, focus_type, template, created_at). Backend ordering is created_at DESC; index [0] is the most recent. To download a previously-generated CV, call get_cv_download_url(cv_id, format) — note format is fixed at the time of generation: if you generated a docx and now want PDF, you must call rewrite_cv_for_job(..., export_format='pdf') again. There is no cross-format on-demand re-render in v0.4.0.

Input parameters:

- `limit` (integer): Optional client-side cap on returned generated CVs. Backend ordering is created_at DESC.

### `list_tracked_jobs` (~79 tokens)

List jobs the user is actively pursuing (Job Tracker pipeline — saved/applied/interviewing/offer/not_offered/accepted). Returns paginated tracker rows with status metadata. For the full library of imported JDs, use list_jobs.

Input parameters:

- `limit` (integer): Number of jobs to return.
- `offset` (integer): Pagination offset.

### `get_tracked_job` (~66 tokens)

Fetch a specific job from the Job Tracker pipeline by ID. Returns the full tracker row (status, dates, jd_id). The job_tracker table does not store free-text notes — activity history lives on the activities endpoint.

Input parameters:

- `id` (string, required): The Job Tracker row ID.

### `track_job` (~228 tokens)

Add a job to the user's Job Tracker pipeline (the same tracker shown at /job-tracker, listed by list_tracked_jobs). Use after import_job_from_url / rewrite_cv_for_job to record that the user is pursuing a role. title and company are required; status defaults to "Saved" (valid: Saved, Applied, Interviewing, Offer, Not Offered, Accepted). Pass jd_id to link the imported JD and linkedCvId to link a generated CV/résumé. Returns the new tracker_id.

Input parameters:

- `company` (string, required): Company name.
- `jd_id` (string): jd_id from import_job_from_url, to link the imported JD.
- `linkedCoverLetterId` (string): Generated cover-letter id to link (camelCase key — matches the backend contract).
- `linkedCvId` (string): Generated CV/résumé id to link (camelCase key — matches the backend contract).
- `source_url` (string): Original job posting URL.
- `status` (string): Pipeline status. Defaults to "Saved".
- `title` (string, required): Job title.

### `analyze_job_fit` (~236 tokens)

Analyze how well your CV (also called resume — terms interchangeable) profile matches a specific job description. Mirrors the working browser flow at src/app/jobs/page.tsx:461-494: stage 1 calls the gated job-fit BFF /api/analyze/job-fit (which meters the job_fit_analysis quota, then forwards to the Python analyzer), stage 2 persists to Go /api/v2/job-analyses (best-effort). Returns alignment scores (0-100 scale), strengths, weaknesses, recommendations. Enum hints (documented for agent UX, not enforced here — upstream may relax):
  • level: entry | mid | senior | lead | principal
  • recommendation: strong-fit | fit | partial-fit | not-fit
Returns envelope.meta.score_scale="0-100" and envelope.meta.persisted=<bool>.

Input parameters:

- `candidate_profile_id` (string): Optional CV profile id (discover via list_cv_profiles). Defaults to the most-recently-uploaded CV profile (profiles[0]).
- `jd_id` (string, required): The job description ID (from list_jobs, get_job, or import_job_from_url).

### `rewrite_cv_for_job` (~532 tokens)

Generate a CV (also called a resume — terms interchangeable in this MCP) tailored to a specific job description. Optionally persists and returns a structured export descriptor: data.export.url (long signed download URL), data.export.short_url (chat-client-friendly short URL — new in v0.3.0), expires_at, content_type, size_bytes, filename. Set export_format to "docx" (default) or "pdf" — both formats route through the same /d/[code] short-URL flow. Use get_cv_download_url to mint a fresh short URL after the original expires; the re-mint preserves the original format (no cross-format re-render). Note: MCP-generated PDFs always render with contentType='standard' and length='3_page' regardless of what variation you previewed in the browser UI — the MCP layer does not expose those knobs in v0.4.0. To get a different variation, change the variation in the browser UI and use its Export PDF button. PDFs render with all sections visible; if you toggled sections off in the browser UI, that state does not propagate to MCP PDFs.

Input parameters:

- `color` (string): Save-side color. Defaults to blue.
- `content_style` (string): Optional content style knob.
- `content_type` (string): Defaults to natural; ats also supported.
- `cv_profile_id` (string): Optional CV profile id (from /api/v2/candidate-profiles). Defaults to first available.
- `export_format` (string): Export format. 'docx' (default) or 'pdf'. PDF path reuses the same Chunk C.1 short-URL flow as docx (same /d/[code] redirect, same cv_short_links table) — your returned data.export.short_url just res…
- `industry` (string): Optional industry.
- `jd_id` (string, required): The job description ID.
- `page_length` (string): Defaults to 3_page.
- `paper_size` (string): Save-side paper size. Defaults to letter.
- `persist` (boolean): If true, persist and call export.
- `role_level` (string): Optional role level.
- `template` (string): Save-side template (e.g. tech). Defaults to tech.
- `template_type` (string): CV template (e.g. modern, tech). Defaults to modern.

### `generate_cover_letter` (~217 tokens)

Generate a customized cover letter for a specific job description using AI. Uses your CV (also called resume — terms interchangeable) profile as the candidate context. Optionally persists the result to your library. Focus values: 'balanced' | 'cv-focused' | 'job-focused' (DB-enforced). Synonyms accepted; unknown values fall back to 'balanced'. Response includes the resolved focus on envelope.echo.input_focus and the normalized value on envelope.meta.focus_used.

Input parameters:

- `cv_profile_id` (string): Optional CV profile id (from /api/v2/candidate-profiles). Defaults to the first available CV profile.
- `focus` (string): Letter focus: one of 'balanced' | 'cv-focused' | 'job-focused' (matches browser+DB). Common synonyms ('professional', 'formal', 'cv', 'job') are normalized; unknown values fall back to 'balanced'.
- `jd_id` (string, required): The job description ID.
- `persist` (boolean): If true, also stores the generated letter to your library.

### `analyze_compensation_for_job` (~203 tokens)

Analyze how a specific JD (by jd_id from the Jobs Module) or a free-text role+location compares to market compensation. Returns market percentiles, the user's position if comp data is on file, and AI insights.

Input parameters:

- `advertised_salary_max` (number): Maximum advertised salary if known.
- `advertised_salary_min` (number): Minimum advertised salary if known.
- `experience_level` (string): Experience level (mirrors browser field name; entry/mid/senior/etc.).
- `jd_id` (string): Job Description ID from the Jobs Module library (from list_jobs, get_job, or list_tracked_jobs.jd_id). If provided, the tool fetches the JD and extracts title + location + experience_level + advertis…
- `job_title` (string): The job title. Required if jd_id is not provided.
- `location` (string): The job location (free-text). Required if jd_id is not provided.

### `get_compensation_for_role` (~253 tokens)

Fetch compensation benchmarks for a role. Two modes: (1) JD-context — pass jd_id from list_jobs/get_job/list_tracked_jobs.jd_id (RECOMMENDED for SG roles; mirrors browser pattern, closest-match relaxation via Gemini applies automatically). (2) Free-text US benchmark — pass role_title + country='US' for a US benchmark via the compensation analyze endpoint (job_id empty → no persistence). For SG roles without a jd_id, call import_job_from_url first to obtain a jd_id with extracted SSOC codes.

Input parameters:

- `city` (string): City (US: drives MSA selection).
- `country` (string): Country. Defaults to US. SG REQUIRES jd_id.
- `jd_id` (string): JD id from list_jobs/get_job/list_tracked_jobs.jd_id. Required for SG roles; recommended for US roles. When present, role_title/country/seniority/city/state are ignored (read from the JD).
- `role_title` (string): Role title — required only when jd_id is omitted.
- `seniority` (string): Seniority level. Applies a multiplier to the median.
- `state` (string): State or region (US).

### `get_cv_download_url` (~290 tokens)

Return a short, copy-paste-friendly download URL for a previously-generated CV (also called resume — terms interchangeable). Use this when the original signed URL from rewrite_cv_for_job has expired (1 hour TTL) or got line-wrapped in the chat client. The returned short_url routes through the app's /d/[code] redirect, which re-signs the stored Supabase object on each follow (no DOCX/PDF re-render). Short URL itself is valid for 7 days. IMPORTANT: format is fixed at the time the CV was generated by rewrite_cv_for_job — this tool does NOT re-render across formats. If you need a different format than was originally generated, call rewrite_cv_for_job again with the desired export_format. PDFs generated via MCP are rendered with contentType='standard' and length='3_page'; this is fixed at generation time.

Input parameters:

- `cv_id` (string, required): The job-linked CV id (uuid) from rewrite_cv_for_job.ids.cv_id or list_generated_cvs[].id (Chunk D).
- `format` (string): Export format. v0.4.0 supports both 'docx' and 'pdf' end-to-end. Format must match the one used at the original rewrite_cv_for_job call (no cross-format re-render).
- `template` (string): Render template. Defaults to 'tech'. See multi-template docs (Chunk E).

### `signup_url` (~47 tokens)

Generate a signup URL for a new user. Includes MCP attribution and client tracking parameters. No authentication required.

Input parameters:

- `utm_content` (string): Optional UTM content tag for tracking specific campaigns.

### `get_server_info` (~41 tokens)

Returns MCP server version, commit SHA, environment, and deployment timestamp. Useful for bug reports and debugging which version of the MCP is responding. No authentication required.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-aicandidatehub-mcp/aicandidatehub-mcp#diagnostics

## Score history

- 2026-08-04: 58
- 2026-08-03: 59
- 2026-08-02: 29
- 2026-08-01: 29
- 2026-07-31: 20
- 2026-07-29: 38
- 2026-07-28: 38
- 2026-07-27: 19

## Links

- npm package: https://www.npmjs.com/package/@aicandidatehub/mcp
- Socket report: https://socket.dev/npm/package/@aicandidatehub/mcp
- Website: https://www.aicandidatehub.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-aicandidatehub-mcp/aicandidatehub-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-aicandidatehub-mcp/aicandidatehub-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-aicandidatehub-mcp/aicandidatehub-mcp