Bullhorn vs Himalayas Remote Jobs MCP

Bullhorn 5

Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page gives Bullhorn Starter at $99 and Bullhorn Core at $165 per user per month and quotes the other plans. The partner route to the API is an annual platform fee with overage charges, neither published (5). The small agency pricing page says Bullhorn has no free trial at present, and the partner FAQ says free access is given to nobody (0). Customers get OAuth keys through a support ticket and partners through a signed contract, an invoice and a security assessment (0). Pricing and the no-trial answer re-read on 5 November 2026. 0+5+0+0 = 5.

Himalayas Remote Jobs MCP 50

No machine payment protocol; paid extras return Stripe checkout links (0). Plus price public (10 of 20). Free search and posting (20). Public tools need no account (20). 0 + 10 + 20 + 20 = 50.

Bullhorn 76

The REST API change log's newest entry is the June 2026 release (2026.6), dated to its month. Bullhorn's own packages are newer. @bullhorn/bullhorn-types v1.143.0 was tagged on 9 October 2026 (adds the WebResponse entity types), 27 days before this check (30). Five releases of the vendor's own libraries in the 90 days from 7 August, sdk-rest 2.6.3 (12 August, new entities), 2.7.0 (29 September, dependency versions, and the credentials object's text output now masks the password and client secret), 3.0.0 (29 September, Spring 7 and Java 17) and @bullhorn/bullhorn-types 1.142.0 (28 September) and v1.143.0 (9 October), all five in full (20). Closed service with a public change log, a developer ticket form and forums named in the guide. We could not read the help centre (6, the earlier partial, kept). Current official libraries in Java and TypeScript (15). @bullhorn/taurus 3.9.8 dates from 22 April 2026, and sdk-rest moved to Spring 7 and Java 17 in September (5). 30+20+6+15+5 = 76.

Himalayas Remote Jobs MCP 50

Registry update and tag v1.0.3 on 21 October 2026 (30). Fewer than three dated releases found in 90 days (0). Repository issues not read (0). Official registry entry app.himalayas/mcp (15). Docs repository with server.json; server source not public (5 of 10). 30 + 0 + 0 + 15 + 5 = 50. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Bullhorn 50

Read with the hosted rubric, for the REST API. Statuspage at status.bullhorn.com, read from its history page on 5 November 2026, with 94 components by product and cluster (Bullhorn ATS/CRM and its CLS clusters, a Sandbox component) and no REST API component (15, the reading for a vendor page with no component for the product). The history page covers 1 September to 5 November 2026. It lists 37 incidents across all products, 24 minor, six major, four critical and three with no impact. On Bullhorn ATS/CRM the one full outage was on 21 October, when users on every cluster could not log in from 1.35 pm to 6.10 pm ET, which we read as one major (10). The 1 September Greenshades integration fault and the 15 October Daxtra Search & Match fault touch one integration or function, so they count as minor. 7 to 31 August is not on the page and gets no credit of its own. No numeric rate limit is in the API reference. The partner FAQ gives an allowance of 200,000 calls a month, and the guide says login rates are strictly limited without a figure (5, the earlier partial, kept). The error table says to wait 1 second on 429 and retry until successful, which is backoff guidance alone. No idempotency keys or safe-retry guidance for writes was found (10). No SLA was found on the public site (0). The API is generally available at version 2.0 (10). 15+10+5+10+0+10 = 50.

Himalayas Remote Jobs MCP 25

No status page found (0). No history (5). Some limits documented with numbers (100 candidate searches a day, 10 messages a minute) (10 of 15). No retry guidance (0). No SLA (0). Not labelled beta; the old SSE endpoint is retired with 410 Gone (10). 0 + 5 + 10 + 0 + 0 + 10 = 25.

Bullhorn 47

No OpenAPI file or other machine-readable contract is shown or linked on the docs pages (0). /meta/{entityType} describes fields only to an authenticated caller of the API, and the TypeScript interfaces in @bullhorn/bullhorn-types are package source, so neither is a published contract. The docs are one HTML page built from Markdown sources in a public GitHub repository, and www.bullhorn.com/llms.txt is a product index that links to the developer site. No Markdown is served for agents (4). Each operation states its purpose with parameter tables, and the entity guide describes 91 entities field by field (12). Parameters are marked required or optional and entity fields carry types and lengths, but query and where are free-form Lucene and JPQL strings (9). Every operation has a curl example and a sample response. Errors are a table of ten status codes with no bodies (9). Login takes a version parameter, and a change log lists releases from 2024.5 to 2026.6 (13). 0+4+12+9+9+13 = 47.

Himalayas Remote Jobs MCP 70

79 tools read from tools/list (78 visible without sign-in) with JSON Schema inputs and 33 enums (25). llms.txt (10). Clear descriptions with when to use them (15 of 20). Mostly typed, with comma-separated string lists and two free-form objects (8 of 15). Example prompts and parameter tables (7 of 15). Registry version 1.0.3 and repository tags, no changelog (5 of 15). 25 + 10 + 15 + 8 + 7 + 5 = 70.

Bullhorn 67

Closed service. The Master Subscription Agreement is not published, and the legal terms page links only to product supplements. The API Fair Use Policy is public and lets Bullhorn suspend access or discontinue the APIs at any time (10). The privacy policy of 20 May 2026 covers the service platforms, lists machine learning and product enhancement among its purposes, and keeps data while an account is active with no fixed periods. No public DPA was found beyond the standard contractual clauses pages (18). No deprecation policy was found. The reference notes that fields=* is deprecated and will be blocked, without a date (3). The sub-processor list, version 25 August 2026, gives each provider's purpose, location and covered services, with a form to subscribe to changes (20). Privacy policy (20 May 2026) and sub-processor list (25 August 2026) re-read on 5 November 2026. 10+18+3+20 = 51.

Himalayas Remote Jobs MCP 46

Closed service under terms naming Himalayas Remote Jobs Pty Ltd (15). Privacy policy under the Australian Privacy Principles; retention periods not given (15 of 30). Dated retirement of the SSE endpoint (10 of 20). Subprocessors not found (5 of 20). 15 + 15 + 10 + 5 = 45.

Bullhorn 28

OAuth 2.0 authorisation code grant with a client ID and secret issued by Bullhorn, ten-minute access tokens and rotating refresh tokens, exchanged for a BhRestToken session. No scopes were found, so a session carries all the rights of the API user (20). The guide shows the username, password, client secret and access token as URL query parameters, and BhRestToken may be sent in the query string, which takes 10 off (10). Access follows the API user's entitlements per entity and action, readable at /entitlements. No read-only mode or confirmation step for deletes or /massUpdate was found (8). Candidate CVs and notes are untrusted text, and no guidance on handling them was found. The fair use policy requires written permission before any AI tool is connected, which is a contract term and not a mitigation (0). EntityEditHistory records field changes and events carry the user and transaction. No per-call API log for the operator was found (5). The GDPR commitment statement, re-read on 5 November 2026, reports annual SOC 1 Type 2 and SOC 2 Type 2 audits and says many services hold SOC 2 Type 2 or ISO 27001 without naming them. No report, security.txt, disclosure policy or bug bounty was found, and www.bullhorn.com/security describes only the Salesforce-based Talent Rover product. A SOC 2 claim with no report or disclosure route scores 5. 10+8+0+5+5 = 28.

Himalayas Remote Jobs MCP 42

OAuth 2.1 with PKCE and client metadata documents (25 of 30). Read-only public set; writes such as send_message and job posts are annotated (12 of 20). Job posts and recruiter messages are third-party text with no injection guidance (0). No audit log (0). No security.txt (404) or certifications found (5 of 20). The privacy policy follows the Australian Privacy Principles. 25 + 12 + 0 + 0 + 5 = 42.