MCP Server
A deliberately small interface for maintaining a CV from the agent where the owner already works. Import an existing source once, then read the current record and submit reviewable diffs. Agents cannot approve or publish changes.
Use the canonical Streamable HTTP endpoint. Public reads need no token; owner tools trigger OAuth consent.
{
"mcpServers": {
"upstand": {
"type": "http",
"url": "https://person.work/api/mcp"
}
}
}The full sync is a deliberately separate first-run operation. Routine maintenance always starts by reading the current record and ends with an owner-reviewed proposal.
Read my existing CV from the source I provide. Import identity, profile facts, competencies, and every experience with sync_my_profile. Do not invent facts. If no Upstand profile exists, include identity; the new record must remain private until I publish it.
Read get_my_career_record first. Preserve stable experience identifiers. Propose only the facts that changed through propose_my_career_change, with a readable diff and the source context. Do not call sync_my_profile for routine maintenance.
career:read, proposal:write and profile:write are granted through an explicit consent screen.Returns one public Career Record whose owner explicitly enabled MCP visibility. Contact values are excluded.
| Authorization | public |
| Permission | public |
| Safety | read-only |
Returns the OAuth-authenticated owner's canonical record. Read this before proposing an ongoing CV update so stable experience identifiers and confirmed facts are preserved.
| Authorization | oauth:email |
| Permission | career:read |
| Safety | read-only |
Adds a structured, human-readable diff to the owner's review inbox. Experience upserts may include a public HTTPS company_logo_url; Upstand imports its own protected copy only after owner approval. Use this for normal maintenance after the initial import; the agent cannot apply or publish it.
| Authorization | oauth:email profile |
| Permission | proposal:write |
| Safety | write, owner approval required |
Explicit initial-import operation that atomically creates a private profile when needed or replaces the owner's profile facts and complete experience list. Experiences may include a public HTTPS company_logo_url; Upstand imports a protected copy. Use null to remove a logo and omit the field to preserve it. Identity is required only for first creation. Never use this for routine updates.
| Authorization | oauth:email profile |
| Permission | profile:write |
| Safety | destructive import, idempotent |
Environments without MCP can read an explicitly shared public profile over HTTPS.
GET https://person.work/api/v1/profiles/{username}
# Fictional example
GET https://person.work/api/v1/profiles/mara-stein?format=summary