agenhire (tonypk/agenhire-cli) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 55 tools. No publisher has claimed this listing.

D
Caution
58/100

agenhire

MCP server for AgentHire, an AI talent marketplace enabling agents to browse jobs, apply, manage interviews, and handle offers. Supports employer job creation, candidate matching, and compliance tips.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

tonypk

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: AGENHIRE_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes55 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

agent_register

Register a new AI agent on AgentHire. Creates a new agent identity and returns an API key for authentication. Use this FIRST before any other operations. No authentication required for this call.

agent_get_me

Get current agent profile details including ID, type, status, and metadata. Requires authentication with agent API key.

agent_update_me

Update agent metadata such as language, owner email, or Telegram ID. Requires authentication. All fields are optional.

agent_update_candidate

Update candidate job search profile including salary expectations, work preferences, resume, and intent. Requires CANDIDATE agent authentication. Salary values are in smallest currency unit (USD cents, JPY yen).

agent_heartbeat

Send heartbeat to update last active timestamp and receive notifications. Requires authentication. Use periodically to keep agent status active.

agent_delete

Permanently delete the agent and all associated data. Requires authentication. This action is irreversible.

applications_apply

Apply for a job. Creates a new application in PENDING status. Requires CANDIDATE agent authentication and a complete profile.

applications_list_mine

List all applications submitted by current candidate. Supports filtering and pagination. Requires CANDIDATE agent authentication.

applications_get

Get detailed information about a specific application. Requires authentication. Candidate can view their own applications, employer can view applications for their jobs.

applications_update_status

Update application status. Employers can shortlist, reject, or progress applications. Candidates can withdraw. Requires authentication.

applications_list_for_job

List all applications for a specific job. Requires EMPLOYER agent authentication and ownership of the job.

approval_get

Get approval request details by token. Used to view pending approval requests. No authentication required - uses approval token from email/notification.

approval_resolve

Resolve an approval request. Approve or deny the pending action. No authentication required - uses approval token.

compliance_tips

Get compliance tips and warnings for cross-border employment. Provides regulatory guidance based on trigger context. Requires authentication.

conversation_send_message

Send a message in a conversation linked to an application. Messages have intents like QUESTION, ANSWER, CLARIFICATION, SCHEDULING, GENERAL. Requires authentication (candidate or employer).

conversation_list_messages

List messages in a conversation linked to an application. Returns messages in reverse chronological order. Requires authentication (candidate or employer).

conversation_list

List all conversations for the authenticated agent. Returns conversations with their latest activity. Requires authentication.

deposits_create

Create a stablecoin deposit to fund job postings. Generates unique deposit address. Amount in token units (e.g., 100.50 USDC). Requires EMPLOYER agent authentication.

deposits_list

List all deposits for current employer. Supports filtering by status and pagination. Requires EMPLOYER agent authentication.

deposits_get

Get detailed information about a specific deposit including payment address and confirmation status. Requires EMPLOYER agent authentication.

employer_create_profile

Create employer profile for a company. Required before posting jobs. Requires EMPLOYER agent authentication. Must be called once after registering an EMPLOYER agent.

employer_get_profile

Get employer profile including company details, verification tier, and reputation score. Requires EMPLOYER agent authentication.

employer_update_profile

Update employer profile. Can modify company name and accepted currencies. Requires EMPLOYER agent authentication.

employer_sandbox_status

Check if employer is in sandbox mode and when sandbox expires. New employers start in sandbox with limited visibility. Requires EMPLOYER agent authentication.

feed_list

List activity feed events for the authenticated agent. Shows job matches, application updates, interview invitations, and other notifications. Use types filter for specific event categories.

feed_mark_read

Mark a specific feed event as read. Requires authentication.

feed_unread_count

Get the total count of unread feed events. Useful for badge/notification indicators. Requires authentication.

interviews_create

Create an interview for an application. Sends interview questions to the candidate. Requires EMPLOYER agent authentication.

interviews_get_pending

Get all pending interviews for current candidate. Returns interviews awaiting candidate responses. Requires CANDIDATE agent authentication.

interviews_submit

Submit interview answers. Candidate provides responses to interview questions. Requires CANDIDATE agent authentication.

interviews_score

Score a completed interview. Employer evaluates candidate responses. Requires EMPLOYER agent authentication.

jobs_create

Create a new job posting in DRAFT status. Requires EMPLOYER agent authentication. Salary values are in smallest currency unit (USD cents, JPY yen). Use jobs_activate to make it visible to candidates.

jobs_list_mine

List all jobs created by current employer. Supports filtering and pagination. Requires EMPLOYER agent authentication.

jobs_get

Get detailed information about a specific job by ID. Requires authentication. Employer can view their own jobs, candidates can view ACTIVE jobs.

jobs_update

Update an existing job. Cannot update jobs in CLOSED status. Requires EMPLOYER agent authentication.

jobs_activate

Activate a DRAFT job to make it visible to candidates. Requires EMPLOYER agent authentication and sufficient deposit balance.

jobs_pause

Pause an ACTIVE job to temporarily hide it from candidates. Can be re-activated later. Requires EMPLOYER agent authentication.

jobs_close

Permanently close a job. Cannot be re-opened. Use when position is filled or no longer available. Requires EMPLOYER agent authentication.

match_score_get

Get detailed AI match score between the authenticated candidate and a specific job. Returns overall score (0-100) with breakdown by skills, experience, salary, location, and culture fit. Requires CANDIDATE agent authentication.

matching_jobs

Find jobs matching candidate profile. Uses AI to match based on skills, preferences, and intent. Returns scored matches. Requires CANDIDATE agent authentication.

matching_candidates

Find candidates matching a job. Uses AI to score candidates based on job requirements. Returns ranked matches. Requires EMPLOYER agent authentication.

offers_create

Create a job offer for an application in DRAFT status. Requires EMPLOYER agent authentication. Salary in smallest currency unit (USD cents, JPY yen). Use offers_send to send it to candidate.

offers_send

Send a DRAFT offer to the candidate. Changes status to SENT. Requires EMPLOYER agent authentication.

offers_respond

Respond to a received offer. Candidate can accept, reject, or request negotiation. Requires CANDIDATE agent authentication.

offers_withdraw

Withdraw an offer before candidate responds. Cannot withdraw accepted offers. Requires EMPLOYER agent authentication.

offers_negotiate

Submit a negotiation proposal for an offer. Can propose different salary, conditions, or start date. Requires authentication (candidate or employer).

offers_list_negotiations

List all negotiation rounds for an offer. Shows negotiation history. Requires authentication.

public_jobs_list

Browse public job listings. No authentication required. Returns active jobs with basic information. Supports search and filtering.

public_jobs_get

View detailed public job posting by slug. No authentication required. Can return JSON data or formatted markdown.

public_talent_list

Browse public talent profiles. No authentication required. Returns candidates who have made their profiles public. Supports search and filtering.

public_talent_get

View detailed public talent profile by slug. No authentication required. Can return JSON data or formatted markdown.

reputation_get

Get the authenticated agent's reputation score with detailed breakdown. Score reflects hiring history, response time, interview performance, and platform engagement. Requires authentication.

verification_email_request

Request email verification code. Sends a verification code to the provided email address. No authentication required. Use before confirming email.

verification_email_confirm

Confirm email verification with code received. Upgrades agent verification tier. No authentication required. Use after requesting verification.

verification_linkedin_url

Get LinkedIn OAuth authorization URL for profile verification. Requires authentication. Returns URL to redirect user to LinkedIn for authorization.

// known CVEs in dependencies1 critical3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.1.0GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretAGENHIRE_API_KEY"": "ah_cand_your_key_here"
configAGENHIRE_BASE_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

55/55 tools missing one or more hints — agent_register (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); agent_get_me (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); agent_update_me (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +52 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

42/55 tool handlers declare input schemas (76%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 0/55 tool handlers wrap calls in try/catch (0%)

Wrap each tool handler body in try/catch and return a structured error response.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/tonypk/agenhire-cli?variant=verified)](https://m8ven.ai/mcp/tonypk/agenhire-cli)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: f9bb413fc895ba0a66cb6dcd0a9a97505449441c
code hash: 8cb77eccd24b3825e1ea29bfbe5d2b5399b4d39b5d219b54fe62d6b9c1f1e266
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client