The TrueCalling MCP server
TrueCalling ships a Model Context Protocol server, so an AI assistant can work inside your recruiting workspace instead of beside it. Connect Claude, Microsoft Copilot Studio or any MCP-compatible client, and ask in plain language for the work you would otherwise click through. The server acts as you, with the same access your own account has.
At a glance
- Server URL
- https://mcp.truecalling.ai/mcp — the MCP endpoint answers POST.
- Transport
- Streamable HTTP for remote clients. A local stdio build also exists for desktop clients.
- Tools
- 58 in total. 55 over HTTP: the three sign-in tools are not exposed when you authenticate with a key.
- Authentication
- A personal key (tcmcp_…) sent as an x-api-key header, or OAuth for clients that cannot send custom headers.
- Where the key comes from
- The TrueCalling app: Settings → Integrations → MCP keys → Generate a key.
- Local install prerequisites
- Node.js 22+ and git. Nothing to build, no .env to fill in.
- Version
- Server 0.3.0, MIT licence.
What is MCP?
The Model Context Protocol is an open standard for connecting AI assistants to the systems where work actually happens. An MCP server publishes a list of tools, each one a named action with a described set of inputs. A client — the assistant you already use — reads that list and calls the tools it needs to answer you.
The point is that the integration is written once and works everywhere. The TrueCalling MCP server describes what a recruiter can do in TrueCalling; any client that speaks the protocol can then do it. There is no plugin to maintain per assistant, and no copy of your data living somewhere else: the tools read and write the same records the web app does.
What you can do
The server exposes 58 tools. A short prompt usually chains several of them; here is the ground they cover.
- Search and score candidates against one of your job descriptions, then get the reasoning behind each score in plain language.
- Source new profiles from LinkedIn and people-search providers, and add the ones worth keeping to the right role's pipeline.
- Find a missing email address or phone number for a candidate, or enrich a whole shortlist in a single sweep.
- Draft outreach copy and interview questions for a specific role, then send a WhatsApp follow-up from the same conversation.
- Create, update, publish or unpublish job descriptions, and turn a raw job posting into a structured one.
- Assign a psychometric test, read the submission back, and generate a candidate PDF report for the hiring manager.
Tool catalog
All 58 tools, by domain. The three sign-in tools apply to the local install only: over HTTP your key is the credential, so they are not registered and 55 tools are exposed.
- Candidates (13)
- list_candidates · get_candidate · create_candidate · create_candidates_bulk · update_candidate · update_candidate_status · delete_candidate · score_candidate · enrich_candidate · upload_cv · extract_cv · parse_cv_file · lookup_linkedin_profile
- Jobs (8)
- list_jds · get_jd · create_jd · update_jd · publish_jd · unpublish_jd · parse_job_text · expand_job_title
- Sourcing & search (6)
- search_jd_candidates · fullenrich_search · fullenrich_enrich_linkedin · fullenrich_poll · search_candidates_pdl · find_recruiter
- Emily / WhatsApp (7)
- emily_chat · emily_analyze · emily_score_screening · send_whatsapp · list_whatsapp_messages · list_wa_contacts · generate_writer
- Analysis & generation (4)
- generate_interview_questions · analyze_cv_standalone · generate_score_explanation · interpret_psychometric
- Assessments (4)
- create_psy_assignment · list_psy_items · get_psy_submission · psy_score
- Reports (3)
- generate_candidate_pdf · generate_cv · send_candidate_report
- Batch (4)
- sweep_enrich_candidates · recalculate_scores · compare_jd_candidate · match_internal_jds
- Scheduling (3)
- list_interview_slots · propose_interview_slots · approve_interview_slot
- Enterprise (3)
- get_my_enterprise · list_team_members · get_enterprise_config
- Auth (local install only) (3)
- tc_login · tc_logout · tc_auth_status
Getting started
You need a TrueCalling account and an MCP-compatible client. That is the whole prerequisite list for the hosted server: nothing to install, nothing to build.
Create your key in the app
Open the TrueCalling app and go to Settings → Integrations → MCP keys → Generate a key. Name it after the assistant you are connecting, so you can tell your keys apart later.
The key is drawn in your browser and shown once. Copy it straight into your client and store it like a password: only its hash reaches our database, so nobody, including us, can display it to you again.
The same panel lists your keys with their creation date, last use and status, and revokes any of them in one click.
Point your client at the server
Every client asks for the same three things: the server URL, the transport, and the header carrying your key.
{
"url": "https://mcp.truecalling.ai/mcp",
"transport": "streamable-http",
"headers": {
"x-api-key": "tcmcp_..."
}
}Field names differ from one client to the next; the values do not. The endpoint answers POST and rejects unauthenticated calls.
Claude Code
One command, identical on macOS, Linux and Windows. Replace the placeholder with the key you just generated.
claude mcp add truecalling-remote --transport http https://mcp.truecalling.ai/mcp --header "x-api-key: <your key>"Microsoft Copilot Studio
In your agent, go to Tools → Add a tool → New tool → Model Context Protocol, enter the server URL above, and choose API key authentication with the header x-api-key. Each person pastes their own key into their own connection, so a single shared agent still gives every recruiter their own data.
Clients that cannot send a custom header
Some clients, ChatGPT among them, only support OAuth. The server also implements the MCP OAuth resource-server flow and publishes its discovery metadata, so those clients register themselves and send you through a normal TrueCalling sign-in instead of asking for a key. Talk to us before wiring one up and we will confirm the current state of that path.
Local install
A local build exists that runs the server on your own machine over stdio, for desktop clients. It needs Node.js 22+ and git, and nothing else: no npm install, no build step and no environment file, because the server ships as a self-contained bundle. It is distributed on request while the repository is private, so ask us and we will send you the installer.
An assistant that acts on your behalf, not above you
Handing an AI assistant a key to your recruiting data is a real decision. Here is what the server does about it, feature by feature.
The server acts as you, never above you
Your key is exchanged for a short-lived token that belongs to your own account. Every call is then made as that user, and the database's row-level security decides what the call is allowed to read or write.
No privileged key ships with the server
The only credential built into the server is the public API key. There is no service key inside it, so there is no path where the server reads your data with more rights than you have.
Your key is generated in your browser
The app draws 32 random bytes with the browser's Web Crypto API and shows you the result once. Only its SHA-256 hash and a 12-character prefix are ever sent to the database.
Revoke in one click
Revoking a key blocks any new exchange straight away and cuts off sessions already running within five minutes, the lifetime of the cached token. The app tells you the same thing before you confirm.
One key does not have to mean every tool
A key can be restricted to a list of tools. The filter is applied when the server is built, so a tool left out never appears in the client's tool list and cannot be called at all.
Sign-in tools are not exposed remotely
When you authenticate with a key, the three sign-in tools are not registered. The key is the credential; nothing in the session can be used to log in as somebody else.
Destructive actions need two calls
Deletions, sends and exports are gated by the server itself: the first call returns a preview and a single-use token, and nothing happens until the same call is repeated with that token. Deleting a candidate is a reversible soft-delete.
Outside text is fenced before the model sees it
CVs, LinkedIn profiles, search results and WhatsApp message bodies are wrapped in an explicit untrusted-content marker, so instructions hidden inside a document are not read as instructions by the assistant.
Writes leave a trail
Every successful write appends a row — the tool name and the record it touched — to an append-only audit table that only you can read.
Requests are bounded
Sixty requests per minute per key, failed sign-in attempts throttled per IP address, request bodies capped at 4 MB, and timeouts on headers, bodies and requests.
Put your assistant to work on your pipeline.
Generate a key in your settings and connect your client, or let us walk you through it on a 20-minute call with one of your open roles on screen.