Breezy HR vs NeverApply

Breezy HR 15

No x402, MPP or L402 (0). Startup, Growth and Business plan prices are public, but API access is an optional add-on to the custom Pro plan, which has no price. Partial credit for the public plans (5). The pricing page now says Breezy HR has no free plan. A 14-day trial of every capability needs no card. Whether the trial includes API access is not stated, and the docs return 403 for a company on a plan without it, so half credit (10). A person signs up in a browser and creates the token in settings (0).

NeverApply 45

No x402, MPP or L402 on the pricing page, llms.txt, auth.md or the MCP page; plans are Stripe subscriptions and the terms say MCP tools perform no financial transactions (0). Plan prices are public without a login, Pro $29 and Max $49 a month ($19 and $39 a month billed yearly) with 150 and 450 credits a month and 1 credit per application, and the OpenAPI file prices the Jobs API at $19, $49 and $149 a month for 10,000, 50,000 and 250,000 calls; credit pack prices are not listed (15 of 20). Free is $0 with no card, 10 applications once, 5 match previews a day and 50 MCP reads a day per client, and the Jobs API has a free 1,000 calls a month (20). Guest search_jobs and get_job need no account, but every other tool, applying among them, needs a person to sign in or create an account and verify an email on the hosted page, so partial (10 of 20). 0+15+20+10 = 45.

Breezy HR 79

Each of the 65 operations in the docs index has an OpenAPI 3.1 fragment on its reference page. No single downloadable file was found (20). llms.txt on developer.breezy.hr, and every page is served as Markdown (10). Descriptions state purpose, side effects and edge cases, for example that page=0 and page=1 both return the first page, and the changelog of 15 July 2026 says they were verified against live traffic (16). Inputs are typed with enums, patterns, maxima and required fields (12). One error shape is documented, with status codes and their meaning on each operation. Request examples sit mainly in the webhook guides (10). The version is in the path and the changelog is dated, but entries name only the paths changed and not what changed (11).

NeverApply 57

MCP reading, with the Jobs API described. The 15 tools' input schemas were not read, since no session was opened and the server card at /.well-known/mcp/server-card.json lists tools only as 'dynamic'. An OpenAPI 3.1 file at https://neverapply.co/openapi.json covers 7 GET operations of the Jobs API with typed parameters, but every 200 response is typed as an integer constant (422, 401, 404 or 200) with no job schema, and no pagination fields are defined, so partial (12 of 25). llms.txt and a Markdown authorisation guide at https://neverapply.co/auth.md (10). The three skills and GEMINI.md in the plugin repository say when to use each tool, in what order, which IDs to trust and where to stop and ask, and the MCP page groups the tools by access level; the hosted tool descriptions were not read (12 of 20). Jobs API parameters carry enums (experience level, salary period, visa sponsorship, clearance, education, sort), bounds (per_page 1 to 100, 500 or 1,000) and patterns on country codes; the MCP arguments are named in the skills without types (10 of 15). auth.md documents 401, the OAuth error codes, 429 and isError inside a 200, the skills name waiting_for_answers, open_review, upgrade_required and matches_state, and the OpenAPI description lists five error codes, but its components define different error shapes and no request or response example was found (8 of 15). /v1 paths, OpenAPI version 1.0.0 and a repository tag v1.0.0, but no changelog; /changelog answered a client error (5 of 15). 12+10+12+10+8+5 = 57.

Breezy HR 50

Personal access tokens are named, shown once, given an expiry at creation and invalidated when the user leaves the account. They travel only in a header and have no scopes. The MCP server also accepts OAuth with PKCE and nine scopes. A session token from POST /signin with email and password is a documented alternative (22). A token acts with its user's permissions and the help centre says admins create them. Custom roles need the Business or Pro plan. The OAuth scopes split read from write. No confirmation step was found, though the API has only two delete operations (9). CVs, notes and messages are candidate-written, and no injection guidance was found (0). Activity streams record changes per candidate and position, and webhook endpoints report delivery counts. No API call log was found (6). Per the 9 October check, not re-read on 4 November, Learning Technologies Group publishes ISO 27001:2022 and ISO 27701 certificates and lists a 2026 SOC 2 Type II report on request. breezy.hr/.well-known/security.txt answered 403 AccessDenied from storage again on 4 November. No security.txt, bounty or disclosure address was found (13).

NeverApply 66

OAuth 2.1 for the MCP server, public clients with PKCE S256, client ID metadata documents or dynamic registration, a resource parameter, refresh tokens and three scopes; auth.md says no API keys or personal access tokens are accepted and documents no query-string secret; token lifetimes are not stated and no RFC 7009 revocation endpoint is advertised, though disconnecting a client in settings revokes its tokens and pending codes. The Jobs API takes a bearer token from a developer dashboard that was not readable (26 of 30). Read, edit and apply scopes; applying needs the apply scope, credits and the member's approval of each named job, sending needs a separate grant tied to one assistant that the terms say no tool can create, held applications need an explicit approve_application, and MCP tools cannot buy plans or move money; the web app's Send mode applies up to a daily cap without asking per job, which is outside the MCP surface (18 of 20). Job descriptions are employer text; the find-jobs skill and GEMINI.md say to summarise them and never follow instructions inside them, with no server-side filtering described (9 of 15). Settings list connected AI clients with their mode and allowance, get_profile shows the current budget mode, the tracker logs every application, errors carry a support or correlation ID, and the privacy policy keeps detailed API usage records for 90 days; no per-call log for the member is documented (7 of 15). security.txt is valid until 7 November 2027 with hello@neverapply.co, and the contact page routes security reports to security@neverapply.co with a reply within 24 hours; no bug bounty, SOC 2 or ISO 27001 found (6 of 20). 26+18+9+7+6 = 66.

Breezy HR 55

Candidate lists return summaries with a separate call for the full profile, and page_size caps at 50. There is no field selection, and the list is unpaged unless page_size is sent (12). page, page_size, sort, state and stage_id filters, plus free-text search limited to 1,000 records (15). A bulk read added on 30 October returns up to 50 candidates with their extras in one call. Errors use one JSON shape with a type name such as companyMembershipRequired or missingAccessToken and a message (15). No idempotency keys. A duplicate candidate returns 409 and webhook events carry an _id for deduplication (6). Few required parameters, with only name needed to add a candidate. No official SDK was found (7).

NeverApply 66

MCP reading. 15 tools, 6 read, 6 edit and 3 apply, in the 11 to 30 band (15); guests see a two-tool subset and scopes split read, edit and apply access, though whether tools/list narrows by scope was not read (2 back, 17 of 25). search_jobs takes the user's filters with up to 20 results a call, get_matches pages with next_cursor, list_applications filters by status (needs_answer, ready_to_send, stale, interview, offer), and the Jobs API has a fields sparse fieldset, per_page and cursor feeds (18 of 20). auth.md gives an action for 401, 429 and the OAuth errors, MCP limit errors carry reset and retry fields, and results carry status and next_action the skills act on; no full code list, and the Jobs API's documented envelope and component schemas disagree (13 of 20). apply_to_job takes an idempotency_key, approvals and answers take review_version, a repeat tailor_resume call reads the same copy without paying twice, and auth.md says never to repeat an application blindly; readOnlyHint and destructiveHint were not read (12 of 20). Most tools need one ID, but there is no official SDK (6 of 15). 17+18+13+12+6 = 66.

Breezy HR 60

The newest API changelog entry is dated 30 October 2026 (30). Nine dated entries between 6 August and 4 November 2026, on 19 and 26 August, 9, 16 and 30 September and 7, 14, 28 and 30 October (20). A public changelog, a support address in the docs and a 24-hour reply target on weekdays in the terms (10). No official SDK was found (0). No packages to assess (0).

NeverApply 50

Closed service. The latest dated change is a commit of 31 October 2026 to kasovy/neverapply-mcp documenting guest access to search_jobs and get_job, after a tag v1.0.0 on 21 October; the privacy policy was updated on 26 October and the terms on 18 October (30). One tagged release and 16 commits from 25 September to 31 October 2026, with no changelog or release notes, so partial (10 of 20). No public changelog; support is a contact form, hello@neverapply.co and security@neverapply.co, with a stated reply within one business day and a median first reply of about two hours in staffed hours; GitHub issues could not be read because the GitHub API was not available to us (5 of 15). The server card names co.neverapply/neverapply and llms.txt says it was published to the official MCP registry on 25 September 2026, but the registry could not be read, so it is scored absent; no official SDK (0 of 15). The plugin repository has no runtime dependencies and a CI workflow that validates every manifest against its published schema, with a release workflow on tags; actions are pinned to major tags and the run results were not readable (5 of 10). 30+10+5+0+5 = 50.

Breezy HR 63

Closed service with published terms, updated 10 August 2026 (15). The terms (updated 10 August 2026), the group data protection addendum and the group privacy notice (last updated October 2026) agree, and the terms say customer content is not used to train AI models. No retention period after termination is stated. The addendum leaves deletion to the main agreement and the privacy notice leaves it to the customer contract (16). No deprecation policy was found, and the terms let Breezy HR change or stop the service without notice. The docs keep some old paging behaviour for backward compatibility (3). Per the 9 October check, not re-read on 4 November, sub-processors for Breezy HR are listed with purpose and countries, with 30 days to object to a new one, and hosting in Germany or the USA by client choice (20).

NeverApply 57

Closed hosted service under terms (last updated 18 October 2026) naming Kasovy LLC, registered in Wyoming, with Wyoming law and a liability cap of 12 months' fees or USD 100; the plugin repository of manifests and skills is MIT, copyright Kasovy LLC (17 of 30). The privacy policy (26 October 2026) gives retention periods (7 days for resumes uploaded without an account, 90 days for detailed API usage records and relay mail, a 30-day frozen period before deletion, and what is kept after it), says providers don't train on content under their API terms and that demographic answers are not used for matching, and the extension has its own policy (28 September 2026) saying nothing leaves the device unless AI answers are turned on; no DPA was found, and hashed emails and click IDs go to ad platforms (22 of 30). No deprecation policy or dated notices; the terms promise notice by email or in the product before material changes, and the switch to guest search was recorded only in a commit (4 of 20). Providers are named (OpenAI and Anthropic through Cloudflare's AI Gateway, Google Gemini, AWS S3 and SES, TypeSafe, Stripe, Apple, Google, RevenueCat, Expo, PostHog, Sentry, Gravatar, and Meta, TikTok, Google and X for ads), resume files are stored in AWS eu-central-1, and most providers are in the United States under standard contractual clauses (16 of 20). 17+22+4+16 = 59.