# hires_list_candidate_files List all files attached to a candidate (resumes and other documents). Each entry has uuid, absolute download url (use Bearer auth), relative_time, file metadata (orig_file_name, file_ext, file_type/MIME, readable_size), and type (resume/other). Default response is compact; avoid include=text_content on candidates with many files — it adds parsed resume text per file which can exceed the response budget. Agent View of the PolicyLayer registry record for `hires_list_candidate_files`. HTML page: https://policylayer.com/tools/com-100hires-100hires/hires-list-candidate-files ## Facts - Tool: `hires_list_candidate_files` - Server: 100Hires - AI ATS & Recruitment Software (`https://mcp.100hires.com/mcp`) — https://policylayer.com/tools/com-100hires-100hires.md - Homepage: https://github.com/100Hires/mcp - Risk category: Read (Low risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server rate-limited: no - Parameters: 1 (1 required) - Recommended policy verdict: Allowed ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `id` | string | number | yes | Candidate ID (integer) or alias (string). | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "hires_list_candidate_files", "arguments": { "id": 0 } } } ``` ## Why hires_list_candidate_files is rated Low This is a Read operation as it retrieves candidate documents and metadata. Severity is high because resumes and personal candidate files contain sensitive personal information (names, contact details, employment history, education), which could be exposed or exfiltrated by an agent with unrestricted access. From the tool's own definition: "Tool description explicitly states it 'List all files attached to a candidate' and provides 'download url', 'file metadata', and 'parsed resume text' — classic data retrieval operations with no modification or side effects." Risk signals: Bulk/mass operation — affects multiple targets ## Use case AI agents call hires_list_candidate_files to retrieve information from 100Hires - AI ATS & Recruitment Software without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere. ## Recommended policy (PolicyLayer) Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches 100Hires - AI ATS & Recruitment Software: ```json { "version": "1", "default": "deny", "tools": { "hires_list_candidate_files": {} } } ``` ## Other tools on 100Hires - AI ATS & Recruitment Software (132) - `hires_batch_remove_from_boards` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-batch-remove-from-boards.md - `hires_cancel_all_notification_messages` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-cancel-all-notification-messages.md - `hires_delete_application` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-application.md - `hires_delete_candidate` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-candidate.md - `hires_delete_company` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-company.md - `hires_delete_email_template` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-email-template.md - `hires_delete_form` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-form.md - `hires_delete_job` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-job.md - `hires_delete_job_webhook` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-job-webhook.md - `hires_delete_message` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-message.md - `hires_delete_note` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-note.md - `hires_delete_notification_message` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-notification-message.md - `hires_delete_nurture_campaign` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-nurture-campaign.md - `hires_delete_question` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-question.md - `hires_delete_webhook` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-delete-webhook.md - `hires_disqualify_candidate` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-disqualify-candidate.md - `hires_remove_from_job_board` — Destructive — https://policylayer.com/tools/com-100hires-100hires/hires-remove-from-job-board.md - `hires_batch_job_boards` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-batch-job-boards.md - `hires_download_attachment` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-download-attachment.md - `hires_get_ai_score` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-ai-score.md - `hires_get_application` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-application.md - `hires_get_billing` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-billing.md - `hires_get_candidate` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-candidate.md - `hires_get_candidate_resume` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-candidate-resume.md - `hires_get_career_job` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-career-job.md - `hires_get_company` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-company.md - `hires_get_email_template` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-email-template.md - `hires_get_evaluation` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-evaluation.md - `hires_get_form` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-form.md - `hires_get_interview` — Read — https://policylayer.com/tools/com-100hires-100hires/hires-get-interview.md - …and 102 more: https://policylayer.com/tools/com-100hires-100hires.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-100hires-100hires · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-100hires-100hires