Sargonpiraev Hh MCP Server
@sargonpiraev/hh-mcp-server
npm
v1.26.0
Source verified
Published by sargonpiraev — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
HeadHunter API MCP Server provides seamless integration between AI tools and HeadHunter's comprehensive job search platform.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 15.4 = 85. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −15.4 | Mixed-script (homoglyph) text in description MTC-UNI-009 | injection |
2. Client adoption risk — 85 − 3 = 82. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 2
high Mixed-script (homoglyph) text in descriptionMTC-UNI-009
A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.
Evidence: Получение cловарей резюме-профиля
Fix: Restrict metadata to a single script, or normalize confusables before display.
Location: tool get-resume-profile-dictionaries · description
medium Hardcoded egress to an external endpoint (build/main.js)MTC-SRC-003
In the server's implementation (`build/main.js:197`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: t tokenResponse = await fetch('https://api.hh.ru/token', { method: 'POST', headers: {
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/main.js
Tools 167
Each tool and what it can reach — statically extracted from the published source.
cancel-webhook-subscriptionnetwork egresschange-webhook-subscriptionnetwork egresspost-webhook-subscriptionnetwork egressadd-applicant-commentno sensitive capabilityadd-employer-managerno sensitive capabilityadd-employer-to-blacklistedno sensitive capabilityadd-resume-visibility-listno sensitive capabilityadd-vacancy-to-archiveno sensitive capabilityadd-vacancy-to-blacklistedno sensitive capabilityadd-vacancy-to-favoriteno sensitive capability
Show 157 more tools ↓
add-vacancy-to-hiddenno sensitive capabilityapply-to-vacancyno sensitive capabilityauthorizeno sensitive capabilitychange-negotiation-actionno sensitive capabilitychange-vacancy-draftno sensitive capabilityconfirm-phone-in-resumeno sensitive capabilitycreate-resumeno sensitive capabilitycreate-resume-profileno sensitive capabilitycreate-saved-resume-searchno sensitive capabilitycreate-saved-vacancy-searchno sensitive capabilitycreate-vacancy-draftno sensitive capabilitydelete-applicant-commentno sensitive capabilitydelete-artifactno sensitive capabilitydelete-employer-from-blacklistedno sensitive capabilitydelete-employer-from-resume-visibility-listno sensitive capabilitydelete-employer-managerno sensitive capabilitydelete-resumeno sensitive capabilitydelete-resume-visibility-listno sensitive capabilitydelete-saved-resume-searchno sensitive capabilitydelete-saved-vacancy-searchno sensitive capabilitydelete-vacancy-draftno sensitive capabilitydelete-vacancy-from-blacklistedno sensitive capabilitydelete-vacancy-from-favoriteno sensitive capabilitydisable-automatic-vacancy-publicationno sensitive capabilityedit-artifactno sensitive capabilityedit-current-user-infono sensitive capabilityedit-employer-managerno sensitive capabilityedit-negotiation-messageno sensitive capabilityedit-resumeno sensitive capabilityedit-vacancyno sensitive capabilityget-active-negotiationsno sensitive capabilityget-active-vacancy-listno sensitive capabilityget-addressno sensitive capabilityget-all-districtsno sensitive capabilityget-applicant-comments-listno sensitive capabilityget-applicant-phone-infono sensitive capabilityget-archived-vacanciesno sensitive capabilityget-area-leaves-suggestsno sensitive capabilityget-areasno sensitive capabilityget-areas-from-specifiedno sensitive capabilityget-areas-suggestsno sensitive capabilityget-artifact-photosno sensitive capabilityget-artifact-photos-conditionsno sensitive capabilityget-artifacts-portfoliono sensitive capabilityget-artifacts-portfolio-conditionsno sensitive capabilityget-available-vacancy-typesno sensitive capabilityget-blacklisted-employersno sensitive capabilityget-blacklisted-vacanciesno sensitive capabilityget-clickme-statisticsno sensitive capabilityget-collection-negotiations-listno sensitive capabilityget-countriesno sensitive capabilityget-current-user-infono sensitive capabilityget-dictionariesno sensitive capabilityget-educational-institutions-dictionaryno sensitive capabilityget-educational-institutions-suggestsno sensitive capabilityget-employer-addressesno sensitive capabilityget-employer-departmentsno sensitive capabilityget-employer-infono sensitive capabilityget-employer-managerno sensitive capabilityget-employer-manager-limitsno sensitive capabilityget-employer-manager-typesno sensitive capabilityget-employer-managersno sensitive capabilityget-employer-vacancy-areasno sensitive capabilityget-facultiesno sensitive capabilityget-favorite-vacanciesno sensitive capabilityget-fields-of-study-suggestionsno sensitive capabilityget-hidden-vacanciesno sensitive capabilityget-industriesno sensitive capabilityget-languagesno sensitive capabilityget-localesno sensitive capabilityget-locales-for-resumeno sensitive capabilityget-mail-templatesno sensitive capabilityget-manager-accountsno sensitive capabilityget-manager-settingsno sensitive capabilityget-metro-stationsno sensitive capabilityget-metro-stations-in-cityno sensitive capabilityget-mine-resumesno sensitive capabilityget-negotiation-itemno sensitive capabilityget-negotiation-message-templatesno sensitive capabilityget-negotiation-messagesno sensitive capabilityget-negotiation-test-resultsno sensitive capabilityget-negotiationsno sensitive capabilityget-negotiations-statistics-employerno sensitive capabilityget-negotiations-statistics-managerno sensitive capabilityget-new-resume-conditionsno sensitive capabilityget-payable-api-actionsno sensitive capabilityget-payable-api-method-accessno sensitive capabilityget-positions-suggestionsno sensitive capabilityget-pref-negotiations-orderno sensitive capabilityget-professional-roles-dictionaryno sensitive capabilityget-professional-roles-suggestsno sensitive capabilityget-prolongation-vacancy-infono sensitive capabilityget-registered-companies-suggestsno sensitive capabilityget-resumeno sensitive capabilityget-resume-access-typesno sensitive capabilityget-resume-conditionsno sensitive capabilityget-resume-creation-availabilityno sensitive capabilityget-resume-negotiations-historyno sensitive capabilityget-resume-profile-dictionariesno sensitive capabilityget-resume-search-keywords-suggestsno sensitive capabilityget-resume-statusno sensitive capabilityget-resume-view-historyno sensitive capabilityget-resume-visibility-employers-listno sensitive capabilityget-resume-visibility-listno sensitive capabilityget-resumes-by-statusno sensitive capabilityget-salary-employee-levelsno sensitive capabilityget-salary-evaluationno sensitive capabilityget-salary-industriesno sensitive capabilityget-salary-professional-areasno sensitive capabilityget-salary-salary-areasno sensitive capabilityget-saved-resume-searchno sensitive capabilityget-saved-resume-searchesno sensitive capabilityget-saved-vacancy-searchno sensitive capabilityget-saved-vacancy-searchesno sensitive capabilityget-skill-set-suggestsno sensitive capabilityget-skillsno sensitive capabilityget-suitable-resumesno sensitive capabilityget-tests-dictionaryno sensitive capabilityget-vacanciesno sensitive capabilityget-vacancies-related-to-vacancyno sensitive capabilityget-vacancies-similar-to-resumeno sensitive capabilityget-vacancies-similar-to-vacancyno sensitive capabilityget-vacancyno sensitive capabilityget-vacancy-branded-templates-listno sensitive capabilityget-vacancy-conditionsno sensitive capabilityget-vacancy-draftno sensitive capabilityget-vacancy-draft-listno sensitive capabilityget-vacancy-positions-suggestsno sensitive capabilityget-vacancy-search-keywordsno sensitive capabilityget-vacancy-statsno sensitive capabilityget-vacancy-upgrade-listno sensitive capabilityget-vacancy-visitorsno sensitive capabilityget-webhook-subscriptionsno sensitive capabilityhide-active-responseno sensitive capabilityinvalidate-tokenno sensitive capabilityinvite-applicant-to-vacancyno sensitive capabilityload-artifactno sensitive capabilitymove-saved-resume-searchno sensitive capabilitypost-negotiations-topics-readno sensitive capabilitypublish-resumeno sensitive capabilitypublish-vacancyno sensitive capabilitypublish-vacancy-from-draftno sensitive capabilityput-mail-templates-itemno sensitive capabilityput-negotiations-collection-to-next-stateno sensitive capabilityput-pref-negotiations-orderno sensitive capabilityread-resume-profileno sensitive capabilityrestore-vacancy-from-hiddenno sensitive capabilitysearch-employerno sensitive capabilitysearch-for-resumesno sensitive capabilitysearch-for-vacancy-draft-duplicatesno sensitive capabilitysend-code-for-verify-phone-in-resumeno sensitive capabilitysend-negotiation-messageno sensitive capabilityupdate-applicant-commentno sensitive capabilityupdate-resume-profileno sensitive capabilityupdate-saved-resume-searchno sensitive capabilityupdate-saved-vacancy-searchno sensitive capabilityvacancy-prolongationno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (167 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 4
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.26.0 latest |
B 82/100 | 2 | 1.13.0 | 2026-09-07 |
v1.25.0 |
B 82/100 | 2 | 1.12.1 | 2026-08-24 |
v1.22.1 |
B 82/100 | 2 | 1.12.1 | 2026-08-16 |
v1.22.0 |
B 80/100 | 2 | 1.12.1 | 2026-08-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @sargonpiraev/hh-mcp-server --onlineMore in Business & CRM
Free public tax reference data — GST/VAT, income, company and capital-gains tax rules for 50+ countries.
The approval gate for unattended UCP buying agents — a policy/approval MCP proxy in front of a merchant's UCP checkout endpoint.
Autotask PSA MCP server. Generic entity query/get/create/update across the full REST API plus convenience tools for tickets, companies, contacts, projects, tasks and time entries. AI-safe with readonly mode and destructive-action confirmation. stdio + opt
MCP server for B2C Commerce developer experience tools
Search, compare and contact real-world companies through a public MCP business directory.
Norwegian business register (Brønnøysundregistrene) as an MCP server — companies, roles, subunits and annual accounts, with the register's silent traps encoded as guards.