# hires_upload_candidate_file

Upload a file for a candidate using a base64 payload. Used for resume ingestion, portfolio uploads, and document attachment.

Agent View of the PolicyLayer registry record for `hires_upload_candidate_file`. HTML page: https://policylayer.com/tools/100hires-mcp-server/hires-upload-candidate-file

## Facts

- Tool: `hires_upload_candidate_file`
- Server: 100Hires MCP Server (`100hires/mcp-server`) — https://policylayer.com/tools/100hires-mcp-server.md
- Homepage: https://github.com/100Hires/mcp-server
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "hires_upload_candidate_file",
    "arguments": {}
  }
}
```

## Why hires_upload_candidate_file is rated Medium

File upload is a write operation that creates new data objects in the candidate record. Severity is medium because malicious file uploads could introduce malware or fraudulent documents into hiring records, affecting recruitment workflows and compliance. However, the operation is reversible (files can be deleted), so it does not rise to Destructive.

From the tool's own definition: "Tool name and description explicitly state 'Upload a file for a candidate' — this creates or modifies data (resume, portfolio, document attachment) in the ATS system. The base64 payload mechanism confirms file creation/storage."

## Use case

AI agents use hires_upload_candidate_file to create or update resources in 100Hires MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your 100Hires MCP Server environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches 100Hires MCP Server:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "hires_upload_candidate_file": {
      "limits": [
        {
          "counter": "hires_upload_candidate_file_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on 100Hires MCP Server (129)

- `hires_batch_remove_from_boards` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-batch-remove-from-boards.md
- `hires_cancel_all_notification_messages` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-cancel-all-notification-messages.md
- `hires_delete_application` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-application.md
- `hires_delete_candidate` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-candidate.md
- `hires_delete_company` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-company.md
- `hires_delete_email_template` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-email-template.md
- `hires_delete_form` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-form.md
- `hires_delete_job` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-job.md
- `hires_delete_job_webhook` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-job-webhook.md
- `hires_delete_message` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-message.md
- `hires_delete_note` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-note.md
- `hires_delete_notification_message` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-notification-message.md
- `hires_delete_nurture_campaign` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-nurture-campaign.md
- `hires_delete_question` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-question.md
- `hires_delete_webhook` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-delete-webhook.md
- `hires_disqualify_candidate` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-disqualify-candidate.md
- `hires_remove_from_job_board` — Destructive — https://policylayer.com/tools/100hires-mcp-server/hires-remove-from-job-board.md
- `hires_batch_job_boards` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-batch-job-boards.md
- `hires_download_attachment` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-download-attachment.md
- `hires_get_ai_score` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-ai-score.md
- `hires_get_application` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-application.md
- `hires_get_billing` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-billing.md
- `hires_get_candidate` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-candidate.md
- `hires_get_candidate_resume` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-candidate-resume.md
- `hires_get_career_job` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-career-job.md
- `hires_get_company` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-company.md
- `hires_get_email_template` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-email-template.md
- `hires_get_evaluation` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-evaluation.md
- `hires_get_form` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-form.md
- `hires_get_interview` — Read — https://policylayer.com/tools/100hires-mcp-server/hires-get-interview.md
- …and 99 more: https://policylayer.com/tools/100hires-mcp-server.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=100hires-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/100hires-mcp-server