Tool

ATS-CVC

Overview

A CV gap analysis tool that compares your CV against a job description using the ATS-CVC Framework — highlighting what's missing, undersold, and what a hiring manager will probe on.

ATS-CVC is not a CV writer. It's an analytical tool that identifies gaps, framing mismatches, and interview risks between a specific CV and a specific job description. The framework, backed by evidence and research, is the product — AI is the analytical engine.

The problem: Candidates often have the right experience but describe it in the wrong language for the role. Generic CV advice doesn't help. This tool gives honest feedback on whether you're competitive, and what to fix, before you invest in a full rewrite.

Live Tool

Try the tool →

The tool runs entirely in your browser. No server, no database, no tracking. Bring your own API key from any of the four supported providers.

The Framework

The ATS-CVC Framework produces five structured outputs from any CV + JD pair:

Role FitPercentage score with detailed breakdown of alignment
Seniority CalibrationWhether the CV reads at the right level for the role
Keyword GapPresent, missing, and framing mismatches
Expand These PointsSpecific CV sections underselling their value
Interview Risk FlagsWhat hiring managers are likely to probe on

Four Guardrails

The framework operates under four non-negotiable constraints to prevent CV fraud:

  1. No invented quantification — never suggest metrics not evidenced in the CV
  2. No verb upgrades beyond accuracy — don't overclaim ownership versus contribution
  3. No unevidenced skill assumptions — don't add skills not actually in the CV
  4. Flag every assumption explicitly — make visible every inference that needs verification

These exist because the tool is supposed to make candidates more competitive honestly, not help them misrepresent themselves. A candidate following the tool's advice should still be able to defend every claim on their CV in an interview.

AI Provider Support

Bring your own API key from any of:

API keys are never stored. They live only in memory during the session and are explicitly cleared on page close. No keys are logged, persisted, or transmitted anywhere except to the chosen provider's API.

Architecture

The tool is a single HTML file (~60KB) with no build step, no bundler, no server, and no dependencies to install. This is deliberate.

ArchitectureSingle-file HTML/CSS/JavaScript
PDF parsingPDF.js v3.11.174 (browser-side)
HostingGitHub Pages (static only)
StateNo localStorage, no cookies, no backend
CSPConnections restricted to 4 AI provider domains

The single-file design is intentional: the entire tool is auditable in one view. You can open it, read it, understand what it does, and verify the security claims yourself.

Security Model

DATA FLOW

CV/JD upload → browser text extraction → prompt injection sanitisation ↓ HTTPS to chosen provider ↓ Response rendered in browser ↓ Explicit cleanup on page close

What leaves your machine: Only the CV text, JD text, and your API key, sent directly to the provider you chose. Nothing else.

What's on disk: Nothing. No cookies, no localStorage, no logs, no database.

Input validation: Magic number checks, extension validation, size limits (CV 5MB, JD 2MB), text truncation for cost control (CV 8,000 chars, JD 4,000 chars).

Prompt injection protection: Text sanitisation patterns to prevent the uploaded CV/JD from manipulating the prompt.

Usage

  1. Go to the live tool
  2. Choose an AI provider (Mistral has a free tier)
  3. Get an API key from your chosen provider — links provided in the UI
  4. Upload your CV (PDF, max 5MB)
  5. Upload or paste the job description
  6. Confirm the extracted name and role title
  7. Click Analyze to run
  8. Review the five-part report
  9. Save as PDF using the browser print function

Evidence Base

The framework is backed by primary research sources. It explicitly debunks common CV myths — for example, the widely-repeated "75% ATS auto-rejection" statistic, which turns out to be fabricated and not traceable to any published study.

The methodology documentation (METHODOLOGY.md in the repo) includes:

Local Development

The tool has no build step. Run with any static file server:

# Python
python3 -m http.server 8080

# Node
npx serve .

Then open http://localhost:8080/tool/. File:// URLs work for most functionality, but some browsers restrict API calls from file:// origins due to CORS policy.

Documentation

The repo includes extensive documentation beyond the code:

METHODOLOGY.mdFramework documentation with evidence base
FRAMEWORK_PROMPT.mdMachine-readable system prompt for AI providers
BUILD.mdTechnical decisions and their rationale
SECURITY.mdSecurity architecture and guarantees
PRIVACY.mdPrivacy commitments and data flow