The problem
Candidate sourcing is hours of repetitive judgment: search, open profiles, weigh skills against a spec, write outreach that doesn't read like a template. Automating it usually means fragile anonymous scrapers and — worse — bots that message people without a human in the loop. Talent Agent automates the judgment and keeps the human on the trigger.
Architecture
The agent runs on Kimi K2.6 through the Kimi Agent SDK, which drives the local kimi CLI over stdio JSON-RPC. Browsing goes through Kimi WebBridge into the user's real, logged-in Chrome session — no API keys, no headless browser fighting auth walls.
A run is five phases. DISCOVER: 3–5 web searches collect 20–30 unique LinkedIn profile URLs. SCRAPE: WebBridge navigates each profile and extracts name, headline, location, role, skills, and experience. SCORE: every profile gets 0–100 across five weighted gates — skills 35%, seniority 25%, location 20%, recency 10%, standout 10%. DRAFT: the top ten candidates scoring at least 60 get personalized LinkedIn messages and emails. DELIVER: the ranked shortlist lands in a Notion CRM database and a Telegram chat.
Everything persists to SQLite, and a single-file web dashboard streams the run live over WebSocket — steps, token usage, tool calls, and candidates appearing as they're stored — with mid-flight interrupt and steering ("only London, skip recruiters") plus full replay of past runs.
Safety boundaries
Outreach is never auto-sent: sending is a separate, human-approved, per-candidate action in the UI. Scraping caps at 30 profiles by default (hard ceiling 50), waits about two seconds between navigations, skips auth-walled profiles rather than bypassing them, and keeps candidate PII out of stdout. Because the server drives the user's actual Chrome, it binds to 127.0.0.1 only and runs one job at a time.
Honest limitations
The scoring rubric is a designed heuristic — its weights encode a recruiter's stated priorities, and no ground-truth study measures how well scores predict hiring outcomes. Runs depend on a live, authenticated Chrome session, which is a deliberate trade: robustness and consent over scale.