Ashby vs Himalayas Remote Jobs MCP

Ashby 81

Graded on the public API, with the beta MCP server noted. Statuspage site at status.ashbyhq.com with separate Ashby API, Reports API and Job Post API components (20). The history feed, read on 2 November, lists 13 incidents between 4 August and 2 November 2026. Each touches one integration, one region, one feature or some users, namely Certn (7 to 9 August), Dropbox Sign (31 August and 21 October), bulk import (10 September), South East Asia (21 to 28 September), delayed data in search, reports and the API (5 October), candidate booking (6 October), job board submissions for 43 minutes (14 October), reporting data, AI functions and BambooHR (21 October), sporadic access failures through Cloudflare (23 October) and an hour of platform latency (26 October). None was an API outage, so minor only (20). 1,000 requests a minute per key, 15 report starts a minute and 120 MCP requests a minute (15). Reports document 429 with advice to wait and retry, and a changelog entry dated 14 October 2026 in its address and posted on 21 October says per-key rate limits answer 429 and partner-wide throttling adds an X-RateLimit-Scope header. No Retry-After header, backoff schedule or idempotency key was found (8). A 99.9 per cent uptime SLA with service credits is published, and applies only where the customer's Master Service Agreement references it (8). The API is generally available, the MCP server is beta (10). 20 + 20 + 15 + 8 + 8 + 10 = 81.

Himalayas Remote Jobs MCP 25

No status page found (0). No history (5). Some limits documented with numbers (100 candidate searches a day, 10 messages a minute) (10 of 15). No retry guidance (0). No SLA (0). Not labelled beta; the old SSE endpoint is retired with 410 Gone (10). 0 + 5 + 10 + 0 + 0 + 10 = 25.

Ashby 10

No x402, MPP or L402 (0). Foundations prices are public by company size, $300 to $900 a month. Plus and Enterprise are by quote, and nothing is priced per call (10). No free tier or trial found, and each plan starts with a sales call (0). An Organisation Admin creates the key in the web app (0). Total 10.

Himalayas Remote Jobs MCP 50

No machine payment protocol; paid extras return Stripe checkout links (0). Plus price public (10 of 20). Free search and posting (20). Public tools need no account (20). 0 + 10 + 20 + 20 = 50.

Ashby 78

Closed service with published customer terms, AI terms and product-specific terms (15). Privacy policy, a DPA on request, a 30-day erasure clause after termination and AI terms that rule out training on customer data. Retention is set by each customer, and no default period is published (22). API versions have a lifecycle table and at least six months' notice before retirement. No version has been deprecated yet, so no dated notice exists (17). Sub-processors are listed with purposes on the trust centre, and data is stored in the United States on AWS (16). Total 70.

Himalayas Remote Jobs MCP 46

Closed service under terms naming Himalayas Remote Jobs Pty Ltd (15). Privacy policy under the Australian Privacy Principles; retention periods not given (15 of 30). Dated retirement of the SSE endpoint (10 of 20). Subprocessors not found (5 of 20). 15 + 15 + 10 + 5 = 45.

Ashby 63

API keys are scoped read or write per module, start with no permissions, show creator and last use, and can be disabled. They are long-lived, with no expiry setting found. The MCP server uses per-user OAuth with dynamic client registration (26). Confidential jobs, private fields and on-behalf-of requests are off unless an admin opts in. The MCP note tool drafts for confirmation. API writes have no approval step (15). Resumes, emails and notes are candidate-written, and no injection guidance was found (0). Keys show last use and every response has a request id. auditLog.list exists but is in closed beta (8). SOC 2 Type 2 and SOC 1 Type 2, third-party penetration tests, a disclosure policy and public security notices. No bug bounty or security.txt found (14). Total 63. Re-read on 2 November, the trust centre still lists SOC 2 Type 2 and SOC 1 Type 2, the disclosure policy is unchanged, and auditLog.list is still in closed beta, with the surface each action came through added on 15 October 2026.

Himalayas Remote Jobs MCP 42

OAuth 2.1 with PKCE and client metadata documents (25 of 30). Read-only public set; writes such as send_message and job posts are annotated (12 of 20). Job posts and recruiter messages are third-party text with no injection guidance (0). No audit log (0). No security.txt (404) or certifications found (5 of 20). The privacy policy follows the Australian Privacy Principles. 25 + 12 + 0 + 0 + 5 = 42.

Ashby 64

The newest changelog entry is dated 30 October 2026, three days before the check (30). The changelog's first three pages alone hold 30 dated entries from 4 September to 30 October 2026, none marked breaking (20). Public changelog and a support address that asks for the request id. No public forum or issue tracker found (10). No official SDK found, and the MCP server isn't in the official MCP registry under an Ashby namespace, per the 7 October check (0). Reference pages and their OpenAPI definitions are regenerated with each versioned release. There are no packages to check (4). 30 + 20 + 10 + 0 + 4 = 64.

Himalayas Remote Jobs MCP 50

Registry update and tag v1.0.3 on 21 October 2026 (30). Fewer than three dated releases found in 90 days (0). Repository issues not read (0). Official registry entry app.himalayas/mcp (15). Docs repository with server.json; server source not public (5 of 10). 30 + 0 + 0 + 15 + 5 = 50. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Ashby 82

Every endpoint page carries an OpenAPI 3.1 definition with shared schemas, but we found no single downloadable spec file (20). llms.txt indexes 244 reference pages, all served as Markdown (10). Descriptions state purpose and the permission needed, and some say when to use a neighbouring endpoint, such as application.create against applicationForm.submit (14). Inputs are typed with UUID patterns, required lists, maximums and additionalProperties: false. auditLog.list filters are free strings checked against a published vocabulary (13). Request and response examples on each page. Error codes are listed for some endpoints, and the only documented response status is 200 with a success or error body (10). Date-based versions with a lifecycle table, version.list and a dated changelog (15). Total 82.

Himalayas Remote Jobs MCP 70

79 tools read from tools/list (78 visible without sign-in) with JSON Schema inputs and 33 enums (25). llms.txt (10). Clear descriptions with when to use them (15 of 20). Mostly typed, with comma-separated string lists and two free-form objects (8 of 15). Example prompts and parameter tables (7 of 15). Registry version 1.0.3 and repository tags, no changelog (5 of 15). 25 + 10 + 15 + 8 + 7 + 5 = 70.