# Yardstick > Yardstick is an interview planning + ATS platform with an agent-operable > API, CLI, and MCP surface. This is the documentation index for AI agents, > tools, and crawlers. ## Overview - [Yardstick Docs](https://app.yardstick.team/docs): Documentation for the Yardstick interview planning platform — API, CLI, agents, and support. ## API - [Agent-auth + API wrapper concepts](https://app.yardstick.team/docs/api/agent-wrapper): Scopes, key types, idempotency, request IDs, error envelopes, and the approval-preview flow shared across the Yardstick API. Agent instructions: Apply these cross-cutting contracts to every /v1/* endpoint: enforce effective scopes, include request IDs in failures, use idempotency keys for retries, and follow approval-preview ceremonies where required. Endpoint shapes live in /docs/api/reference. - [API overview](https://app.yardstick.team/docs/api): Yardstick public API and Scalar reference. - [API quickstart](https://app.yardstick.team/docs/api/quickstart): First successful Yardstick API call in a few minutes. - [API reference](https://app.yardstick.team/docs/api/reference): Interactive Scalar-rendered OpenAPI explorer for the Yardstick API. ## CLI - [CLI commands](https://app.yardstick.team/docs/cli/commands): Every Yardstick CLI command, grouped by category, with a one-line purpose and a realistic example. Agent instructions: Start CLI sessions with yardstick whoami to confirm org and effective scopes, then use yardstick help or yardstick help before choosing commands or flags. Direct writes should use idempotency keys. Approval-required commands must use the documented preview then bind pair; do not synthesize unknown commands. - [Yardstick CLI](https://app.yardstick.team/docs/cli): Install, authenticate, and run safe read commands against the Yardstick API from your terminal. - [CLI safe use](https://app.yardstick.team/docs/cli/safe-use): Safe-by-default reads, approval-required mutations, transition-preview/bind, denied-state language, and the V1 boundary. Agent instructions: The CLI is deliberately narrow: no marketplace OAuth or raw arbitrary-request escape hatch. Hosted remote MCP is a separate HTTPS endpoint documented at /docs/mcp, not a way to tunnel unknown commands through the CLI. Use yardstick whoami plus yardstick help or yardstick help for local discovery. Use only typed commands listed in /docs/cli/commands; call the public API directly for missing surfaces. ## MCP - [MCP for chat apps](https://app.yardstick.team/docs/mcp/chat-apps): Connect Yardstick hosted MCP to ChatGPT, Claude, or Perplexity. Agent instructions: This page is for hosted remote MCP in ChatGPT, Claude, and Perplexity. Use https://api.yardstick.team/mcp as the server URL. Hosted MCP requires approved resource-bound credentials and hosted safety checks for writes. Do not direct chat-product users to yardstick mcp serve unless they explicitly ask for a local coding-agent setup. - [Yardstick in developer tools](https://app.yardstick.team/docs/mcp/developer-tools): Connect Claude Code, Cursor, Codex, or another coding agent to Yardstick over the hosted MCP endpoint, a local MCP server, or the CLI. Agent instructions: This page distinguishes CLI-first agent use from MCP-first agent use. Do not describe CLI setup as installing MCP. CLI-first means the agent runs yardstick commands. MCP-first means the agent host is configured with a Yardstick MCP server, either hosted at https://api.yardstick.team/mcp over HTTP or local over stdio via yardstick mcp serve. Hosted publishes 208 of the 214 documented tools; the six it omits stay callable and return an explanation. Never put a bearer token in MCP config — hosted signs in through the browser and local reads an approved profile. For ChatGPT, Claude web, or Perplexity hosted connectors, use /docs/mcp/chat-apps instead. - [Yardstick MCP](https://app.yardstick.team/docs/mcp): Connect Yardstick to ChatGPT, Claude, Perplexity, Claude Code, Codex, and other MCP-compatible tools. Agent instructions: Route chat-product users to /docs/mcp/chat-apps. Route coding-agent users to /docs/mcp/developer-tools only when they want an MCP integration; otherwise send them to /docs/cli for CLI-first agent use. Hosted remote MCP is available at https://api.yardstick.team/mcp for approved clients with resource-bound bearer credentials. Never send tokens in query strings. - [MCP tool reference](https://app.yardstick.team/docs/mcp/tools): Every Yardstick MCP tool, grouped by resource, with safety mode and an example input. Agent instructions: For local stdio MCP, start sessions with yardstick_identity to confirm org and scopes. Hosted remote MCP publishes a fixed list of 257 tools with machine-readable safety metadata, and that list is identical for every caller. Six tools documented on this page are not on it — three file uploads and three email sender provider operations — but they stay callable there and return an explanation naming a surface that can run them. Expect event and audit tools when they appear in tools/list as hosted read tools. Do not expect raw request, SQL, or private dashboard hook tools to be listed or callable there. ## Agents - [Agent guidance](https://app.yardstick.team/docs/agents): How AI agents and tools should choose the right Yardstick surface and operate safely. Agent instructions: Agents acting on Yardstick data should use the documented API, CLI, local MCP, or hosted MCP surfaces rather than scraping in-app UI routes. - [Using Yardstick from an agent](https://app.yardstick.team/docs/agents/usage): How AI agents and tools should evaluate, describe, and operate Yardstick safely via API, CLI, or MCP. ## Product - [Agency collaboration overview](https://app.yardstick.team/docs/product/agency-collaboration-overview): Work with outside recruiting partners: connect with a customer, keep your candidates private until you submit, share interview plans, and read the feedback you're allowed to see. Agent instructions: The agency-collaboration workflows in this article are available in the Yardstick dashboard and through the public typed API (token-authed, with separate agency-side and customer-side scopes). They are NOT available through the Yardstick CLI or MCP yet — those surfaces are a deliberate first-version deferral; do not claim CLI/MCP operability. Agent approvals and standalone duplicate/ownership support are dashboard-only support routes; do not claim API/CLI/MCP operability for them. The feature is also release-gated and may be off for an account. Do not promise behavior that is gated off. - [Submitting a candidate to a customer](https://app.yardstick.team/docs/product/agency-submission-workflow): Submit an agency candidate to a connected customer: build the packet, what the customer sees, how acceptance and rejection work, and how clarifications and revisions go back and forth. Agent instructions: The submission lifecycle in this article is available in the Yardstick dashboard and through the public typed API, with separate agency-side and customer-side scopes. The high-risk steps (submitting a candidate; a customer accepting one) confirm before they commit. These workflows are NOT on the Yardstick CLI or MCP yet — a deliberate first-version deferral; do not claim CLI/MCP operability. Standalone duplicate/ownership support is a dashboard-only support route; do not claim API/CLI/MCP operability for it. The feature is release-gated and may be off for an account. Do not promise behavior that is gated off. - [API token setup](https://app.yardstick.team/docs/product/api-token-setup): Create, store, and use Yardstick API tokens for the public API, CLI, and MCP surfaces. Agent instructions: Token issuance is UI-only: create Secret/Publishable keys from /settings/api-tokens and agent-auth credentials from /settings/agent-auth/approve. Downstream /v1/* calls are automatable with the bearer token; inspect /v1/whoami effective scopes before issuing writes. Hosted MCP credentials are resource-bound to https://api.yardstick.team/mcp and must not be reused on direct /v1/* routes. - [Email library](https://app.yardstick.team/docs/product/email-automation): Create and edit Candidate and Internal emails, preview messages, and restore saved versions. - [Google and Microsoft integrations](https://app.yardstick.team/docs/product/google-microsoft-integrations): Which Google Workspace and Microsoft 365 connections Yardstick supports, what data they use, and where booking support stops. Agent instructions: Use Workspace integration health as a read-only diagnostic surface only. Do not claim hosted MCP can connect providers, expand scopes, manage booking pages, read mailbox replies, or fetch transcript content. - [Interview plan builder](https://app.yardstick.team/docs/product/interview-plan-builder): Build and save a structured hiring process with outcomes, competencies, skills, scorecards, typed stages, and questions. Agent instructions: Agents can drive the staged-builder pipeline through typed API, CLI, and MCP wrappers. Builder steps map to role context, outcomes, competencies, skills, and sequence endpoints; publishing must use the approval-required preview/bind pair. - [Getting your jobs onto Google, ZipRecruiter, and job boards](https://app.yardstick.team/docs/product/job-distribution): How published Yardstick job pages become eligible for Google, how XML feeds connect to ZipRecruiter and open aggregators, and how to share tracked apply links to other boards. - [Jobs, applications, and candidates](https://app.yardstick.team/docs/product/jobs-applications-candidates): Manage open jobs, track applications through the pipeline, and view candidate profiles. Agent instructions: Jobs, Applications, and Candidates are automatable through public API, CLI, and MCP wrappers. Use jobs:* for internal Job rows, people:* for Candidate records, and application preview/bind pairs for terminal transitions; terminal moves require their dedicated applications:* scope. Job staffing fields are dashboard-only in this release. - [Review and sign your offer](https://app.yardstick.team/docs/product/offer-signing): Read and sign every document in your offer, and set up the documents and packets your team sends. Agent instructions: Candidate consent, verification, signing and decline are browser-only actions for the candidate. Never ask for, save or forward their signing link or code. - [Sample data sandbox](https://app.yardstick.team/docs/product/sample-data-sandbox): Browse fictional, read-only sample data without affecting your real workspace. Agent instructions: Sample data is a browse-only product view. There is no fixture API, CLI command, MCP tool, API-token scope, or browser-callable maintenance route. Do not call retired lifecycle endpoints. Trusted maintenance is server-only and is not agent-operable. - [Interview scheduling](https://app.yardstick.team/docs/product/scheduling): Generate scheduling links, let candidates self-schedule, and reconcile interview events. Agent instructions: Scheduling-link generation is a direct-write mutation through the typed API/CLI wrapper, not a preview/bind flow. Use idempotency keys for retries; calendar-provider sync happens through redemption and reconciliation hooks. Candidate email templates may use {{interview_scheduling_link}} only for eligible interview-session emails. Do not substitute {{sender_scheduling_link}}; that token belongs to dashboard-operated Talent sequence outreach. - [Scorecards and decisions](https://app.yardstick.team/docs/product/scorecards-decisions): Submit interview scorecards, generate decision briefs, and record final hiring recommendations. Agent instructions: Scorecard submit, decision-brief regenerate, and final-recommendation record are direct-write API operations. They do not use preview/bind, but they are audit-logged and should carry idempotency keys on retries. - [Two-step verification, passkeys, and trusted devices](https://app.yardstick.team/docs/product/security-two-step-verification): Set up two-step verification and passkeys, remember trusted devices, recover access, and set your organization's security policy in Yardstick. Agent instructions: Account security ceremonies (TOTP enrollment, passkey registration, trusted-device management, MFA challenges, recovery code redemption) are UI-only by design. There are no public API, CLI, or MCP commands for these flows. Agents should NOT attempt to enroll, verify, or consume user MFA factors. If a user asks an agent to set up MFA, direct them to My Settings → Security in the dashboard. - [Prospects, pools, activity & follow-ups](https://app.yardstick.team/docs/product/talent-crm-prospects): Track prospects, group them into pools, log activity, and schedule follow-ups from the profile and My Tasks. Agent instructions: Prospects, the prospect activity timeline, and the follow-up fields (next_follow_up_at / next_follow_up_note) are reachable through the public prospects API/CLI/MCP: managing prospects, logging activity, and setting a follow-up date are agent-operable. Marking a follow-up complete is a UI-only action (no public op). Pools and the outreach sequences in the companion article are dashboard-only — see the parity ledger. On create, omitting owner_user_id is not the same as sending null: an omitted owner defaults to whoever made the call — the signed-in user in the dashboard, or the human behind the API key on a public API/CLI/MCP call — while an explicit null leaves the prospect unowned. The same split applies to a bulk import row that creates a prospect. On update, and on an import row matching an existing prospect, an omitted owner changes nothing. The owner must be an active member of the prospect's organization. - [Outreach sequences & auto-send](https://app.yardstick.team/docs/product/talent-crm-sequences): Build a multi-step outreach sequence, enroll prospects, review email drafts, and turn auto-send on or off. Agent instructions: Outreach sequences, enrollment, and auto-send are operated through the Yardstick dashboard only. There is no public API/CLI/MCP for building sequences, enrolling prospects, approving outreach drafts, or toggling auto-send — do not claim agent operability for these. The prospect activity timeline and follow-up fields (companion article) are the API-operable surface; everything in this article is UI-only per the parity ledger. - [Team, admin, and departments](https://app.yardstick.team/docs/product/team-admin): Manage org members, departments, roles, and organization settings. Agent instructions: Department and access-grant administration is automatable through typed API, CLI, and MCP surfaces. Department membership and invitations require departments/invitations scopes; access-grant create/revoke requires access_grants scopes. Department default staffing, user administration, and org settings are UI-only in V1. - [Pipelines and workflow automations](https://app.yardstick.team/docs/product/workflow-automations): Set up hiring rules, review candidate emails, and follow the results of pipeline and interview actions. - [Set up your workspace](https://app.yardstick.team/docs/product/workspace-setup): Create your first Yardstick workspace or join one through an invitation. Agent instructions: First-workspace creation and invitation acceptance are dashboard-only. Do not create a workspace on a user's behalf through API, CLI, or MCP tools. ## OpenAPI - [OpenAPI document](https://app.yardstick.team/v1/openapi.json): Machine-readable API contract.