StartupKit

Introduction

Kit, the flagship product from StartupKit, collapses four internal operations — recruiting, vulnerability disclosure, compliance training and cold outreach — into one per-seat account. Its defining architectural choice is that external participants never create accounts: candidates, security researchers and trainees each receive a private magic link to a portal served on the company's own domain. Internal work happens in the browser or through an MCP connection exposing more than 190 tools to assistants such as Claude Code, ChatGPT and Cursor. Pricing starts at €6,99 per seat per month after a 30-day trial.

Key Features

Four products, one login. StartupKit splits its surface area into hiring, security, training and outreach, with Compensation Research (beta) included in the base plan. The proposition is not that each module outclasses a dedicated specialist, but that the records live in the same account — so a candidate rejected during Q2 sourcing can later be cross-checked against an outreach campaign without exporting anything.

• Hiring pipelines — the hiring module covers per-role stages, GitHub code assignments with expiry timers, resume extraction, structured team reviews and interview scheduling. The operator dashboard leads with an attention column: five reviews pending, a code task expiring in sixteen hours, twelve candidates waiting for a reply. Scheduling is bundled rather than licensed separately, and candidates book from the same magic link they use to track their application.
• Vulnerability disclosure — the security workflow handles report intake, triage, acknowledgment SLAs (the reference screenshot shows 17 hours remaining), duplicate detection, researcher appeals and bounty approval. Approving a bounty writes a ledger credit and notifies the researcher in a single step. The researcher portal exposes fix verification, payout status, payout details and tax document upload.
• Compliance training — SOC 2, ISO 27001, GDPR and HIPAA course decks paired with a completion register that exports to CSV or PDF: one row per person with employee ID, department, role and completion date. Trainees upload their own evidence, for example a lock-screen screenshot annotated with capture date and machine name. Per-learner fees are not charged.
• Outreach (add-on) — prospects are researched one at a time from LinkedIn, company sites and a knowledge base, then an email is drafted for human approval. Reply detection, bounce handling and sentiment tagging push interested prospects to the top of a shared inbox.
• MCP and the agent layer — 190+ tools with annotations telling the client whether a call reads data, makes a destructive change, or contacts someone outside the company. An MCP client sees a warning such as "destructive · emails a real person · confirm?" before advancing an application or approving a bounty.
• Templates and integrations — 20 role templates across 7 categories in 5 languages, plus Slack, GitHub, Google Calendar, Google Meet, webhooks and any MCP client.

How It Works

Onboarding begins with a signup that requires a card, though the 30-day trial is not charged. Teams then either build stages manually or copy a role template and edit it for their own process. Candidates, researchers and trainees operate entirely through magic links: no passwords, no separate portals to provision, and the portal sits on the company's own domain.

The second working surface is the assistant. A copyable prompt at startupkit.app/agent-setup/prompt.md instructs an agent to fetch and execute setup instructions, and the public MCP server functions before signup. Access is scoped with tokens tied to Kit permissions and can be revoked at any time. Because tool annotations distinguish read-only, destructive and outbound-contact operations, the client decides whether to pause for confirmation — a sensible design that nonetheless leaves final confirmation behaviour dependent on the assistant in use.

The operator/participant/agent framing explains the model clearly: an operator sees everything waiting on a response, a participant sees only their own record, and an agent sees the same state machine through tool calls. Each action that leaves the company's perimeter is labelled as such before execution.

Use Cases

• Early-stage startups that must hire quickly while assembling evidence for SOC 2 or ISO 27001 audits. The training register doubles as auditor-facing documentation with per-person evidence attached.
• Teams running a vulnerability disclosure programme without buying a bug bounty platform: intake, SLA countdowns, appeals, bounty ledger entries, researcher payouts and exports in one place.
• Security leads handling leaked-credential or stored-XSS reports who need documented closure rather than an inbox thread.
• Lean teams adopting agent workflows, where an assistant summarises applications, schedules interviews or drafts outreach while human approval gates everything outbound.
• Agencies and recruiters that need repeatable pipelines per role and per client — the template library shortens setup considerably.
• Compliance owners who need completion records with uploaded evidence instead of a course checkbox.

Pricing & Value

The pricing page lists €6,99 per seat per month, with switching to $8, 29,99 zł or £5.99. Seats can be added or removed and the bill adjusts automatically. The 30-day trial requires a card but is never charged during the trial period; cancelling before day 30 avoids billing. Outreach is the only separately billed add-on at €17,99 per month, while Compensation Research (beta), interview scheduling and the complete security workflow are included. No dedicated startup discount exists — the published seat price applies to every team. Customer data is stored on EU infrastructure with a DPA available to all customers, though connected AI providers operate under their own processing terms.

Value depends on substitution. A team replacing a recruiting subscription, an interview scheduling add-on and a bug bounty platform with one account is comparing €6,99 per seat against several separate line items. Teams needing only one of the four modules will extract less leverage from the bundle.

Final Verdict

StartupKit is an opinionated consolidation play: fewer tools, shared records, passwordless portals for outsiders and an agent layer carrying explicit safety annotations. It is strongest for small technical teams that hire regularly, run some form of disclosure programme and need training evidence for audits — the three concerns genuinely share data here rather than merely sharing a login screen.

The trade-offs are tangible. A card is required up front. Outreach costs extra and prospects interact only through email. Confirmation prompts for destructive agent calls depend on the MCP client, so guardrails are advisory rather than enforced. Data residency is EU-only, which rules the product out for teams with conflicting regional requirements. For its intended audience — startups shipping fast and preparing for a first audit — the bundle is coherent, transparently priced and defensible.