agenhire (tonypk/agenhire-cli) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 55 tools. No publisher has claimed this listing.
MCP server for AgentHire, an AI talent marketplace enabling agents to browse jobs, apply, manage interviews, and handle offers. Supports employer job creation, candidate matching, and compliance tips.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
tonypk
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
agent_registerRegister a new AI agent on AgentHire. Creates a new agent identity and returns an API key for authentication. Use this FIRST before any other operations. No authentication required for this call.
agent_get_meGet current agent profile details including ID, type, status, and metadata. Requires authentication with agent API key.
agent_update_meUpdate agent metadata such as language, owner email, or Telegram ID. Requires authentication. All fields are optional.
agent_update_candidateUpdate candidate job search profile including salary expectations, work preferences, resume, and intent. Requires CANDIDATE agent authentication. Salary values are in smallest currency unit (USD cents, JPY yen).
agent_heartbeatSend heartbeat to update last active timestamp and receive notifications. Requires authentication. Use periodically to keep agent status active.
agent_deletePermanently delete the agent and all associated data. Requires authentication. This action is irreversible.
applications_applyApply for a job. Creates a new application in PENDING status. Requires CANDIDATE agent authentication and a complete profile.
applications_list_mineList all applications submitted by current candidate. Supports filtering and pagination. Requires CANDIDATE agent authentication.
applications_getGet detailed information about a specific application. Requires authentication. Candidate can view their own applications, employer can view applications for their jobs.
applications_update_statusUpdate application status. Employers can shortlist, reject, or progress applications. Candidates can withdraw. Requires authentication.
applications_list_for_jobList all applications for a specific job. Requires EMPLOYER agent authentication and ownership of the job.
approval_getGet approval request details by token. Used to view pending approval requests. No authentication required - uses approval token from email/notification.
approval_resolveResolve an approval request. Approve or deny the pending action. No authentication required - uses approval token.
compliance_tipsGet compliance tips and warnings for cross-border employment. Provides regulatory guidance based on trigger context. Requires authentication.
conversation_send_messageSend a message in a conversation linked to an application. Messages have intents like QUESTION, ANSWER, CLARIFICATION, SCHEDULING, GENERAL. Requires authentication (candidate or employer).
conversation_list_messagesList messages in a conversation linked to an application. Returns messages in reverse chronological order. Requires authentication (candidate or employer).
conversation_listList all conversations for the authenticated agent. Returns conversations with their latest activity. Requires authentication.
deposits_createCreate a stablecoin deposit to fund job postings. Generates unique deposit address. Amount in token units (e.g., 100.50 USDC). Requires EMPLOYER agent authentication.
deposits_listList all deposits for current employer. Supports filtering by status and pagination. Requires EMPLOYER agent authentication.
deposits_getGet detailed information about a specific deposit including payment address and confirmation status. Requires EMPLOYER agent authentication.
employer_create_profileCreate employer profile for a company. Required before posting jobs. Requires EMPLOYER agent authentication. Must be called once after registering an EMPLOYER agent.
employer_get_profileGet employer profile including company details, verification tier, and reputation score. Requires EMPLOYER agent authentication.
employer_update_profileUpdate employer profile. Can modify company name and accepted currencies. Requires EMPLOYER agent authentication.
employer_sandbox_statusCheck if employer is in sandbox mode and when sandbox expires. New employers start in sandbox with limited visibility. Requires EMPLOYER agent authentication.
feed_listList activity feed events for the authenticated agent. Shows job matches, application updates, interview invitations, and other notifications. Use types filter for specific event categories.
feed_mark_readMark a specific feed event as read. Requires authentication.
feed_unread_countGet the total count of unread feed events. Useful for badge/notification indicators. Requires authentication.
interviews_createCreate an interview for an application. Sends interview questions to the candidate. Requires EMPLOYER agent authentication.
interviews_get_pendingGet all pending interviews for current candidate. Returns interviews awaiting candidate responses. Requires CANDIDATE agent authentication.
interviews_submitSubmit interview answers. Candidate provides responses to interview questions. Requires CANDIDATE agent authentication.
interviews_scoreScore a completed interview. Employer evaluates candidate responses. Requires EMPLOYER agent authentication.
jobs_createCreate a new job posting in DRAFT status. Requires EMPLOYER agent authentication. Salary values are in smallest currency unit (USD cents, JPY yen). Use jobs_activate to make it visible to candidates.
jobs_list_mineList all jobs created by current employer. Supports filtering and pagination. Requires EMPLOYER agent authentication.
jobs_getGet detailed information about a specific job by ID. Requires authentication. Employer can view their own jobs, candidates can view ACTIVE jobs.
jobs_updateUpdate an existing job. Cannot update jobs in CLOSED status. Requires EMPLOYER agent authentication.
jobs_activateActivate a DRAFT job to make it visible to candidates. Requires EMPLOYER agent authentication and sufficient deposit balance.
jobs_pausePause an ACTIVE job to temporarily hide it from candidates. Can be re-activated later. Requires EMPLOYER agent authentication.
jobs_closePermanently close a job. Cannot be re-opened. Use when position is filled or no longer available. Requires EMPLOYER agent authentication.
match_score_getGet detailed AI match score between the authenticated candidate and a specific job. Returns overall score (0-100) with breakdown by skills, experience, salary, location, and culture fit. Requires CANDIDATE agent authentication.
matching_jobsFind jobs matching candidate profile. Uses AI to match based on skills, preferences, and intent. Returns scored matches. Requires CANDIDATE agent authentication.
matching_candidatesFind candidates matching a job. Uses AI to score candidates based on job requirements. Returns ranked matches. Requires EMPLOYER agent authentication.
offers_createCreate a job offer for an application in DRAFT status. Requires EMPLOYER agent authentication. Salary in smallest currency unit (USD cents, JPY yen). Use offers_send to send it to candidate.
offers_sendSend a DRAFT offer to the candidate. Changes status to SENT. Requires EMPLOYER agent authentication.
offers_respondRespond to a received offer. Candidate can accept, reject, or request negotiation. Requires CANDIDATE agent authentication.
offers_withdrawWithdraw an offer before candidate responds. Cannot withdraw accepted offers. Requires EMPLOYER agent authentication.
offers_negotiateSubmit a negotiation proposal for an offer. Can propose different salary, conditions, or start date. Requires authentication (candidate or employer).
offers_list_negotiationsList all negotiation rounds for an offer. Shows negotiation history. Requires authentication.
public_jobs_listBrowse public job listings. No authentication required. Returns active jobs with basic information. Supports search and filtering.
public_jobs_getView detailed public job posting by slug. No authentication required. Can return JSON data or formatted markdown.
public_talent_listBrowse public talent profiles. No authentication required. Returns candidates who have made their profiles public. Supports search and filtering.
public_talent_getView detailed public talent profile by slug. No authentication required. Can return JSON data or formatted markdown.
reputation_getGet the authenticated agent's reputation score with detailed breakdown. Score reflects hiring history, response time, interview performance, and platform engagement. Requires authentication.
verification_email_requestRequest email verification code. Sends a verification code to the provided email address. No authentication required. Use before confirming email.
verification_email_confirmConfirm email verification with code received. Upgrades agent verification tier. No authentication required. Use after requesting verification.
verification_linkedin_urlGet LinkedIn OAuth authorization URL for profile verification. Requires authentication. Returns URL to redirect user to LinkedIn for authorization.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
AGENHIRE_API_KEY"": "ah_cand_your_key_here"AGENHIRE_BASE_URLTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
55/55 tools missing one or more hints — agent_register (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); agent_get_me (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); agent_update_me (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +52 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
42/55 tool handlers declare input schemas (76%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 0/55 tool handlers wrap calls in try/catch (0%)
Wrap each tool handler body in try/catch and return a structured error response.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tonypk/agenhire-cli)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check