Lever Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Lever Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server for interacting with the Lever.co API. This server allows AI agents to list candidates, retrieve candidate details, create job requisitions, and send fun themed emails.
This Python MCP server provides:
Want to test the OAuth flow locally before deploying? See:
python3 -m venv .venv
source .venv/bin/activate pip install -e .The server requires the following environment variables:
LEVER_API_KEY: Your Lever API key.LEVER_API_BASE_URL (Optional): The base URL for the API. Defaults to https://api.lever.co/v1.For email sending functionality:
GOOGLE_CLIENT_ID: Your Google OAuth client IDGOOGLE_CLIENT_SECRET: Your Google OAuth client secretOAUTH_REDIRECT_URI (Optional): OAuth redirect URI. Defaults to http://localhost:8080/oauth/callbackTOKEN_STORAGE_PATH (Optional): Path to store OAuth tokens. Defaults to ./.oauth_tokensSee OAUTH_SETUP.md for detailed Gmail OAuth setup instructions.
To use the Lever Sandbox environment:
LEVER_API_BASE_URL to https://api.sandbox.lever.co/v1.To run the server:
./run.shTo connect this server to Antigravity, you need to add it to your MCP settings configuration.
~/.antigravity/mcp_settings.json or via the UI).{
"mcpServers": {
"lever": {
"command": "/bin/bash",
"args": ["/Users/andrew/focus/ai/apps/lever-mcp/run.sh"],
"env": {
"LEVER_API_KEY": "your_api_key_here",
"LEVER_API_BASE_URL": "https://api.sandbox.lever.co/v1"
}
}
}
}Note: Replace `/Users/andrew/focus/ai/apps/lever-mcp/run.sh` with the actual absolute path to your `run.sh` file.
Trigger Prompt: Once connected, you can ask Antigravity:
"Can you list the current job candidates from Lever?"
Viewing Logs:
stderr. In Antigravity, these logs are typically visible in the MCP Server logs panel or the application logs.lever_mcp.log if you configured file logging, otherwise they appear in the console output of the server.If you prefer to run the server manually in your terminal and have Antigravity connect to it, you can use the HTTP transport.
The streamable-http transport is the modern, recommended approach for web deployments:
./run_http.shThis will start the server on port 8005.
{
"mcpServers": {
"lever": {
"url": "http://localhost:8005/mcp"
}
}
}The SSE transport is deprecated but still supported:
./run_sse.shThis will start the server on port 8005.
{
"mcpServers": {
"lever": {
"url": "http://localhost:8005/sse"
}
}
}Note: When running manually, you must ensure the `LEVER_API_KEY` environment variable is set in your terminal session before starting the server.
#### list_candidates Lists candidates from your Lever account.
Parameters:
limit (optional): Maximum number of candidates to return (default: 10)offset (optional): Pagination offset tokenExample:
List the first 20 candidates from Lever#### get_candidate Retrieves detailed information about a specific candidate.
Parameters:
candidateId (required): The ID of the candidate to retrieveExample:
Get candidate details for ID abc123#### create_requisition Creates a new job requisition in Lever.
Parameters:
title (required): Job titlelocation (required): Job locationteam (required): Team nameExample:
Create a requisition for Senior Software Engineer in San Francisco for the Engineering team#### send_email Generates and sends a themed email via Gmail API with OAuth 2.0 authentication.
Parameters:
to (required): Recipient email addresstheme (required): Email theme - one of: birthday, pirate, space, medieval, superhero, tropicalsubject (optional): Custom subject line (uses theme default if not provided)cc (optional): CC email addresses (comma-separated)bcc (optional): BCC email addresses (comma-separated)access_token (optional): OAuth access token from agent (on-behalf-of flow)user_id (optional): User identifier for token storage (default: "default")Returns:
Available Themes:
Example:
Send a birthday themed email to [email protected]OAuth Integration:
access_token parameter to send email immediately#### get_oauth_url Get OAuth authorization URL for Gmail access.
Parameters:
user_id (optional): User identifier (default: "default")Returns:
Example:
Get Gmail OAuth authorization URL#### exchange_oauth_code Exchange OAuth authorization code for access token.
Parameters:
code (required): Authorization code from OAuth callbackuser_id (optional): User identifier (default: "default")Returns:
Example:
Exchange OAuth code abc123xyz for access token#### check_oauth_status Check OAuth authentication status.
Parameters:
user_id (optional): User identifier (default: "default")Returns:
Example:
Check Gmail OAuth statusNote: Email tools do not require Lever API credentials and can be used independently.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.