Quick answer: Some staffing agencies are giving recruiters MCP access to their databases, but most are not there yet. A growing list of recruiting platforms now let Claude or ChatGPT read and update the agency database through MCP (Model Context Protocol). Where agencies have written an AI policy, it usually narrows access rather than opening it up, and Bullhorn, one of the most widely used staffing platforms, has no official MCP server.
The worry nobody is writing about: an AI assistant sees whatever the recruiter can see. A recruiter with access to the whole database can ask AI to pull it in one request.
Who this is for: agency owners, recruiting leaders and ops managers deciding whether to connect AI to their ATS or CRM.
What does MCP access to an agency database actually mean?
MCP is an open standard, introduced by Anthropic, that lets an AI assistant connect to other software through one consistent interface. When an ATS or CRM ships an MCP server, a recruiter can add it to Claude or ChatGPT as a connector, sign in, and then ask questions about live agency data in plain English.
In practice that means prompts like “find every controller candidate we spoke to this year” or “move this candidate to first interview” get answered or done inside the chat, not by clicking through screens. Spott, one of the vendors shipping this, says each recruiter connects with their own login, so the AI only reaches data that person is already allowed to see, according to its MCP guide.
That last point is both the safeguard and the risk. The AI does not get more access than the recruiter. It does get the same access, and it works a lot faster.
Which recruiting platforms have MCP servers?
Newer ATS and CRM vendors are shipping MCP servers. Most of the older platforms have not. A Hirevire count found eleven HR tools with an MCP server maintained by their own vendor as of August 2026, and that list leaves out several agency platforms below, per Hirevire’s MCP roundup. Spott says most legacy ATS vendors are held back by older data models and slower release cycles.
| Platform | MCP status | What it does |
|---|---|---|
| Manatal | Public beta, Jan 2026 | Bills itself as the first recruitment software with a native integration for ChatGPT, Claude and other LLMs; can add candidates, clients and jobs |
| Workable | Live since May 2026 | Launched with 38 tools and grew to 94 by July, with read and write access |
| Greenhouse | Announced May 2026, open beta | Tied to existing permissions, with audit trails, rate limits and organization level controls |
| BrightMove | Live, July 2026 | Hosted server at mcp.brightmove.com, pitched at RPO firms and staffing agencies |
| Spott | Live | Custom connector for Claude or ChatGPT, signed in with each recruiter’s own Spott login |
| Atlas | Live, June 2026 | Opens Atlas’s record of calls, emails and notes on candidates and clients to Claude |
| iSmartRecruit | Live | Search, compare and analyse candidates from ChatGPT or Claude |
| CoRecruit | Live | Call notes, candidate records, ATS sync logs and job history, within each recruiter’s own access |
| 100Hires | Live | Hosted endpoint with OAuth 2.1 and 130 tools |
| Bullhorn | No official server | Third party bridges only (next section) |
For a wider view of who connects to what, see our MCP directory.
Does Bullhorn have an MCP server?
No. Bullhorn has no official MCP server, which leaves out every agency running on it. Its AI work goes into Amplify, inside its own product. At Engage Boston on May 28, 2026 it launched Amplify Digital Workers (Prospect, Verify, Audit and Transcribe) and Amplify Chat, a chat interface over live Bullhorn data for Amplify customers, according to Carly’s Bullhorn breakdown.
Agencies that want Claude or ChatGPT working on Bullhorn data go through third parties:
| Option | Type | What you get |
|---|---|---|
| StackOne | Hosted, managed | Bullhorn MCP server with 80 prebuilt actions |
| Knit | Hosted | Bullhorn MCP server run by Knit |
| Ribbon | Hosted | Reads job orders, candidates and submissions; writes interview results and notes back through an audited path |
| CData | Connector | MCP server for Bullhorn CRM data |
| Osher | Free, open source | Python server you run yourself; read only, with six tools |
The catch for an agency owner: every one of these connects through Bullhorn’s API, and none of them is made by Bullhorn. Prices, access levels and setup steps for each are in our Bullhorn MCP guide.
Are agency owners worried about what recruiters could do with it?
Yes, though most of the worry in print is older than MCP. The database is an agency’s main asset, and owners have always feared it walking out the door with a departing recruiter. A 2015 ERE article warned that recruiters who quit may take much of the firm’s data with them, not just their contacts, in this ERE piece. Turnover keeps that risk constant. An older HIRABL whitepaper put average recruiter turnover at 43%, within a range of 25% to 110%, in its turnover whitepaper.
What are the AI specific worries?
Industry writing about AI in recruiting falls into three groups of concern:
| Worry | What the source says |
|---|---|
| Data going into public chatbots | A June 2026 session by Atlas Cloud, hosted on APSCo’s site, warns that candidate data is being shared with public AI platforms and security protocols bypassed (APSCo session). Strategies, a UK firm that sells private AI hosting, tells agencies to check what an AI tool does with data before plugging it into the CRM (Strategies). |
| Agents acting on their own | A SailPoint survey cited by APSCo found 80% of companies using AI agents reported unintended actions, including 39% accessing the wrong systems and 33% accessing inappropriate data (APSCo blog). |
| Security reviews | The Access Group cites a 2026 Dark Reading poll in which 48% of security professionals ranked agentic AI the top attack vector for the year (Access Group). |
What is the MCP version of the departing recruiter problem?
Almost nobody has written about it yet. Exporting a database used to mean clicking through export screens an admin could lock down. With an MCP connection, a recruiter can ask an AI assistant to pull every client contact they have touched in a single request, and the assistant will do it if their ATS role allows it. Our searches of industry blogs and forums turned up no discussion focused on that scenario. We cover the fixes in our guide to protecting your database.
Are agencies letting their whole team use MCP with AI?
Mostly not yet. Where firms have written a policy, it usually narrows access. Wendy Kennah, chief operations officer at IT staffing firm Procom, told the American Staffing Association’s Staffing Success magazine that some staff had their own ChatGPT or Claude licenses, so the firm now allows only tools the organization defines and secures on its own network, per ASA’s AI feature. That rules out a recruiter plugging a personal AI account into the agency database. To write your own rules, start from our AI policy template.
Full rollouts are rare. US Tech Automations, citing Pin.com’s analysis of Bullhorn’s GRID 2026 data, reports that only 10% of staffing operators have fully embedded agentic AI across their workflow, in its agency AI analysis. Willing owners also struggle with adoption. Elena Volk, writing on ERE about her own recruiting team, said a founder testing ChatGPT late at night is very different from a whole team using AI every day, in her ERE article.
What does it look like when a whole team does use it?
The owner usually holds the connection, and the recruiters work from what the AI produces:
- Blue Castle Agency, a real estate recruiting firm, has Claude read active jobs from its ATS and build passive candidate lists through Zapier MCP, with a second Claude pass checking each list. CEO Curtis Key built it; recruiters work from the checked lists, according to Zapier’s case study.
- Josh Kirkham at CoRecruit runs a weekly Claude audit of business development calls and posts the results to a Slack channel for the whole team, in CoRecruit’s agency guide.
The pull toward AI is strong. In Bullhorn’s 2026 survey of nearly 2,300 recruitment professionals, agencies using AI at any stage were 3.5 to 4.5 times more likely to have grown in 2025, as summarized by HeroHunt. That is a correlation, not proof that AI caused the growth.
How do agencies that use MCP keep control of their data?
The vendors’ main safeguard is that the AI gets exactly the access the recruiter already has. Workable says its MCP server inherits each user’s permissions, so an administrator cannot grant the AI client more access than that user already has, in its MCP security post. That also means a recruiter who can see the whole database can have the AI pull the whole database. ATS permissions matter more once MCP is switched on, not less.
| Control | Why it matters | Who recommends it |
|---|---|---|
| Tighten ATS permissions before connecting anything | Whatever a user can see, their AI can see | Follows from how Workable and Spott scope access |
| Start with read and draft only | Turn on write access deliberately, after the team trusts the setup | Workable |
| Require a human yes before any change | Agents should need explicit user authorisation every time they modify data | The Access Group |
| Keep an audit trail | You can see what the AI read and changed, and when | Greenhouse, Ribbon |
| Approve AI tools centrally | Connections stay in company managed accounts, not personal ones that leave with the recruiter | Procom’s policy |
If you are still choosing an ATS, our ATS comparison shows which platforms list an MCP server, and our guide to MCP for recruiters covers setup.
Two risks grow once AI can touch your ATS: resume prompt injection and the candidate data rules in your state. To pick one AI platform for the team, see our assistant comparison.
Quick answers
Can Claude connect to my ATS?
Yes, if your ATS has an MCP server or a third party bridge. Workable, Greenhouse, Manatal, Spott, BrightMove, Atlas and others offer one; Bullhorn users need a third party option such as StackOne, Knit or Ribbon.
Can an AI assistant see more than the recruiter can?
Not on the vendor servers covered here. Workable and Spott both say the AI inherits the signed in user’s permissions. It sees the same data, faster.
Is it safe to let recruiters connect personal ChatGPT or Claude accounts?
Many firms say no. Procom, for example, allows only AI tools the organization defines and secures on its own network.
Does Bullhorn have an official MCP server?
No. Bullhorn’s AI runs inside its own product as Amplify, including Amplify Chat for Amplify customers.
Should AI be allowed to write to the database?
Start with read and draft only. Workable advises expanding write access deliberately, and The Access Group says every data change should need explicit user approval.
How many agencies have fully adopted AI agents?
About 10% of staffing operators, according to US Tech Automations citing Pin.com’s read of Bullhorn data.
The bottom line
MCP is here, and the list of recruiting platforms that support it grows every month. Most agencies are still holding back, and the ones moving fastest keep the connection in the owner’s hands, lock down ATS permissions first and give recruiters what the AI produces rather than open access to the whole database. If you run on Bullhorn, any MCP route today is a third party one. Every guide in this series is on our MCP agency hub. Follow new MCP launches on our recruiting news feed.
Sources: Spott, Hirevire, Manatal, Workable guide, Workable security, Greenhouse, Greenhouse launch, BrightMove, Atlas, iSmartRecruit, CoRecruit, 100Hires, Carly, StackOne, Knit, Ribbon, CData, Osher, ERE 2015, HIRABL, APSCo session, APSCo blog, Strategies, Access Group, ASA, US Tech Automations, ERE 2026, Zapier, CoRecruit guide, HeroHunt
Free newsletter
Get the Work Insiders weekly
One email a week: the recruiting and HR tech news that mattered, the tools we just added to the directory, and one practical guide. No spam, and you can unsubscribe in one click.