100Hires ATS MCP Server

What is MCP?

Model Context Protocol is an open standard from Anthropic that lets AI assistants connect to external systems through a uniform interface — think of it as USB-C for AI tools.

100Hires runs a remote MCP server, not a local one. There’s nothing to install, deploy or update on your machine — every client, including Claude Desktop and Cursor, points at https://mcp.100hires.com/mcp and authorizes via OAuth. New tools and bug fixes land server-side and reach all your assistants the next time they call tools/list.

What you can ask

Ten real prompts that work today, in plain English.

• “Show me candidates who applied this week for the Senior PM role”
• “Move all rejected candidates from this job to the talent pool”
• “Schedule a 30-minute interview with Sarah next Tuesday for the Backend Engineer role”
• “Draft a follow-up email to candidates who haven't replied in 5 days and send it”
• “Open a new Senior Product Designer job in New York and publish it to LinkedIn”
• “Find every LinkedIn candidate with Python on their resume and tag them 'pythonista'”
• “What's on my interview calendar tomorrow?”
• “How many candidates do we have at each stage in the Sales Rep pipeline?”
• “Reject everyone still in 'Phone Screen' for the Marketing Manager job with reason 'No response'”
• “Pull the resume and last 3 notes for the candidate I interviewed yesterday”

Quickstart

From zero to your first MCP prompt in under five minutes.

1. Prerequisites

   A 100Hires account on any plan, including the 14-day free trial. The MCP endpoint is available to every workspace.

2. Pick your AI client

   One-click install for Cursor and VS Code; copy a snippet for everything else. All clients connect to https://mcp.100hires.com/mcp over Streamable HTTP; stdio-only clients use the mcp-remote shim.

   ChatGPT Claude.ai Cursor VS Code Claude Desktop Claude Code Codex OpenAI API Anthropic API Other

   Open 100Hires in ChatGPT

   Or in ChatGPT go to Settings → Apps and find 100Hires in the directory.

   Click Connect, sign in, and click Allow.

   In claude.ai, open the sidebar and click Customize.

   

   Go to Connectors, click +, and choose Add custom connector.

   

   In the Add custom connector dialog, fill in:

   • Name: 100Hires
   • Remote MCP server URL: https://mcp.100hires.com/mcp
   • Click Add.

   

   Claude opens the 100Hires consent screen. Sign in, click Allow, and you’re connected.

   Install in Cursor

   Click Install in Cursor to add 100Hires MCP automatically. Or paste the snippet below into ~/.cursor/mcp.json.

   Install in VS Code

   Opens VS Code and registers the server. Or paste the snippet into .vscode/mcp.json in your workspace.

   Add the snippet to your Claude Desktop config and restart the app:

   • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
   • Windows: %APPDATA%\Claude\claude_desktop_config.json

   Run this in your terminal:

   OpenAI Codex CLI — add the server, then run codex mcp login 100hires to authorize.

   From OpenAI Responses API

   Connect 100Hires MCP headless from your own scripts, backends, and AI agents — no desktop client required. Pass the server as a tool with type: "mcp" and the OpenAI platform calls the endpoint directly. The example exposes only the read-only hires_list_jobs tool and skips approval for that tool — add more tools to allowed_tools only after deciding which actions require approval.

   Requires an OAuth access token — your app obtains it via the OAuth 2.1 flow (see Authentication). OpenAI does not store the token: send it with every request and refresh it yourself when it expires (access tokens live 1 hour).

   Copy

   from openai import OpenAI
   
   client = OpenAI()
   
   response = client.responses.create(
       model="gpt-5",
       tools=[{
           "type": "mcp",
           "server_label": "100hires",
           "server_url": "https://mcp.100hires.com/mcp",
           "authorization": "YOUR_OAUTH_ACCESS_TOKEN",
           "allowed_tools": ["hires_list_jobs"],
           "require_approval": "never"
       }],
       input="List all open jobs in 100Hires"
   )
   
   print(response.output_text)

   From Anthropic Messages API

   Connect 100Hires MCP headless from the Anthropic SDK — the MCP connector lets the Messages API call the server for you via mcp_servers, no local MCP client needed. The connector runs tools without approval prompts, so the example enables only the read-only hires_list_jobs tool — extend the allowlist in configs deliberately.

   Requires an OAuth access token — your app obtains it via the OAuth 2.1 flow (see Authentication). Anthropic does not store the token: send it with every request and refresh it yourself when it expires (access tokens live 1 hour).

   Copy

   import anthropic
   
   client = anthropic.Anthropic()
   
   response = client.beta.messages.create(
       model="claude-opus-4-8",
       max_tokens=16000,
       messages=[{"role": "user", "content": "List all open jobs in 100Hires"}],
       mcp_servers=[{
           "type": "url",
           "url": "https://mcp.100hires.com/mcp",
           "name": "100hires",
           "authorization_token": "YOUR_OAUTH_ACCESS_TOKEN"
       }],
       tools=[{
           "type": "mcp_toolset",
           "mcp_server_name": "100hires",
           "default_config": {"enabled": False},
           "configs": {"hires_list_jobs": {"enabled": True}}
       }],
       betas=["mcp-client-2025-11-20"]
   )
   
   for block in response.content:
       if block.type == "text":
           print(block.text)

   For stdio-only clients (Zed, Windsurf, n8n, older builds) use the mcp-remote shim. It’s a third-party open source bridge: github.com/geelen/mcp-remote.

   Copy

   Full list of MCP-compatible clients: modelcontextprotocol.io/clients.

3. Authorize

   Your client opens the 100Hires consent screen. Sign in, review the requested scope, click Allow. Tokens are stored on the client; 100Hires never sees its credentials.

4. Verify

   Ask your assistant: “List all open jobs in 100Hires.” If you get a list back — you’re wired up. If not, see FAQ.

5. Next steps

   • Browse all 136 tools
   • Understand OAuth and scopes
   • Review the safety model

Tools

Keep human confirmation on for destructive tools. Feedback: [email protected].

Authentication

OAuth 2.1 with PKCE and Dynamic Client Registration. Hosts onboard themselves — no API keys to copy and paste, no client secrets to leak.

Flow

AI client → GET  /.well-known/oauth-authorization-server   (RFC 8414)
          → POST /oauth/register                            (DCR, RFC 7591)
          → GET  /oauth/authorize  + PKCE                   (consent in 100Hires)
          → POST /oauth/token                               (code → access_token)
          → POST /mcp  Authorization: Bearer <token>

Client identity

Two ways to identify a client are supported: Dynamic Client Registration (RFC 7591) and, where the server metadata advertises client_id_metadata_document_supported, OAuth Client ID Metadata Documents: the client uses the HTTPS URL of its metadata document as client_id, skips registration, and the server fetches the document and matches redirect_uri against it. In both cases an https redirect URI must point at a known AI client host; loopback and native-app redirects are always accepted.

Scopes

A single scope, mcp:full, mirrors the permissions of the authorizing user.

Token lifetime & refresh

• Access tokens expire after 1 hour.
• Refresh tokens are issued automatically; clients refresh transparently.
• Tokens are bound to the authorizing user and revoked when they leave the workspace.

Manage sessions

Settings → Integrations → Connected AI clients lists every active session: client name (from DCR), last used, IP, scope, and a one-click Revoke.

Safety

• Access is controlled by your API key permissions.
• Read operations are always safe.
• Destructive actions (delete, reject) require explicit IDs.
• Rate limiting with automatic retry is built-in.
• API key is never sent to third-party hosts.

Access model

Every token — OAuth or API key — is bound to a single 100Hires user. The MCP server only ever sees data that user could see in the UI; cross-company access is impossible. Sessions are listed under Settings → Integrations → Connected AI clients.

Destructive tools

These tools modify or remove data and always require explicit IDs — assistants cannot batch-delete by query:

• hires_delete_*
• hires_reject_application
• hires_disqualify_candidate
• hires_batch_reject_applications

Best practices

• Don’t hand AI assistants a blanket “delete by filter” permission — keep human confirmation on for destructive tools.
• Use a separate token per client so you can revoke one without disrupting the others.
• Revoke unused sessions on a regular cadence.
• For CI, prefer a restricted API key over a personal token.

FAQ

rm -rf ~/.mcp-auth/100hires