Connect AI Tools (MCP)
HiringCenter MCP Server
Connect HiringCenter to Claude, ChatGPT, Cursor, and other AI tools that support the Model Context Protocol (MCP). Once you connect, you can ask your AI tool to find prospects, add notes and tasks, schedule meetings, and record texts, emails, and calls you had outside HiringCenter, all in your own account.
Server URL
Code
You sign in with your HiringCenter login (OAuth). There is no API key to copy.
Who Can Connect
Everyone except View Only users can connect an AI tool: owners, admins, managers, and users. The AI tool gets your permissions, so it can only see and change what you can in HiringCenter.
Connect Your AI Tool
Every tool follows the same steps: add a custom connector or MCP server with the server URL above, then sign in when the tool opens HiringCenter.
Claude
- In Claude, open Connectors (under Settings or Customize, depending on your version) and choose Add custom connector.
- Name it HiringCenter and paste the server URL.
- Click Connect. HiringCenter opens. Sign in, choose the account, and click Allow.
Claude Code
Code
Then run /mcp in Claude Code and choose hiringcenter to sign in.
ChatGPT
- Turn on Developer mode in ChatGPT's settings (under Apps & Connectors → Advanced on most plans; on a work plan, your workspace admin may need to allow custom connectors first).
- Create a connector with the server URL and OAuth authentication.
- ChatGPT opens HiringCenter. Sign in, choose the account, and click Allow.
Cursor
Add this to .cursor/mcp.json (or ~/.cursor/mcp.json for every project). Cursor signs you in when you first use it:
Code
VS Code
Add this to .vscode/mcp.json, then choose Start on the server to sign in:
Code
Other MCP clients
Add a remote (Streamable HTTP) server with the URL. Clients that support MCP OAuth sign you in automatically.
What Happens When You Connect
- Your AI tool sends you to HiringCenter. Sign in if you are not already signed in.
- The consent screen shows which tool is asking. Choose the account to connect (accounts where you are View Only can't be chosen).
- Click Allow. HiringCenter creates an API key in that account named after you, for example
Jamie Lee (Claude), and gives it to your AI tool. You never see or copy it.
Keys made in Settings are tied only to the account. This key is scoped to you as well, so it acts as you:
- Everything the AI tool creates or changes is credited to you, the same as if you did it in the app. No request needs a user ID.
- Texts, emails, and calls it logs go in your own Manual Log thread with that prospect.
- It has your permissions, the same rules as the app:
- Managers and users see and change only the prospects they own or that are in their offices, and the notes, tasks, meetings, and hires on those prospects. Anything else looks like it doesn't exist.
- Nobody can edit or delete another person's notes, tasks, meetings, or hires unless the app would let them.
- It reaches only the endpoints the AI tool's actions use (listed below), whatever your role. Bulk changes, merges, conversations, messages, webhooks, and AI suggestions are off for it.
- It can read and write data, but not manage API keys: like every API key, it can see, rename, rotate, or delete only its own key, never anyone else's, and it can't create keys.
- It stops working right away if you are removed from the account or changed to View Only.
What the AI Tool Can Do
| Tool | What it does |
|---|---|
get_account | The account's users, stages, pipelines, offices, sources, labels, and time zone |
search_prospects | Find prospects by name, email, phone, title, company, stage, owner, office, source, label, or date added |
get_prospect_overview | Catch up on one person in one call: details, notes, tasks, meetings, stage history, recent texts, emails, and calls, drafts waiting, and the sequences they are in. See GET /prospects/{prospectId}/context |
get_prospect | One prospect's record |
my_agenda | Your open tasks (overdue marked), meetings, drafts waiting, and scheduled messages for today, this week, or the next 7 days. See GET /agenda |
create_prospect | Add a prospect. If someone already has that email or phone, it tells you who and changes nothing |
update_prospect | Change fields, move stages, add or remove labels, or opt someone out of texts, emails, or calls |
add_note, list_notes | Notes on a prospect |
log_activity | Log a text, email, or call that already happened outside HiringCenter, inbound or outbound. It goes in your own Manual Log thread with the prospect. See POST /activities |
log_call | Log a call and what came out of it in one step: the call, a note, up to 3 follow-up tasks, and a meeting |
draft_message | Write a text or email and leave it as a draft in HiringCenter for you (or anyone in that conversation) to review and send. See POST /prospects/{prospectId}/drafts |
create_task, list_tasks, complete_task | Follow-up tasks |
create_meeting, list_meetings | Meetings on the HiringCenter calendar |
The AI tool cannot send texts or emails. draft_message leaves a draft that a person sends from HiringCenter, and log_activity and log_call only record what already happened.
It asks before anything reaches a prospect. Adding a prospect, moving a stage, or adding a label can start one of your account's automations or sequences, which do text or email the prospect. When that would happen, HiringCenter refuses the change and tells the AI tool which automations or sequences would run, and the tool asks you before trying again with your approval.
It can opt people out, never back in. Only a person in HiringCenter can turn texts, emails, or calls back on for someone who opted out.
Each tool calls the HiringCenter API, so the same rules, validation, and rate limits apply. Every change it makes is safe to retry: a repeated request never creates a second note, task, meeting, or prospect.
Example requests
- "Catch me up on Avery Coleman."
- "What's on my plate today?"
- "Log that I called Jordan Miller. He wants a demo next Tuesday at 2pm, and remind me to send the deck tomorrow."
- "Draft a text to Avery confirming Thursday at 2."
- "I just texted Jordan Miller from my phone: 'Are you free Thursday at 2?' Log it in HiringCenter."
- "Move Avery to Interviewing and tag her Hot."
Disconnect
- Remove the connector in your AI tool, or
- In HiringCenter, an admin or owner can open Settings → API / Webhooks and mark the key named after you (for example
Jamie Lee (Claude), labeled MCP) inactive. The AI tool loses access at once.
Every connection in the account shows on that tab, so admins can see and turn off any of them. These keys can't be rotated. Connecting again creates a new key.
Only Your Own Connection Works
The MCP server accepts only the key HiringCenter creates when you connect through sign-in. API keys made in Settings are for the REST API; sent to https://api.hiringcenterpro.com/mcp they get 401.
Technical Details
For MCP client developers:
- Transport: Streamable HTTP at
https://api.hiringcenterpro.com/mcp. The server is stateless: send JSON-RPC withPOST. It returns JSON, not SSE, and issues no session ID.GETandDELETEreturn401without a token, otherwise405. - Discovery: an unauthenticated request returns
401withWWW-Authenticate: Bearer resource_metadata="https://api.hiringcenterpro.com/.well-known/oauth-protected-resource/mcp".- Protected resource metadata (RFC 9728):
/.well-known/oauth-protected-resource/mcp - Authorization server metadata (RFC 8414):
/.well-known/oauth-authorization-server
- Protected resource metadata (RFC 9728):
- OAuth 2.1: authorization code with PKCE (S256 required), dynamic client registration (RFC 7591) at
/oauth/register, token endpoint/oauth/token, revocation (RFC 7009) at/oauth/revoke. The scope ishiringcenter. - Redirect URIs:
https://,http://onlocalhost,127.0.0.1, or[::1], or an app's own scheme (for examplecursor://...). The URI must match the registered one exactly. - Tokens: the access token is a HiringCenter API key (
hc_...). It has no expiry and there is no refresh token. It lasts until it is revoked, marked inactive, or the person loses access. An authorization code is single-use and expires after 5 minutes. A code presented twice disables the key it issued.

