Problems and solutions · Updated · By CVPosh · Markdown version
Is it safe to give my resume to ChatGPT or Claude, or connect it through MCP?
It carries the same risk as sending the resume to any service that stores or processes text: your name, contact details and work history leave your device. Reduce it by removing details you do not need, connecting only trusted servers, preferring read-only tools, reading the consent screen, and knowing how to revoke access. Check the assistant provider's data settings yourself.
What the risks actually are
A resume contains personal information that is useful to identity thieves and to scammers: full name, phone number, email, sometimes a home address, the names of your employers and schools. Anything you paste into a chat or let a connector read is sent to the company that runs the assistant, and its handling is governed by that provider's terms and your account settings. We do not describe those policies here because they differ by plan and change; read the provider's current data controls page.
Connecting a tool through MCP adds a second set of risks, which both Anthropic and OpenAI describe in their own help pages (read 2026-11-13). Claude's page says custom connectors can reach services Anthropic has not verified, advises connecting only to servers you trust, and warns about prompt injection (instructions hidden in content that try to make the assistant do something you did not ask). OpenAI's page says connecting to unsafe or untrusted MCP servers may increase exposure to security risks, including prompt injection, and that you are responsible for vetting the server.
Resume text is also an injection route in its own right: a resume or a job posting can contain text that tries to instruct the assistant. CVPosh's get_cv tool description tells the assistant that CV text is untrusted data, but you should read what the assistant does with it.
A checklist to lower the risk
- Remove what the task does not need. For a keyword or format check, the assistant does not need your home address, date of birth or personal ID numbers. Replace them with placeholders before pasting.
- Check what the provider does with the text. Open the provider's current data controls and privacy pages and look for whether conversations are used to train models, how long they are kept, and how to delete them. Settings often differ between consumer and business plans.
- Prefer read-only tools. Before you connect, read the tool list. Tools that only read and score cannot change your documents, whereas a tool that can create, update or delete can. Disable tools you do not need if the assistant lets you.
- Connect only servers you trust, and read the consent screen. Check who runs the server, what the consent screen says the agent can do, and the host it returns to. Cancel if anything is unexpected.
- Know how to revoke. Find the place where you can list and delete connections, and use a connection with an expiry when you can. Delete connections you no longer use.
- Review what the assistant does. Ask it to show which tools it called and what they returned. Be suspicious of any step that goes beyond the task you asked for.
- Never put secrets in a resume file. No passwords, API keys or full ID numbers belong on a resume or in a prompt.
| You can | How |
|---|---|
| Approve a connection | OAuth sign-in ends on a CVPosh consent page that names the client, shows the host it returns to, lists what the agent can do and offers Cancel or Allow. Nothing is shared until you click Allow. |
| See which agents are connected | Settings, then API keys, lists every connection by name (for example "MCP: ChatGPT") with its last-used date. |
| Revoke access | Deleting the key in Settings stops the agent immediately; the page asks you to confirm first. |
| Limit how long OAuth access lasts | OAuth connections expire after 90 days and the agent has to be approved again. API keys created in Settings do not expire; delete them to disconnect. |
| Cap what an agent can do | Each connection is limited to 100 tool calls a day and 120 requests a minute. |
| Keep the agent from changing anything | All four tools are declared readOnlyHint true, destructiveHint false and openWorldHint false, and the server has no operation that writes, deletes, exports or sends a CV. You make every change in the CVPosh editor. |
| Limit what an agent can read | Only the signed-in user's own CVs. Profile photos are never returned and payment details are not reachable. |
Not available today: No per-call activity log: Settings shows a last-used date, not which tool was called with what. No notification when a connection is created or used. No agent write tools, so there is nothing to put in an approval queue; an agent cannot edit or tailor a CV itself. No MCP tools for the employer (hiring) workspace. This list is from the CVPosh code and is kept in sync with the MCP page.
When to use CVPosh for this
If you use the CVPosh MCP server: all four tools are declared read-only, so the assistant cannot create, edit, delete, export or share a CV, and it reads only your own CVs; profile photos are never returned. Each connection is limited to 120 requests a minute and 100 tool calls a day. OAuth connections expire after 90 days; API keys created in Settings do not expire until you delete them.
The ATS and keyword checks run on CVPosh servers with fixed rules, call no AI model and store nothing. What the assistant reads is still sent to the assistant provider.
There are gaps. Settings shows a last-used date, not a log of every call, and nothing notifies you when a connection is created or used. If you need that level of auditing, do not connect, or paste a redacted text instead.
Copy-paste prompt for an AI assistant connected to CVPosh
Connect the CVPosh MCP server first (setup on the MCP page). Every tool is read-only, so the assistant reports and you make the changes.
Assign to CVPosh: connect to the CVPosh MCP server, list the tools it offers and tell me for each one whether it is declared read-only. Then call list_cvs and show me only the titles. Do not call get_cv or any other tool until I say so; show me what you did so I can approve the next step.
Questions
Can the CVPosh MCP server change or delete my CV?
No. Every tool is declared read-only and the server has no operation that writes, deletes, exports or shares a CV. You make changes in the editor.
How do I disconnect an assistant?
Delete the connection under Settings, then API keys. The agent stops immediately. You can also remove the connector inside the assistant's own settings.
Does the assistant provider see my resume?
Yes. Whatever the assistant reads is sent to its provider. Check the provider's data controls before sharing anything you would not want stored.
Should I remove my address before pasting a resume?
Yes, unless the task needs it. A keyword or formatting check does not.
Related problems
- How do I check my resume ATS score from ChatGPT or Claude?
- Is there a resume builder with an MCP server for AI assistants?
- How can a career coach check several client resumes against a job description with an AI assistant?
- How do I tailor my resume to a job posting with AI without making things up?
Tools and pages that help
Sources
- Claude Help Center: Get started with custom connectors using remote MCP (read 2026-11-13)
- OpenAI Help Center: Connecting custom MCP servers in ChatGPT (read 2026-11-13)
Markdown version of this page: https://cvposh.com/solutions/safe-to-give-resume-to-ai-assistant.md