email-agent-mcp vs Himalaya

email-agent-mcp 50

Graded with the lines for local packages and stdio MCP servers. Installs from the official npm package email-agent-mcp with npx, CI runs on Node 20 (20). A CI workflow with Vitest tests, Codecov and a spec-coverage gate; the run results weren't readable through GitHub's API that day, so partial (20 of 25). Open crash and regression issues couldn't be read because GitHub's API refused our requests for its rate limit (0, unchecked). Semver tags from v0.1.7 to v0.5.0 and auto-categorised GitHub Releases as the changelog, with no breaking changes marked in what we read (10 of 15). Pre-1.0 (0). Total 50.

Himalaya 84

Read with the local-software lines, since the owner runs the binary. Official packages exist on crates.io at 2.2.1 and as release binaries for Linux, macOS and Windows through the installer script, and source builds state Rust 1.89. Homebrew, Arch and Scoop versions were not checked (18 of 20). The repository held 243 #[test] functions in 44 files when the Tests and Audit workflow badges read passing on 9 October 2026 (master holds 345 in 56 files on 2 November; the badges were not re-read). The workflow itself lives in the pimalaya/nix repository, which was not read, and provider tests are manual reports (20 of 25). Three open issues and two open pull requests, with one bug open since 15 March 2026 that has five comments, per the 9 October check (22 of 25). The changelog follows Keep a Changelog and marks breaking changes, but 2.2.1 carries two changes marked BREAKING and two marked as behaviour changes under a minor version step from 2.1.0 (9 of 15). Version 2.2.1, and the project site labels the tool stable (15).

email-agent-mcp 42

Apache-2.0 with a LICENSE file (30). SECURITY.md says tokens and mail are handled locally over stdio with no network listener, and the broker README says mail never reaches the broker and refresh tokens aren't stored. The broker has no published privacy policy (22 of 30). No deprecation policy (0). No telemetry was found in the README or package manifests, and none is stated either way (10 of 20). Total 62.

Himalaya 72

The editorial half. Dual licence, MIT or Apache-2.0, on the source and on crates.io since 2.0.0 (30). No privacy statement exists. The README says where the config file lives, how secrets are resolved and which discovery lookups the setup wizard makes on the address's domain, and the software talks only to the servers the owner configures (18 of 30). No deprecation policy was found. SECURITY.md marks 1.x and 0.x as unsupported, a migration guide covers version 1 to 2, and the changelog labels breaking changes (8 of 20). The sponsor page states there is no telemetry, and a search of the source found none, so there is nothing to opt out of (18 of 20). The provenance half is computed from the provenance block.

email-agent-mcp 67

OAuth to the person's own provider with the scopes each profile needs, tokens in the OS keychain, and an observe profile with Microsoft read scopes only. Gmail uses gmail.readonly and gmail.compose, and its code exchange and refreshes relay through a UseJunior-hosted broker that holds the client secret and says it stores no refresh tokens (25 of 30). Send allowlists, delete off by default behind an operator variable and a caller flag, inbox rules that block forwarding and deletion, and protected system folders (20). Receive allowlists limit whose mail the agent acts on; no guidance on treating message bodies as untrusted was found (9 of 15). No log of tool calls beyond the mailbox's own history (3 of 15). SECURITY.md with private reporting and acknowledgement within 3 business days, semgrep in CI; no bug bounty or advisories (10 of 20). Total 67.

Himalaya 43

Himalaya has no credential model of its own. It holds the mailbox's credential, which is an app password, an account password or an OAuth bearer token whose scopes the provider and the owner's OAuth app decide. Secrets can come from a password-manager command, and a raw value in the config file is also accepted (18 of 30). No read-only mode and no confirmation before a send or delete were found. Deletion is trash-first, and a build can leave out the smtp Cargo build option (8 of 20). Mail is untrusted content. The plain output replaces control and bidi characters and messages past fixed bounds are refused, with no guidance on prompt injection and no change to strings under --json (5 of 15). --log-level and --log-file write a trace of each run, with no audit log (6 of 15). SECURITY.md names 2.x as supported and sends reports to the public issue tracker. A cargo audit workflow and a deny.toml policy run in CI. No security.txt, bug bounty, certification or published advisory was found (6 of 20).

email-agent-mcp 79

27 tools in the full profile, the 11 to 30 band, plus the observe profile as a read-only subset (20 of 25). List and search tools filter and page; we read the tool table, not every parameter (16 of 20). Errors are sanitised and use stable reasons such as NOT_SUPPORTED, failing closed before a Gmail mutation (15 of 20). readOnlyHint and destructiveHint on the tools in source; sends take no idempotency key (16 of 20). One npx command and a setup wizard for OAuth and mailbox choice; TypeScript only (12 of 15). Total 79.

Himalaya 65

A CLI adds no tool definitions to context. --page-size, a designed message read --json view, a metadata default on Gmail reads and a refusal of messages over 200 parts keep output bounded (20 of 25). --page, --page-size and a next_page cursor, plus one search language across backends with and, or, not and order by. Microsoft Graph refuses flag clauses (18 of 20). Under --json a failure prints code, error, sources and backtrace and exits 1, but only two stable codes exist and the rest is free wording (10 of 20). No idempotency key or dry run was found. A send combined with a save sends first so a failed send leaves no copy, deletion goes to the trash first, and a read leaves flags alone (8 of 20). Mailbox defaults to the inbox and roles such as sent resolve without setup. One CLI, with no SDK in a second language (9 of 15).

email-agent-mcp 79

Tools are defined with typed input schemas that the MCP SDK publishes as JSON Schema (25). README in five languages, AGENTS.md, CLAUDE.md and GEMINI.md; no llms.txt, which a local server doesn't need (5 of 10). The README's tool table marks each tool read, write or destructive and states provider limits, such as Gmail deletes removing drafts only (15 of 20). Typed inputs with options such as list_style (12 of 15). Setup examples per client and documented error behaviour, such as NOT_SUPPORTED on Gmail and sanitised errors (10 of 15). Semver tags and GitHub Releases (12 of 15). Total 79.

Himalaya 70

Graded on the CLI. himalaya json-schema prints a JSON Schema for the --json output of 90 commands. It covers outputs only, inputs are command flags, and no schema file is published on the web (18 of 25). No llms.txt. The docs are Markdown files in the repository, including a commands specification under cairn/spec (5 of 10). Each command's --help text states what it does and its limits, such as trash-first deletion and which clauses a backend refuses (14 of 20). Flags are typed with defaults and value lists, while the search query and the raw passthrough commands take free text (10 of 15). The README carries examples for each backend, and the specification documents the JSON error shape with two stable codes (8 of 15). Semantic versions and a dated changelog back to 2021 (15).

email-agent-mcp 84

v0.5.0 was tagged and published on 5 November 2026 (30). Nine npm releases in the 90 days from 8 August, v0.3.0 to v0.5.0 (20). Pull requests up to #234 merged in the history, all by the one maintainer; issue responses couldn't be read through GitHub's API that day (10 of 25). io.github.UseJunior/email-agent-mcp is in the official MCP registry with 0.5.0 marked latest (15). CI, commitlint, semgrep and Codecov workflows (9 of 10). Total 84.

Himalaya 78

Version 2.2.1 was tagged on 2 October 2026, 31 days before this check, and crates.io still carries it as the newest version (20, cause time). Three tags in the 90 days from 4 August, 2.1.0 on 16 August and 2.2.0 and 2.2.1 on 2 October (20). Commits to master continue, 63 since the 2.2.1 tag with the newest on 2 November 2026. Open issues and pull requests per the 9 October check (three open issues, one bug open since March 2026), not re-read on 2 November because github.com refuses our requests (22 of 25). crates.io carries 2.2.1 from the day of the tag. Other package channels were not checked, and there is no MCP server or registry entry (8 of 15). A lockfile, cargo audit and a dependency policy in CI, with io-pimdir pinned to a git revision instead of a release (8 of 10). 20+20+22+8+8 = 78.