Best tools for HR and recruiting AI agents in 2026

Your recruiting agent reads a Greenhouse note, then moves the candidate to a rejected stage. That stage change sends the rejection email. Nobody on the hiring team asked for it. The offer amount and the candidate phone number are now in a chat log.

This post compares five ways to connect an agent to HR systems, and names the records you should block before a write goes out.

What to check before an agent touches candidate data

Judge the tool on the write, not on the demo.

• Can a rule read the arguments and refuse the call before the ATS sees it?
• Where does the credential live, and can the model read it?
• Can the response hide pay, government IDs, or bank details before the model sees them?
• If a person must approve a write, what happens when nobody answers?
• How long do you keep the audit, and can you turn storage off?

A sync product copies records on a schedule. A runtime checks the call your model just chose.

Five tools and the job each one fits

Greenhouse, when Greenhouse is the only system. Greenhouse describes a permission-aware MCP so approved agents can use Greenhouse data inside a structured hiring process. Use it when every workflow stays inside Greenhouse. You still need another path for Lever, Ashby, or Workday. Their overview of AI inside structured hiring is the vendor description, not a cross-ATS policy file.

Merge, when you read many customer ATS accounts through one schema. Merge's ATS catalog includes Greenhouse, Lever, Ashby, iCIMS, and Workday. On the October 2026 unified pricing page, the first 3 production Linked Accounts are free, then $650 a month covers up to 10, and each account after that is $65. Professional, which is contract priced, adds custom fields and field-level scopes. The common model is the right cut for a directory of candidates. It is the wrong cut when the agent needs a Greenhouse-only offer field. The same pricing page lists Remote Data and Authenticated Passthrough for that gap. Unified API trade-offs for B2B products go further on normalized schemas.

Apideck, when jobs and applicants are enough. Apideck prices by active consumer. The October 2026 pricing table lists Launch at $599 a month for one category and 25 consumers, and Scale at $1,299 a month for three categories at 100 consumers. Their Greenhouse ATS resource page marks jobs and applicants as live, and applications as not supported. If the agent must update an application, this connector does not offer that resource.

Workato, when the recruiter runs the same steps every time. The October 2026 pricing page lists Standard, Business MCP, Enterprise MCP, and Workato ONE, and does not publish a dollar price. Pre-built MCP servers start on Business MCP. You draw the recipe. The agent calls what you published. That fits a known path, such as "new applicant, create the scorecard task." It is a weak fit when the model invents the next call.

Swytchcode, when the model picks the call. You download a bundle, enable specific methods, and keep rules in policies.json. A block never sends the request. On the October 2026 pricing page, Free is $0 for 100 live commands a month with allow and deny rules. Approval on Slack or Telegram starts on Business at $149 a month. If nobody answers within 48 hours, the call does not run. Enterprise can run in your own AWS, Azure, or GCP account, and you choose the region. Cloud plans do not offer that region choice.

Records an agent should not write

Allow a read of the candidate name and the current stage. Block the writes that change someone's job offer or notify them.

• Offer amount, equity, and start date
• Stage changes that email the candidate
• EEO and other demographic fields
• Government IDs and bank details
• Scorecards that other interviewers have not filed

A response rule can also hide pay fields in a read before the model sees the body. Policies can redact a response after the call returns. Rules you keep in git shows allow, deny, and approval in the same file. Keeping the API key out of the model covers where the credential sits.

Block the write before it leaves your machine

Follow this step to install the CLI. Use one of these.

npm install -g swytchcode

irm https://cli.swytchcode.com/install.ps1 | iex

curl -fsSL https://cli.swytchcode.com/install.sh | sh

Confirm the install, then start the project.

swy --version
swy init

Search with your ATS name. Download the bundle only if search prints one. Do not assume a bundle exists until search shows it. swy discover only searches bundles you already downloaded. Copy a canonical ID from the local list. Enable the reads you mean to allow. Leave offer writes out.

swy search <ats>
swy get <name from search>
swy list methods
swy add <canonical_id from swy list methods>

Connect the provider. There is no .env file in this project. Swytchcode keeps credentials in its own local store and reads them when a call runs.

swy auth connect <provider>

Add a block for any write you did not enable. The command shape, after you paste a real ID from swy list methods, looks like this.

swy policy add --non-interactive --name "Block offer writes" \
  --target "<canonical_id from swy list methods>" \
  --action POLICY_BLOCKED \
  --message "Offer writes stay with a recruiter"
swy policy validate

A blocked call exits with code 6 and does not reach the ATS. Turn on workspace log storage only if you want the hosted log. Retention is 7 days on Free, 30 days on Pro, and 90 days on Business. swy audit stats reads local history without a sign-in.

Run swy search for your ATS, add only the read methods, and block every write you have not reviewed with a person.

Related reading

• A security checklist before company data. What to settle before candidate records enter a chat.
• Human approval for a tool call. When a stage change should wait for a recruiter.
• Log every API call an agent makes. How long the record of a candidate read actually lasts.
• Managed OAuth for agents. Who holds the ATS login when more than one customer connects.

FAQ

Can an agent update a candidate stage without emailing them?

Only if that ATS splits "set the stage" from "send the email," and you enabled the quiet method. If one method does both, block it. Confirm the split with swy info on the ID you copied from swy list methods.

Does a unified HR API stop the agent from seeing pay data?

A common model can omit fields. It does not, by itself, hide a field that the sync included. If pay is in the payload, you still need a response rule, a field scope, or a decision not to request that object.

Where should candidate PII sit if we cannot use a US or EU region on the cloud plan?

Swytchcode Cloud does not let you pick a region. Enterprise runs in your AWS, Azure, or GCP account, and the pricing page lists India, EU, US, and other regions. Application data and API keys stay in that account. OAuth sign-in still goes through Swytchcode's sign-in service.

What happens if a recruiter never answers an approval?

On Business and Enterprise, the call does not run if it is denied or if nobody responds within 48 hours. Free and Pro have allow and deny only. They do not include approval workflows.