Standout MCP server

Let an AI assistant search Standout’s startup job board for a candidate. Once they connect their Standout account, the assistant also sees the roles we’ve matched them with and where each one stands — the same picture the candidate sees on their own dashboard.

Endpoint

https://standout.work/api/talent/mcp

Connecting to it requires authorization: any request without a token returns 401, so clients ask the candidate to sign in when they add the server. https://standout.work/api/talent/mcp/public serves the same server and tools but also answers anonymous callers, who can use the job-search tools before connecting. It is the URL the Standout ChatGPT app connects to.

Streamable HTTP transport. Point any MCP client at this URL; it discovers everything else from the standard metadata documents at /.well-known/oauth-protected-resource/api/talent/mcp and /.well-known/oauth-authorization-server.

Authorization

On the public endpoint the job-search tools need no authorization. Everything else uses OAuth 2.1 with PKCE (S256, required). Clients identify with a client ID metadata document or register dynamically (RFC 7591). There is no API key and no partner credential: a token is minted only after a candidate signs in to Standout and consents, and it is scoped to that one candidate. A request without a token to the main endpoint, or an account-tool call to the public one, returns 401 with a WWW-Authenticate header, which is the cue for a client to start the flow.

1. Use the https URL of your client metadata document as the client_id. Its client_id must equal that URL and it must list your redirect_uris. Without one, register at /api/talent/mcp/oauth/register to get a client_id bound to your redirect URIs.
2. Send the candidate to /api/talent/mcp/oauth/authorize with a code_challenge. They sign in and approve.
3. Exchange the code at /api/talent/mcp/oauth/token for a bearer token.

MCP scopes: talent:read is always granted. talent:write is granted only when you request it in scope and the candidate approves it on the consent screen. Calling a write tool with a read-only token returns 403 with error="insufficient_scope", the scopes to request, and the resource metadata, so the client can ask the candidate again.

Access tokens last 30 days. Each comes with a refresh token (grant type refresh_token) that renews it without sending the candidate back through consent; refresh tokens rotate on every use and lapse after 180 days unused. The authorization response includes iss (RFC 9207). The candidate can revoke any connection from their Standout settings at any time. A revoked or expired token returns 401 with a WWW-Authenticate header pointing back at the resource metadata, so clients can re-run the flow.

npx standout agent login uses OAuth device authorization at /api/talent/cli/device and the same token endpoint, with client standout-cli, which is granted talent:read talent:write: the same access as an MCP connection with write consent, and the refresh credential expires like one. The same login reads and acknowledges the candidate’s update queue with npx standout agent updates, served by /api/talent/cli/updates. Every other CLI command is a tool call to this server, so the CLI serves exactly the tools listed below.

Job search tools (no account on the public endpoint)

search_jobs: Open roles on the Standout job board, filtered by title keyword, city, remote, visa sponsorship, minimum salary, job type and recency. Ten per page, up to five pages.
get_job: One role in full: the description, requirements, compensation and the company, plus the link to be introduced to its founders.

Account tools (connected candidate)

get_my_profile: The candidate's profile and what they want in a role — locations, salary target, work mode, start date, and how actively they are searching.
list_my_matches: Roles Standout has matched the candidate with, each with a plain-English status and guidance on what may be claimed about its progress, plus whether the latest matching run is running, found matches, found none or failed.
get_match_details: Full detail for one match: the role description, the company, compensation and current status.
check_for_updates: What changed since the assistant's last check (pass back its nextSince): new and updated matches, messages from Standout, a finished search, profile changes. Plus the matches waiting on a decision and when to check next. The one call for a recurring check without events, every 10 minutes.
report_standout_issue: Report a problem with Standout itself (a failing tool or command, a wrong result, confusing instructions, a missing capability) to Standout's engineers. Works on a read-only connection; the same problem from the same account is filed once per week, up to five reports an hour.

Reporting a problem without a connection

When an agent cannot connect at all (the CLI will not install, sign-in never completes), it can still file a report: POST https://standout.work/api/talent/report with a JSON body of the same fields as report_standout_issue (kind, summary, details, and optionally what_you_ran, error_text, client_version, suspected_side, severity). No login needed; a talent bearer token, when one is sent, attributes the report to its candidate. Anonymous reports are capped per address.

Acting for the candidate (talent:write)

approve_job_match: Say yes to one of the candidate's matches, or ask for an intro to a role from search_jobs, exactly as the job page's intro button does. Returns what happens next and the match's status afterwards.
reject_job_match: Pass on one of the candidate's matches, with their reason, which Standout uses to choose better roles.
trigger_job_matching: Start a fresh matching run in the background (about five minutes). Returns a run_id; the end of the run arrives as a matching.finished event, or shows in list_my_matches.
confirm_qualified_after_clarification: Send the candidate's answers when Standout needs more information before putting them forward for a role.
update_job_match_feedback, exclude_company_from_matches, reinclude_company: Add a reason to a past decision, and keep a company out of (or back in) their matches.
pause_matching, reactivate_matching: Pause new matches for a while, and resume them.
report_interview_outcome, report_offer_received, record_call_booked: Tell Standout how an interview went, about an offer, or that the first call with a company is booked.
ask_hiring_team, report_intro_email_issue: Ask a match's hiring team a question, or tell them their intro email never arrived.
update_my_background, update_availability, update_profile_links: Update the candidate's current role, experience and work authorization, when they can interview and start, and their GitHub or X link.
update_my_preferences: Update what the candidate is looking for (locations, work mode, salary floor, total comp, start date, search status, company stage, functions, seniority, track), through the same path Standout's agent uses. Returns the preferences as saved.
reply_to_standout: Last resort for what no other tool covers: send Standout a message in the candidate's words (an answer, a LinkedIn link, a question) and get Standout's reply.

Except for preferences, none of these acts on its own. Each one hands the candidate’s words to Standout’s recruiting agent, as if they had texted us, and returns the reply. Relay the reply without strengthening it. Up to 30 per candidate per hour.

Events (connected candidate)

Assistants that speak MCP protocol 2026-07-28 can subscribe to updates about the connected candidate instead of polling, per the MCP Events draft. Events are rolling out to connected accounts gradually: when they are available, server/discover advertises the events capability. Clients on earlier protocol versions keep the tools unchanged.

match.presented: Standout put a new role in front of the candidate. Once per match. share_card is the match's card of the candidate and the company: post its markdown (an image) on its own line. When there is no card, job_url is Standout's page for the role; never the role's own posting.
match.updated: A match reached a new stage: profile with the company, intro made, interviewing, offer, hired, or closed. A closure is only sent after Standout has told the candidate itself.
interview.scheduled: An interview for one of the candidate's matches was booked, as reported by the hiring side, with the time when one was given (as reported; it may carry no time zone). Bookings the candidate told Standout about themselves are not sent back.
matching.finished: A matching run started with trigger_job_matching ended, sent the moment it does: matches_found (already in list_my_matches), no_matches, or failed. Once per run.
message.received: Standout, or a hiring team through Standout, messaged the candidate on WhatsApp, SMS, iMessage, email or the web app. Replies inside a conversation the candidate is actively having are not sent. When a candidate talks to Standout through their assistant, our follow-ups to them (match results, nudges) are delivered through it instead of another channel: those arrive here with channel "assistant" and nowhere else, so relay them to the candidate.

· Webhook delivery. Call events/subscribe with an https callback on the default port and a whsec_ secret. We verify the callback with a signed challenge it must echo, then sign every event per Standard Webhooks and send the subscription id in X-MCP-Subscription-Id.
· Lifetime. Subscriptions last at most seven days; refresh before refreshBefore. A subscription starts from now and never replays history, so cursor is always null. Each event has a stable eventId; deduplicate on it.
· Data, not instructions. Payloads carry facts and a link. The claim-ceilings in status.assistantGuidance stay behind get_match_details; call it before telling the candidate anything about a match’s progress.
· Delivery. Failed deliveries are retried with backoff. Answer 410 to end a subscription. Revoking the connection in Standout settings deletes its subscriptions at once.

What the connector can and cannot do

· Read-only unless the candidate allows more. With talent:read no tool changes the account; the one thing it can send is a report_standout_issueproblem report to Standout’s engineers. With talent:write an assistant can only speak to Standout for the candidate: answer a match, ask for an intro, send a message. It never contacts companies, applies anywhere, or changes account details. Events only push the candidate’s own updates to the assistant they connected.
· One candidate. No tool takes a user id, email or any other selector. A connected assistant can only ever see the account that authorized it.
· Public roles only. Job search returns exactly what standout.work/jobs shows, with the same disclosure rules: no stealth companies and no compensation a company chose to keep private.
· No company data. Recruiter, hiring-manager and other candidates’ data are not reachable from this surface.

Reading match status honestly

Every match carries a status.assistantGuidance string saying what may and may not be claimed about its progress, plus status.awaitingParty (whose move it is) and status.profileIsWithCompany. Follow the guidance rather than inferring progress from the state name. A candidate accepting a match is not the same as us having submitted them, and telling someone their profile is in front of a hiring manager when it isn’t is the failure mode this field exists to prevent.

Limits

Job search needs no account on the public endpoint. The account tools need a free Standout candidate account. Rate limited per connected account, and per user and per address for anonymous search. Up to 25 active event subscriptions per account. No plan or regional restriction.