Tool Reviews

The Best MCP Servers and AI Agent Connectors for Recruitment Agencies (2026)

An honest roundup of MCP servers for recruiters in 2026: Recruiterflow, HubSpot, Bullhorn (via third parties), Google Workspace, Slack, Calendly, Zapier and n8n. What each lets Claude or ChatGPT read and write, how mature it is, and the security risks to settle first.

TB Team Boilr

· November 8, 2026 · 14 min read

Abstract dark liquid-metal ribbons flowing and interlocking with emerald highlights in onyx and racing green

TL;DR

MCP (Model Context Protocol) is the plug standard that lets an AI assistant such as Claude or ChatGPT read from and act in your business systems. For recruiters, the useful question is not "which server is best" but "which of my systems has a maintained connector, and do I want the AI to only read or also write?" The picture in November 2026 is uneven. Recruiterflow offers an official, read-only connector for Claude, ChatGPT and Copilot [1] [2]. HubSpot runs an official remote server that can read and write records [3]. Bullhorn, the biggest staffing CRM, has no official MCP server that we could find; what exists is community code and a commercial StackOne connector [5] [6] [7]. Google, Calendly and Slack host their own servers for the mailbox, calendar and team chat [9] [11], and Zapier and n8n act as bridges to everything else [12] [13]. The recurring risk is the same everywhere: a connector with write access can change client and candidate records on the strength of text the model read, so start read-only and keep a human on every send [15]. boilr is one honest option, but it is not an MCP server: it is an AI sales employee that pushes finished records into Recruiterflow and HubSpot and drafts email into Gmail or Outlook [16].

What MCP Means for a Recruitment Agency

Without MCP, asking Claude "which of my clients have open roles and no contact in 30 days?" means exporting a CSV and pasting it in. With an MCP connector, the assistant queries your system directly, using the permissions of the user who signed in. That is useful and also the source of every risk below.

Read connectors - the assistant looks things up: pipeline, placements, notes, calendar slots. Low risk, high value for reporting.
Write connectors - the assistant creates or edits records, drafts emails, books meetings. This is where mistakes get expensive.
Bridges - a platform (Zapier, n8n, StackOne) that exposes many apps through one MCP endpoint, so you do not need one server per tool.
Hosted versus self-run - vendor-hosted servers sign you in with OAuth. Community servers usually want API credentials in a config file on your machine.

The categories at a glance

Layer	Examples	Typical use	Main risk
ATS and CRM	Recruiterflow, HubSpot, Bullhorn (third party)	Pipeline questions, record updates	Wrong writes to client data
Mailbox and calendar	Google Workspace, Calendly	Drafts, scheduling	Sending or booking in your name
Team chat	Slack	Search and summarise channels	Exposing internal conversation
Bridges	Zapier, n8n, StackOne	Reach apps with no native server	Broad reach, hard to audit

The Servers, Honestly Reviewed

Details come from vendor documentation checked in November 2026. Where a vendor page did not state a limit, price or permission, we say so. This area changes monthly, so confirm on the vendor page before you connect anything.

1. Recruiterflow MCP (official, read-only)

What it does - lets Claude query your Recruiterflow account: candidates and their pipeline stage, client contacts with notes and emails, jobs, stage-by-stage job pipelines, candidate activity, attached files, and placement and revenue data such as bill rate, margin and commission [1].
Write access - none. Recruiterflow describes it as a reporting layer, not an editing one, and says Claude cannot create, edit, delete or merge records [1].
Setup and auth - a custom connector in Claude pointing at Recruiterflow's remote MCP URL, signed in with OAuth 2.1. It needs a Claude Pro, Team or Enterprise plan, and Claude only sees what your Recruiterflow role permits [1]. Help-centre guides also exist for ChatGPT and Microsoft Copilot [2].
Good for - a desk lead asking "what is our margin on contract placements this quarter?" or "which jobs have no submissions in 10 days?"
Watch out for - revenue data is visible to the assistant if your role can see it, so connect with a suitably scoped user. Jobs cannot be filtered directly by open or closed status [1].

2. HubSpot MCP (official, read and write)

What it does - HubSpot hosts a remote server that lets an agent read, write and update contacts, companies, deals and tickets. HubSpot's own connectors for Claude, Copilot, Gemini and ChatGPT run on it [3].
Limits reported - a third-party review says the connectors support view, create and update but no deletes, write ten records at a time, and in ChatGPT do not apply custom validation rules such as pipeline stage checks [4]. Treat these as secondary reporting and check HubSpot's current documentation.
Permissions - access uses OAuth, and scopes decide what the connected app can do [3]. A third-party write-up says ChatGPT needs a Super Admin to approve the connector [4].
Good for - agencies that run BD in HubSpot: summarising pipeline, cleaning up lists, turning call notes into record updates.
Watch out for - the "validation rules not applied" point matters for an agency with strict stage definitions. A bulk update from a chat can bypass the discipline your admin built.

3. Bullhorn (no official server found; community and commercial options)

What we could verify - we found no Bullhorn-published MCP server. The options are community projects, such as a Python server for querying Bullhorn data in natural language and a Node.js server under the MIT licence, both using Bullhorn's REST API and your OAuth credentials [6] [7]. Both are described as unofficial.
Commercial route - StackOne sells a hosted Bullhorn MCP server covering candidates, client contacts, job orders, placements, notes, tasks and more. Its page says agents can read, write and delete, that you can restrict which actions an agent may use, and that credentials never reach the model [5]. It lists no pricing on that page, and its own action counts do not add up exactly, so ask for the current list.
Good for - a technical agency that already has a Bullhorn API user and someone to maintain the connection.
Watch out for - a roundup flags community Bullhorn code as a maintenance risk [8], and "delete" access to a placement database is not something to hand an assistant casually. Ask your Bullhorn account manager what they officially support before building on it.

4. Google Workspace MCP servers (official, in Preview)

What it does - Google documents separate hosted MCP servers for Gmail, Drive, Calendar, Chat and People. You enable them in a Google Cloud project and grant OAuth scopes, with separate read and write scopes per product [9].
Reported capabilities - per third-party directories, Gmail covers searching and reading threads, listing drafts, creating drafts and applying labels, and Calendar covers listing, creating and updating events [9]. Check Google's guide for the current tool list.
Maturity - Preview. Google's guide covers Claude, and Claude plans with custom connectors need an OAuth client ID and secret [9]. Setup is a job for whoever administers your Workspace.
Alternative - a community Google Workspace server and a community Outlook server exist [8]. Run community servers only if you are comfortable reviewing the code, since they hold your mailbox tokens.
Good for - "find the last thread with this hiring manager and draft a follow-up" style requests. Prefer scopes that only create drafts, so a human still presses send.

5. Calendly MCP (official)

What it does - Calendly hosts the server. It lets an assistant list event types, find open slots, get scheduling links, and book or cancel events [11].
Auth - OAuth 2.1 with dynamic client registration and separate scheduling read and write scopes. Personal access tokens and clients that need a console-issued client secret are not supported [11].
Good for - sending a client a booking link inside a conversation, or checking when your next candidate-call slot is free.
Watch out for - the page states no plan requirements, so confirm against your Calendly plan. Cancel and book are write actions; keep them approval-gated.

6. Slack MCP (official hosted server, plus community options)

What it does - third-party listings describe an official Slack server covering channels, threads, search and canvases, but not direct messages [10]. We could not open Slack's own documentation, so treat that scope as unconfirmed.
Community alternative - a community Slack server adds message search and user tools [8], typically with a token you generate yourself.
Good for - "summarise what the 360 desk said about Acme this week" before a client call.
Watch out for - channels contain candidate gossip and fee discussions. Limit which channels the connecting user can see.

7. Zapier MCP and n8n (bridges)

Zapier MCP - exposes actions in thousands of apps to Claude, ChatGPT, Cursor and other clients through one endpoint, with credentials managed by Zapier [12]. Pricing figures differ across third-party pages, including how many tasks each tool call uses, so read Zapier's own pricing page before committing. MCP is request-driven, so anything that must start on its own still needs a normal Zap.
n8n MCP Server Trigger - a node that exposes your n8n workflows' tool nodes to an MCP client over SSE or streamable HTTP [13]. You can self-host, which helps with data location, but you build and maintain the workflows.
Good for - reaching a system with no native server, for example an ATS that only has a webhook or a niche job board.
Watch out for - bridges widen reach. Every extra action you expose is one more thing a bad instruction could trigger.

8. Other ATS servers worth knowing about

Workable, Greenhouse, Manatal - a roundup lists these as official, with Greenhouse rolling out from June 2026 and Manatal requiring its Enterprise Plus plan [8]. That roundup is written by a vendor that appears in its own list, so verify each entry.
Ashby, Lever, Crelate, CATS - listed as third-party implementations, some with maintenance risk [8].
SmartRecruiters - its documentation states the MCP server is not supported for the Public API [14], a good example of why you check scope before planning around a connector.
LinkedIn scraping servers - the same roundup notes one popular community LinkedIn server uses browser automation and breaches LinkedIn's Terms of Service [8]. We would not put an agency account at risk.

Side-by-Side Comparison

Connector	Maintained by	Read	Write	Maturity note
Recruiterflow	Vendor	Yes	No	Official, OAuth 2.1 [1]
HubSpot	Vendor	Yes	Yes	Official, scope-based [3]
Bullhorn (StackOne)	Third party	Yes	Yes, incl. delete	Commercial, action-level limits [5]
Bullhorn (community)	Community	Yes	Not confirmed	Unofficial [6] [7]
Google Workspace	Vendor	Yes	Yes (scoped)	Preview [9]
Calendly	Vendor	Yes	Yes	Hosted only [11]
Slack	Vendor (per listings)	Yes	Not confirmed	Docs not verified [10]
Zapier MCP	Vendor	Via actions	Via actions	Pricing sources conflict [12]
n8n MCP Server Trigger	Vendor	Via your tools	Via your tools	You build it [13]

Security and Write-Access Risks

This is not legal or security advice. It is a sensible checklist drawn from public MCP security guidance, which describes tool poisoning and prompt injection as the main threats and least privilege as the central defence [15].

Prompt injection - a candidate CV, an inbound email or a web page can contain hidden instructions. If the assistant has write tools, it may act on them. Read-only connectors cut this risk sharply.
Scope creep - grant only the scopes a task needs, and review them regularly [15]. A reporting job does not need delete rights.
Approval gates - require confirmation for sends, bookings and bulk updates, and keep audit logs of tool calls [15].
Personal data - candidate CVs, salaries and notes pass through the model provider. Check data processing terms and your lawful basis with your data-protection lead.
Role-based exposure - the assistant sees what the signed-in user sees, including revenue data in Recruiterflow [1]. Use a user with the right role, not the owner account.
Unvetted community code - a community server holds your tokens on your machine. Review it, pin a version, or use a vendor-hosted option.

Where boilr Fits (and Where It Does Not)

boilr is not an MCP server and does not expose your data to a general assistant. It is "your AI sales employee for recruitment", one per consultant, covering the top of the BD motion. The overlap with this article is the integration layer.

Live integrations - boilr's integrations page lists Recruiterflow and HubSpot as live, where it pushes records, for example companies, contacts and deals created the moment a signal fires. It lists Outlook and Gmail for drafts you verify and send [16].
Roadmap, not live - Bullhorn, Vincere, Loxo and Aircall are on the roadmap, so if Bullhorn is your system, boilr does not connect to it today [16].
Duplicate check - before pushing, boilr checks for an existing company by domain and contact by email, then enriches a match rather than creating a duplicate [16].
Different job - an MCP connector answers questions about records you already have. boilr finds client companies, detects hiring signals, scores them against your ICP and drafts outreach as Tasks, with the Company Brain keeping the agency's ICP and winning patterns in one place.
Human in the loop - you verify and send. That mirrors the approval-gate advice above.
Not claimed - the integrations page does not describe boilr as an MCP server or describe reading from a calendar, so we do not claim either.

Which Setup for Which Agency

Recruiterflow agency wanting reporting - connect the official read-only connector to Claude and start asking pipeline and margin questions.
HubSpot agency - use the official connector, with scopes trimmed and bulk edits approved by an admin.
Bullhorn agency - ask Bullhorn what they support, consider a commercial connector with action-level limits, and avoid delete rights.
Google Workspace agency - try draft-only Gmail scopes before anything that sends.
Owner who likes building - n8n self-hosted for control, or Zapier MCP for speed.
Desk whose problem is starting client conversations - an assistant connector will not fix that; look at signal-led outreach tools such as boilr alongside it.

A Safe Rollout in Four Steps

Pick one read-only question - for example "which clients have had no logged contact in 30 days?"
Connect with a scoped user - not the admin account, and with the minimum OAuth scopes.
Trial for two weeks - compare the answers with your own report and count the errors.
Add one write action behind approval - a draft email or a note, never a bulk update first.

Recruiter examples where connectors help

A desk lead asks for a Monday summary of open jobs with no submissions in ten days.
An agency owner asks for margin by client across this quarter's contract placements.
A BD consultant asks for the last three touches with a COO before a call.
A consultant has a draft follow-up created in Gmail after a client call, ready to review.
A booking link for a candidate call is dropped into a client email thread.
A Slack summary of what the 360 desk learned about a client this week.
A HubSpot list of lapsed clients assembled from natural-language criteria.
A new job-board lead routed into your CRM through an n8n workflow exposed as a tool.

Common Mistakes

Starting with write access - begin read-only and earn the right to write.
Using the owner account - the assistant inherits everything that account can see.
Trusting community servers by default - they are unofficial and may be unmaintained [8].
Assuming a connector exists - check, as the SmartRecruiters and Bullhorn cases show [14].
Skipping the data-protection conversation - candidate data is personal data.

How We Would Measure It

Metric	How to measure	What good looks like
Answer accuracy	Compare 10 assistant answers with your own report	No material errors
Time to a pipeline answer	Minutes before versus after	Shorter than your CSV routine
Writes needing correction	Count edits to AI-created records	Trending to zero
Scopes in use	Quarterly permission review	Only what tasks need

We have not published targets because we have no verified benchmark. Set your own baseline first.

Want to see how boilr pushes signal-led companies and contacts into Recruiterflow or HubSpot and drafts outreach you verify and send? Book a demo or start free.

Frequently Asked Questions

What is an MCP server, in recruiter terms?

It is a connector that lets an AI assistant look things up or take actions in a system you already use, such as your ATS, using the permissions of the person who signed in. It replaces copy-pasting exports into a chat.

Does Bullhorn have an official MCP server?

We could not find one. Community projects and a StackOne commercial connector exist [5] [6] [7]. Ask Bullhorn directly what is supported before you build.

Can Claude edit my Recruiterflow records?

Not through the official connector. Recruiterflow describes it as read-only, with no create, edit, delete or merge [1].

Is it safe to give an AI write access to my CRM?

It carries real risk, including prompt injection and scope creep [15]. Start read-only, trim scopes, require approval for writes and bulk edits, and involve your data-protection lead.

Should I use Zapier or a native connector?

Use the native connector when one exists and fits, since it is maintained by the vendor. Use Zapier or n8n when no native server exists [12] [13], and expose only the actions you need.

Is boilr an MCP server?

No. boilr is an AI sales employee that pushes records into Recruiterflow and HubSpot and drafts email into Gmail or Outlook [16]. Bullhorn is on the roadmap, not live.

Do I need a paid AI plan to use these connectors?

Often yes. Recruiterflow's Claude guide requires Claude Pro, Team or Enterprise [1], and Google's guide lists paid Claude plans for custom connectors [9].

Sources

Information sourced from vendor documentation and public reporting as of November 2026.

Back to all articles