# email-agent-mcp vs Himalaya (slim)

> email-agent-mcp scores 65.9 (B) to Himalaya's 57.9 (C) for mailbox access. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/email-agent-mcp-vs-himalaya.md (~4,650 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/email-agent-mcp-vs-himalaya.json · canonical https://www.anchorterminal.com/compare/email-agent-mcp-vs-himalaya
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

email-agent-mcp scores 65.9 (B) on agent readiness against Himalaya's 57.9 (C), and leads in 4 of 7 scored categories. Himalaya leads on reliability and transparency & trust. Both do mailbox access.

- email-agent-mcp: B 65.9, rank #397 of 1510 · https://www.anchorterminal.com/tools/email-agent-mcp.min.md
- Himalaya: C 57.9, rank #774 of 1510 · https://www.anchorterminal.com/tools/himalaya.min.md
- email-agent-mcp, good for A person who wants an agent working in their own Outlook mailbox, or reading and drafting in Gmail, with guardrails. Ahead on Schema & documentation, 79 against 70; Agent ergonomics, 79 against 65; Security & auth, 67 against 43; Maintenance & community, 84 against 78. Also Runs on your own machine; No incidents deducted, where Himalaya loses 9 points for them.
- Himalaya, good for An agent with a shell that must work in one person's existing mailbox on any provider, including plain IMAP hosts, without a hosted intermediary. Ahead on Reliability, 84 against 50; Transparency & trust, 72 against 42. Also Free to start without a card.

| Category | email-agent-mcp | Himalaya |
| --- | --- | --- |
| Reliability (16%) | 50 | 84 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 79 | 70 |
| Agent ergonomics (13%) | 79 | 65 |
| Security & auth (14%) | 67 | 43 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 84 | 78 |
| Transparency & trust (7%) | 42 | 72 |

| Fact (where they differ) | email-agent-mcp | Himalaya |
| --- | --- | --- |
| Kind | MCP server | SDK + MCP |
| Vendor | UseJunior | Pimalaya |
| Transports | stdio |  |
| Auth | OAuth | OAuth or key |
| Licence | Apache-2.0 | MIT OR Apache-2.0 |
| Tools exposed | 27 | none |
| Read-only variant documented | yes | no |
| MCP registry | `io.github.UseJunior/email-agent-mcp` | not listed |
| Last release | 2026-11-05 | 2026-10-02 |
| Popularity | 394 npm/wk | 7.4k stars |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Reliability, Himalaya +34: email-agent-mcp 50 (Graded with the lines for local packages and stdio MCP servers. Installs from the official npm package `email-agent-mcp` with npx, CI runs on Node 20 (20). A CI workflow with Vitest tests, Codecov and a spec-coverage gate; the run results weren't readable through GitHub's API that day, so partial (20 of 25). Open crash and regression issues couldn't be read because GitHub's API refused our requests for its rate limit (0, unchecked). Semver tags from v0.1.7 to v0.5.0 and auto-categorised GitHub Releases as the changelog, with no breaking changes marked in what we read (10 of 15). Pre-1.0 (0). Total 50.); Himalaya 84 (Read with the local-software lines, since the owner runs the binary. Official packages exist on crates.io at 2.2.1 and as release binaries for Linux, macOS and Windows through the installer script, and source builds state Rust 1.89. Homebrew, Arch and Scoop versions were not checked (18 of 20). The repository held 243 `#[test]` functions in 44 files when the Tests and Audit workflow badges read passing on 9 October 2026 (master holds 345 in 56 files on 2 November; the badges were not re-read). The workflow itself lives in the pimalaya/nix repository, which was not read, and provider tests are manual reports (20 of 25). Three open issues and two open pull requests, with one bug open since 15 March 2026 that has five comments, per the 9 October check (22 of 25). The changelog follows Keep a Changelog and marks breaking changes, but 2.2.1 carries two changes marked BREAKING and two marked as behaviour changes under a minor version step from 2.1.0 (9 of 15). Version 2.2.1, and the project site labels the tool stable (15).)
- Transparency & trust, Himalaya +30: email-agent-mcp 42 (Apache-2.0 with a LICENSE file (30). SECURITY.md says tokens and mail are handled locally over stdio with no network listener, and the broker README says mail never reaches the broker and refresh tokens aren't stored. The broker has no published privacy policy (22 of 30). No deprecation policy (0). No telemetry was found in the README or package manifests, and none is stated either way (10 of 20). Total 62.); Himalaya 72 (The editorial half. Dual licence, MIT or Apache-2.0, on the source and on crates.io since 2.0.0 (30). No privacy statement exists. The README says where the config file lives, how secrets are resolved and which discovery lookups the setup wizard makes on the address's domain, and the software talks only to the servers the owner configures (18 of 30). No deprecation policy was found. SECURITY.md marks 1.x and 0.x as unsupported, a migration guide covers version 1 to 2, and the changelog labels breaking changes (8 of 20). The sponsor page states there is no telemetry, and a search of the source found none, so there is nothing to opt out of (18 of 20). The provenance half is computed from the provenance block.)
- Security & auth, email-agent-mcp +24: email-agent-mcp 67 (OAuth to the person's own provider with the scopes each profile needs, tokens in the OS keychain, and an `observe` profile with Microsoft read scopes only. Gmail uses `gmail.readonly` and `gmail.compose`, and its code exchange and refreshes relay through a UseJunior-hosted broker that holds the client secret and says it stores no refresh tokens (25 of 30). Send allowlists, delete off by default behind an operator variable and a caller flag, inbox rules that block forwarding and deletion, and protected system folders (20). Receive allowlists limit whose mail the agent acts on; no guidance on treating message bodies as untrusted was found (9 of 15). No log of tool calls beyond the mailbox's own history (3 of 15). SECURITY.md with private reporting and acknowledgement within 3 business days, semgrep in CI; no bug bounty or advisories (10 of 20). Total 67.); Himalaya 43 (Himalaya has no credential model of its own. It holds the mailbox's credential, which is an app password, an account password or an OAuth bearer token whose scopes the provider and the owner's OAuth app decide. Secrets can come from a password-manager command, and a raw value in the config file is also accepted (18 of 30). No read-only mode and no confirmation before a send or delete were found. Deletion is trash-first, and a build can leave out the `smtp` Cargo build option (8 of 20). Mail is untrusted content. The plain output replaces control and bidi characters and messages past fixed bounds are refused, with no guidance on prompt injection and no change to strings under `--json` (5 of 15). `--log-level` and `--log-file` write a trace of each run, with no audit log (6 of 15). SECURITY.md names 2.x as supported and sends reports to the public issue tracker. A cargo audit workflow and a `deny.toml` policy run in CI. No security.txt, bug bounty, certification or published advisory was found (6 of 20).)
- Agent ergonomics, email-agent-mcp +14: email-agent-mcp 79 (27 tools in the full profile, the 11 to 30 band, plus the `observe` profile as a read-only subset (20 of 25). List and search tools filter and page; we read the tool table, not every parameter (16 of 20). Errors are sanitised and use stable reasons such as NOT_SUPPORTED, failing closed before a Gmail mutation (15 of 20). readOnlyHint and destructiveHint on the tools in source; sends take no idempotency key (16 of 20). One npx command and a setup wizard for OAuth and mailbox choice; TypeScript only (12 of 15). Total 79.); Himalaya 65 (A CLI adds no tool definitions to context. `--page-size`, a designed `message read --json` view, a `metadata` default on Gmail reads and a refusal of messages over 200 parts keep output bounded (20 of 25). `--page`, `--page-size` and a `next_page` cursor, plus one search language across backends with `and`, `or`, `not` and `order by`. Microsoft Graph refuses flag clauses (18 of 20). Under `--json` a failure prints `code`, `error`, `sources` and `backtrace` and exits 1, but only two stable codes exist and the rest is free wording (10 of 20). No idempotency key or dry run was found. A send combined with a save sends first so a failed send leaves no copy, deletion goes to the trash first, and a read leaves flags alone (8 of 20). Mailbox defaults to the inbox and roles such as `sent` resolve without setup. One CLI, with no SDK in a second language (9 of 15).)
- Schema & documentation, email-agent-mcp +9: email-agent-mcp 79 (Tools are defined with typed input schemas that the MCP SDK publishes as JSON Schema (25). README in five languages, AGENTS.md, CLAUDE.md and GEMINI.md; no llms.txt, which a local server doesn't need (5 of 10). The README's tool table marks each tool read, write or destructive and states provider limits, such as Gmail deletes removing drafts only (15 of 20). Typed inputs with options such as `list_style` (12 of 15). Setup examples per client and documented error behaviour, such as NOT_SUPPORTED on Gmail and sanitised errors (10 of 15). Semver tags and GitHub Releases (12 of 15). Total 79.); Himalaya 70 (Graded on the CLI. `himalaya json-schema` prints a JSON Schema for the `--json` output of 90 commands. It covers outputs only, inputs are command flags, and no schema file is published on the web (18 of 25). No llms.txt. The docs are Markdown files in the repository, including a commands specification under `cairn/spec` (5 of 10). Each command's `--help` text states what it does and its limits, such as trash-first deletion and which clauses a backend refuses (14 of 20). Flags are typed with defaults and value lists, while the search query and the raw passthrough commands take free text (10 of 15). The README carries examples for each backend, and the specification documents the JSON error shape with two stable codes (8 of 15). Semantic versions and a dated changelog back to 2021 (15).)
- Maintenance & community, email-agent-mcp +6: email-agent-mcp 84 (v0.5.0 was tagged and published on 5 November 2026 (30). Nine npm releases in the 90 days from 8 August, v0.3.0 to v0.5.0 (20). Pull requests up to #234 merged in the history, all by the one maintainer; issue responses couldn't be read through GitHub's API that day (10 of 25). io.github.UseJunior/email-agent-mcp is in the official MCP registry with 0.5.0 marked latest (15). CI, commitlint, semgrep and Codecov workflows (9 of 10). Total 84.); Himalaya 78 (Version 2.2.1 was tagged on 2 October 2026, 31 days before this check, and crates.io still carries it as the newest version (20, cause time). Three tags in the 90 days from 4 August, 2.1.0 on 16 August and 2.2.0 and 2.2.1 on 2 October (20). Commits to master continue, 63 since the 2.2.1 tag with the newest on 2 November 2026. Open issues and pull requests per the 9 October check (three open issues, one bug open since March 2026), not re-read on 2 November because github.com refuses our requests (22 of 25). crates.io carries 2.2.1 from the day of the tag. Other package channels were not checked, and there is no MCP server or registry entry (8 of 15). A lockfile, cargo audit and a dependency policy in CI, with `io-pimdir` pinned to a git revision instead of a release (8 of 10). 20+20+22+8+8 = 78.)