
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@aicandidatehub/mcp
Advanced tools
MCP server for aicandidatehub.com — profile, jobs, CV, compensation tools for AI agents.
An MCP server for CandidateHub — providing AI agents with tools to manage profiles, resumes, jobs, and compensation data.
No Node, no npm, no config file — Claude Desktop ships its own runtime:
aicandidatehub-mcp-latest.mcpb, ~3.5MB, always the latest release)Prefer npx / another MCP client? See the setups below.
# 1. Mint a Personal Access Token (format chmcp_…) at:
# https://www.aicandidatehub.com/account/mcp-tokens
export CANDIDATEHUB_TOKEN=chmcp_your_token_here
# 2. Run the server (no install needed):
npx -y @aicandidatehub/mcp
Then point your MCP client at it — see the client-specific setups below.
~/Library/Application Support/Claude/claude_desktop_config.json:{
"mcpServers": {
"aicandidatehub": {
"command": "npx",
"args": ["-y", "@aicandidatehub/mcp"],
"env": {
"CANDIDATEHUB_TOKEN": "chmcp_your_token_here"
}
}
}
}
export CANDIDATEHUB_TOKEN=chmcp_your_token_here
npx @aicandidatehub/mcp
~/.cursor/mcp_config.json:{
"mcpServers": {
"aicandidatehub": {
"command": "npx",
"args": ["-y", "@aicandidatehub/mcp"],
"env": {
"CANDIDATEHUB_TOKEN": "chmcp_your_token_here"
}
}
}
}
{
"servers": {
"aicandidatehub": {
"command": "npx -y @aicandidatehub/mcp",
"env": {
"CANDIDATEHUB_TOKEN": "chmcp_your_token_here"
}
}
}
}
Install and run directly:
npm install -g @aicandidatehub/mcp
export CANDIDATEHUB_TOKEN=chmcp_your_token_here
aicandidatehub-mcp
mcpServers:
aicandidatehub:
command: npx
args:
- '-y'
- '@aicandidatehub/mcp'
env:
CANDIDATEHUB_TOKEN: chmcp_your_token_here
18 tools ship in this package:
get_profile — Fetch your candidate profileimport_resume_from_text — Import a resume from plain textlist_cv_profiles — List your stored CV / profile variantsimport_job_from_url — Import a job posting from a URLlist_jobs — List imported job opportunitiesget_job — Get details of a specific jobtrack_job — Add a job to your application trackerlist_tracked_jobs — List jobs in your application trackerget_tracked_job — Get one tracked job's details and statusanalyze_job_fit — Analyze how well your profile matches a jobrewrite_cv_for_job — Generate a role-customized resume (one file per call; see "Storage & File Output" below)list_generated_cvs — List previously-generated tailored CVsget_cv_download_url — Mint a fresh short download URL for an existing CVgenerate_cover_letter — Generate a tailored cover letteranalyze_compensation_for_job — Analyze compensation for a specific jobget_compensation_for_role — Look up salary benchmarks for a rolesignup_url — Generate a signup linkget_server_info — Report the MCP server version, commit SHA, environment, and tool countrewrite_cv_for_job produces exactly one file per call in the requested export_format (docx default, or pdf). Multi-template / multi-format variants in a single call are intentionally not supported — each variant requires a separate call.
Files are written to the private cv-exports Supabase Storage bucket with this path layout:
cv-exports/<user_id>/<cv_id>/<template>-<YYYYMMDD-HHMMSS>.{docx|pdf}
<user_id> — the auth user that owns the CV<cv_id> — the job_linked_cvs.id of the persisted row<template> — the save-side template (e.g. tech, executive)<YYYYMMDD-HHMMSS> — UTC timestamp at render timeEach call inserts exactly one row in public.cv_short_links (the table that backs the /d/<code> redirect) with the corresponding (cv_id, format) pair.
Legitimate multi-row case. A single cv_id may have more than one row in cv_short_links (and more than one object in cv-exports/<user_id>/<cv_id>/) when:
rewrite_cv_for_job again with a different export_format (e.g. originally docx, later pdf), ORget_cv_download_url after the original short URL expired (re-mint preserves the original format).In both cases, each row still represents one historical export. There is no path that produces multiple files from one call.
The MCP response always carries the most recently minted short URL via data.export.short_url, plus the underlying long signed URL via data.export.url.
CANDIDATEHUB_TOKEN — Your Personal Access Token (required by all API-backed tools). Mint one at https://www.aicandidatehub.com/account/mcp-tokens; it has the form chmcp_…. The server starts and lists its tools without it (get_server_info and signup_url work tokenless); any other tool call without a valid token returns an error pointing you to the mint URL.CANDIDATEHUB_API_BASE — API endpoint (defaults to https://www.aicandidatehub.com). The apex (aicandidatehub.com) is intentionally not the default: Cloudflare 301-redirects apex → www, and 301 drops POST bodies → PAT exchange fails with 405. If you must use the apex, configure Cloudflare to issue 308 (or set this variable explicitly).MCP_CLIENT — Client identifier for tracking (defaults to 'unknown')npm install
npm run build
npm test
npm run test:integration # Requires MCP_INTEGRATION=1 and MCP_TEST_PAT
npm run dev # Watch mode
Proprietary — CandidateHub
FAQs
MCP server for aicandidatehub.com — profile, jobs, CV, compensation tools for AI agents.
We found that @aicandidatehub/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.