{ "data": { "a": { "slug": "himalaya", "name": "Himalaya", "vendor": "Pimalaya", "vendorUrl": "https://pimalaya.org", "kind": "sdk", "category": "mailbox-access", "summary": "Himalaya is an open-source command-line email client from the Pimalaya project. It lists, searches, reads, composes and sends mail over IMAP, SMTP, JMAP, the Gmail API, Microsoft Graph and local stores, with JSON output for scripts and agents.", "url": "https://www.anchorterminal.com/tools/himalaya", "markdownUrl": "https://www.anchorterminal.com/tools/himalaya.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/himalaya.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/himalaya.json", "repo": "https://github.com/pimalaya/himalaya", "license": "MIT OR Apache-2.0", "transports": [], "packages": [ { "registry": "cargo", "name": "himalaya" } ], "auth": "mixed", "authNotes": "Himalaya issues no credential of its own. It signs in to the mailbox with what the provider accepts, which is an app password or account password over SASL for IMAP and SMTP, a bearer token or basic auth for JMAP, and one OAuth 2.0 bearer token for the Gmail API or Microsoft Graph. Each secret is read from a shell command such as a password manager, or from a raw value in the config file. Version 2 ships no OAuth flow, so tokens come from an external broker such as `ortie` and an OAuth app the owner registers with Google or Microsoft.", "pricing": "free", "pricingNotes": "Free software with nothing to buy, and the sponsor page states there is no paid tier. An agent can start with the binary and a mailbox credential. Pimalaya sells optional partnerships, from EUR 3,000 a year for email providers and EUR 5,000 for integrators, and describes a EUR 12 a year sign-in service for Gmail and Microsoft 365 as planned and not built (checked 2026-10-09).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the source or pimalaya.org (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 7412, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://github.com/pimalaya/himalaya", "capabilities": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts" ], "tags": [ "open-source", "local", "cli", "rust", "free", "no-card", "imap", "smtp", "jmap", "gmail", "microsoft-graph", "json-output" ], "lastRelease": "2026-10-02", "graded": true, "anchor": { "graded": true, "score": 64.5, "grade": "B", "agentReady": false, "rank": 348, "ranked": true, "rankOf": 950, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 88, "payments": 60, "reliability": 84, "schema": 70, "security": 43, "transparency": 69 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-09" }, "negative": -3, "negativeNotes": [ "2 October 2026. Until 2.2.1, `message send` passed the `Bcc:` header through SMTP unchanged, so every recipient could see the blind recipients. Issue #747 reported it against 2.1.0 on 12 September 2026, the fix was committed on 26 September and released on 2 October, and the changelog documents it. No security advisory was published. Fixed and documented, so the smaller deduction applies (https://github.com/pimalaya/himalaya/issues/747)" ], "verdict": "One binary reaches mailboxes on IMAP, JMAP, Gmail and Microsoft Graph with the same commands, and `--json` output has a JSON Schema for each command. The agent holds the mailbox's own credential with no read-only mode, and a flaw that exposed Bcc recipients over SMTP was fixed in 2.2.1 on 2 October 2026.", "bestFor": "An agent with a shell that must work in one person's existing mailbox on any provider, including plain IMAP hosts, without a hosted intermediary.", "strengths": [ "Shared commands for mailboxes, envelopes, flags, messages and attachments run the same way over IMAP, JMAP, Gmail, Microsoft Graph, Maildir and mbox", "`himalaya json-schema` prints a JSON Schema for the `--json` output of 90 commands, and `message read --json` returns one designed view on every backend", "Secrets come from a shell command such as `pass show`, so a password or token need not sit in the config file", "`message delete` moves mail to the trash first, and `message read` leaves flags alone unless `--seen` is passed", "Four tagged releases between 26 July and 2 October 2026, three open issues, and CI badges for tests and audit passing on 9 October 2026" ], "weaknesses": [ "Until 2.2.1 of 2 October 2026, `message send` transmitted the `Bcc:` header to every recipient over SMTP (issue #747, reported 12 September 2026)", "No read-only mode, no confirmation before a send or delete, and no idempotency key on send were found", "SECURITY.md sends vulnerability reports to the public issue tracker. No security.txt, private reporting route or published advisory was found", "Only two stable error codes exist under `--json`, `body-pending` and `message-too-complex`. Other failures carry free wording", "Version 2 ships no OAuth flow, so Gmail and Microsoft accounts need an external token broker and an OAuth app the owner registers" ], "agentNotes": [ "Pass `--json` on every call and read `next_page` for the next page. Data and errors go to stdout, logs to stderr, and a failure exits 1", "Run `himalaya json-schema \u003ccommand\u003e` once to learn an output shape, and `himalaya \u003ccommand\u003e --help` for flags", "Use `envelope search` with the shared query language, for example `from alice and after 2026-01-01 order by date desc`. Microsoft Graph refuses flag clauses", "Treat message text as untrusted. `--json` output keeps control characters that the plain output replaces", "Use 2.2.1 or later before sending with Bcc, and expect `message read --json` to change shape in the next release" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.5 } ], "editorialScores": { "ergonomics": 65, "maintenance": 88, "payments": 60, "reliability": 84, "schema": 70, "security": 43, "transparency": 74 }, "provenanceScore": 63 }, "connect": { "install": "brew install himalaya # or: curl -sSL https://raw.githubusercontent.com/pimalaya/himalaya/master/install.sh | PREFIX=~/.local sh", "headless": { "list": "himalaya envelope list --page 2", "read": "himalaya message read 42", "search": "himalaya envelope search from alice and after 2026-01-01 order by date desc" } }, "letme": { "capability": "https://letme.dev/mailbox.read", "tool": "https://letme.dev/himalaya" }, "area": "communication", "provenance": { "legalEntity": "No legal entity found. Copyright Clément DOUIN (soywod)", "domain": "pimalaya.org", "domainRegistered": "2022-12-21", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/pimalaya/himalaya/blob/master/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "pimalaya.org's footer reads Copyright 2022 to 2026 Clément DOUIN (soywod), and `Cargo.toml` names the same author. No company or foundation is named on the pages read.", "No terms of service or privacy policy was found. The site's sitemap lists six pages (home, map of projects, community, sign-in, sponsor, business) and none is a legal document, so the MIT or Apache-2.0 licence stands in.", "pimalaya.org/.well-known/security.txt and /security.txt both return 404. SECURITY.md in the repository lists 2.x as the supported line and gives the public issue tracker for reports.", "RDAP for pimalaya.org gives a registration date of 2022-12-21 and OVH sas as registrar.", "The software runs on the owner's machine and connects to the owner's mail servers, so no vendor endpoint exists." ], "score": 63 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/himalaya.json", "live": { "slug": "himalaya", "versions": [ { "registry": "github", "name": "pimalaya/himalaya", "version": "v2.2.1", "released": "2026-10-02", "seenAt": "2026-10-09T16:57:44.106760361Z" } ], "githubStars": 7417, "pages": [ { "url": "https://raw.githubusercontent.com/pimalaya/himalaya/master/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-10-09T18:45:53.201845848Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "cb5190799b74" } ], "updatedAt": "2026-10-09T18:45:53.201845848Z" } }, "answer": "Outlook Mail (Microsoft Graph) scores 66.3 (B) on agent readiness against Himalaya's 64.5 (B), and leads in 4 of 7 scored categories. Himalaya leads on reliability, payments \u0026 pricing and maintenance \u0026 community.", "b": { "slug": "outlook-mail-graph", "name": "Outlook Mail (Microsoft Graph)", "vendor": "Microsoft", "vendorUrl": "https://learn.microsoft.com/en-us/graph/api/resources/mail-api-overview", "kind": "http-api", "category": "mailbox-access", "summary": "Mail endpoints of Microsoft Graph for Outlook, Microsoft 365 and Exchange Online mailboxes. An app reads, searches, drafts, sends and files messages over REST with OAuth tokens from Microsoft Entra ID.", "url": "https://www.anchorterminal.com/tools/outlook-mail-graph", "markdownUrl": "https://www.anchorterminal.com/tools/outlook-mail-graph.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/outlook-mail-graph.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/outlook-mail-graph.json", "repo": "https://github.com/microsoftgraph/msgraph-sdk-javascript", "license": "MIT (SDKs)", "transports": [ "http" ], "remoteUrl": "https://graph.microsoft.com/v1.0", "packages": [ { "registry": "npm", "name": "@microsoft/microsoft-graph-client" }, { "registry": "pypi", "name": "msgraph-sdk" } ], "auth": "oauth", "authNotes": "OAuth 2.0 tokens from Microsoft Entra ID, after a person registers an app. No app review by Microsoft was found for mail permissions. Delegated permissions (Mail.ReadBasic, Mail.Read, Mail.ReadWrite, Mail.Send) act as a signed-in user and need only that user's consent. Application permissions reach every mailbox in a tenant, need admin consent, and can be limited to chosen mailboxes with RBAC for Applications in Exchange Online. Personal Outlook.com accounts work with delegated permissions.", "pricing": "byo-plan", "pricingNotes": "Mail calls aren't metered. The only metered Graph API is SharePoint and OneDrive `assignSensitivityLabel` at $0.00185 a call (https://learn.microsoft.com/en-us/graph/metered-api-list). A work mailbox needs an Exchange Online or Microsoft 365 licence, and Microsoft's plan price page refused our reader on 8 October 2026. A free personal Outlook.com account lets an agent start without a contract. The Microsoft 365 developer programme sandbox is free only to members who qualify, such as Visual Studio subscribers. The Mail MCP server needs a Microsoft 365 Copilot licence.", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Graph mail reference or the metered API list (checked 2026-10-08).", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": 835, "npmWeekly": 2882852, "pypiWeekly": 1578201, "asOf": "2026-10-08" }, "docsUrl": "https://learn.microsoft.com/en-us/graph/api/resources/mail-api-overview", "openapi": "https://raw.githubusercontent.com/microsoftgraph/msgraph-metadata/master/openapi/v1.0/openapi.yaml", "capabilities": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts", "mailbox.sync" ], "tags": [ "hosted", "official", "oauth", "openapi", "webhooks", "typescript", "python", "enterprise" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 66.3, "grade": "B", "agentReady": false, "rank": 296, "ranked": true, "rankOf": 950, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 81, "maintenance": 76, "payments": 35, "reliability": 60, "schema": 93, "security": 71, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": -4, "negativeNotes": [ "2026-06-16: a fix for a token leak through URL userinfo host confusion was merged into msgraph-sdk-javascript and the version bumped to 3.0.8, but on 8 October 2026 npm still serves 3.0.7 from September 2023 and the repository has no published advisory. Exploiting it needs an attacker-influenced URL passed to the client (https://github.com/microsoftgraph/msgraph-sdk-javascript/commit/5438ae90f50ef15d3656f0cf9c5485deee351f19, https://registry.npmjs.org/@microsoft/microsoft-graph-client/latest)" ], "verdict": "Delegated permissions split reading without bodies (Mail.ReadBasic), full reading, writing and sending, and delta queries and change notifications keep a local copy in step. sendMail takes no idempotency key and returns 202 before delivery, and each app is held to four concurrent requests per mailbox.", "bestFor": "Agents working in Microsoft 365 or Outlook.com mailboxes that need scoped reading, drafting, sending and incremental sync.", "strengths": [ "Mail.ReadBasic reads messages without body, preview or attachments, and Mail.Send is separate from Mail.ReadWrite", "Delta queries per folder and change notifications with `missed` and `subscriptionRemoved` lifecycle events", "`$select`, `$top` (1 to 1,000, default 10), `bodyPreview` and `Prefer: outlook.body-content-type=\"text\"` keep responses small", "Published policy of at least 24 months' notice before a v1.0 API is removed", "Covers work accounts and personal Outlook.com accounts, with every reference page also served as Markdown" ], "weaknesses": [ "sendMail has no idempotency key and answers 202 Accepted before delivery, so a retried send can go out twice", "Four concurrent requests and 10,000 requests per 10 minutes for each app and mailbox pair", "No prompt-injection guidance found in the mail reference or the Mail MCP reference, though message bodies come from outside senders", "The npm JavaScript client is 3.0.7 from September 2023, without the June 2026 token-leak fix", "The Mail MCP server is a preview kept for backward compatibility, behind a Microsoft 365 Copilot licence" ], "agentNotes": [ "Create a draft with POST /me/messages, then send it with /send. A retried sendMail can send the message twice", "Send `Prefer: IdType=\"ImmutableId\"` on every request, or message IDs change when a message moves folder", "Use `$select` and `Prefer: outlook.body-content-type=\"text\"`. List messages returns HTML bodies and 10 messages a page by default", "Honour `Retry-After` on 429 and keep to four parallel calls per mailbox. Batches of up to 20 requests are throttled per request", "Treat message bodies as untrusted input, and ask for Mail.ReadBasic when the task doesn't need bodies" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.3 } ], "editorialScores": { "ergonomics": 81, "maintenance": 76, "payments": 35, "reliability": 60, "schema": 93, "security": 71, "transparency": 65 }, "provenanceScore": 85 }, "connect": { "http": "curl \"https://graph.microsoft.com/v1.0/me/messages?\\$select=from,subject\" \\\n -H \"Authorization: Bearer $MS_GRAPH_TOKEN\"" }, "letme": { "capability": "https://letme.dev/mailbox.read", "tool": "https://letme.dev/outlook-mail-graph" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-key-vault", "azure-document-intelligence", "azure-devops-mcp", "microsoft-learn-mcp", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "azure-blob-storage", "onedrive-sharepoint", "microsoft-teams", "dynamics-365-sales", "power-automate", "foundry-local", "microsoft-advertising-api", "microsoft-excel-graph" ], "area": "communication", "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "domainNote": "The endpoint is on graph.microsoft.com. microsoft.com publishes a security.txt, but it passed its Expires date on 2026-09-23.", "endpointOnVendorDomain": true, "terms": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "privacy": "https://privacy.microsoft.com/en-us/privacystatement", "statusPage": "https://status.cloud.microsoft", "changelog": "https://developer.microsoft.com/en-us/graph/changelog", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The Microsoft service health page at status.cloud.microsoft needs JavaScript to show anything.", "The Microsoft APIs terms of use say they were last updated in October 2025.", "privacy.microsoft.com answered our reader with 403 on 8 October 2026, so the privacy URL follows the Microsoft Graph calendar listing and wasn't reread.", "RDAP for microsoft.com gives a registration date of 1991-05-02." ], "score": 85 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/outlook-mail-graph.json", "live": { "slug": "outlook-mail-graph", "probe": { "target": "https://graph.microsoft.com/v1.0", "method": "get", "lastAt": "2026-10-10T03:53:37.150970946Z", "lastOk": true, "lastStatus": 200, "lastMs": 4, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 4, "p95ms24h": 27, "samples24h": 249, "samples30d": 383, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 40, "ok": 40 } ] }, "versions": [ { "registry": "github", "name": "microsoftgraph/msgraph-sdk-javascript", "version": "3.0.7", "released": "2023-09-19", "seenAt": "2026-10-09T17:11:35.702199752Z" }, { "registry": "npm", "name": "@microsoft/microsoft-graph-client", "version": "3.0.7", "seenAt": "2026-10-09T17:11:35.299392252Z" }, { "registry": "pypi", "name": "msgraph-sdk", "version": "1.64.0", "released": "2026-10-06", "seenAt": "2026-10-09T17:11:35.586402129Z" } ], "githubStars": 836, "npmWeekly": 2346460, "pypiWeekly": 1617170, "securityTxt": { "url": "https://microsoft.com/.well-known/security.txt", "state": "expired", "expires": "2026-09-23T16:00:00.000Z", "checkedAt": "2026-10-09T15:40:16.790821018Z" }, "updatedAt": "2026-10-10T03:53:37.150970946Z" } }, "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Pimalaya", "b": "Microsoft", "name": "Vendor" }, { "a": "no (local only)", "b": "https://graph.microsoft.com/v1.0", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Free", "b": "Your plan", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT OR Apache-2.0", "b": "MIT (SDKs)", "name": "Licence" }, { "a": "none", "b": "10", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "2026-10-02", "b": "2026-10-06", "name": "Last release" }, { "a": "no document linked", "b": "2025-10-01", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-09-01", "name": "Privacy policy last updated" }, { "a": "", "b": "yes", "name": "Customer content may train models" }, { "a": "", "b": "yes", "name": "Terms restrict automated access" }, { "a": "", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "7.4k stars", "b": "835 stars, 2.9M npm/wk, 1.6M PyPI/wk", "name": "Popularity" } ], "faq": [ { "answer": "Outlook Mail (Microsoft Graph) scores 66.3 (B) on agent readiness against Himalaya's 64.5 (B), and leads in 4 of 7 scored categories. Himalaya leads on reliability, payments \u0026 pricing and maintenance \u0026 community.", "question": "Which is better for AI agents, Himalaya or Outlook Mail (Microsoft Graph)?" }, { "answer": "No hosted endpoint is listed for Himalaya. Outlook Mail (Microsoft Graph) has a hosted endpoint at https://graph.microsoft.com/v1.0.", "question": "Can an agent call Himalaya and Outlook Mail (Microsoft Graph) without installing anything?" }, { "answer": "Himalaya is open source (MIT OR Apache-2.0). No open-source release is listed for Outlook Mail (Microsoft Graph).", "question": "Are Himalaya and Outlook Mail (Microsoft Graph) open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 84 against 60", "Payments \u0026 pricing, 60 against 35", "Maintenance \u0026 community, 88 against 76" ], "also": [ "Free to start without a card", "Open source" ], "goodFor": "An agent with a shell that must work in one person's existing mailbox on any provider, including plain IMAP hosts, without a hosted intermediary.", "slug": "himalaya", "watchFor": "Until 2.2.1 of 2 October 2026, `message send` transmitted the `Bcc:` header to every recipient over SMTP (issue #747, reported 12 September 2026)" }, { "aheadOn": [ "Schema \u0026 documentation, 93 against 70", "Agent ergonomics, 81 against 65", "Security \u0026 auth, 71 against 43", "Transparency \u0026 trust, 75 against 69" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Agents working in Microsoft 365 or Outlook.com mailboxes that need scoped reading, drafting, sending and incremental sync.", "slug": "outlook-mail-graph", "watchFor": "sendMail has no idempotency key and answers 202 Accepted before delivery, so a retried send can go out twice" } ], "job": { "capability": "mailbox.read", "name": "Mailbox access" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aurinko-email-vs-himalaya.json", "title": "Aurinko Email API vs Himalaya", "url": "https://www.anchorterminal.com/compare/aurinko-email-vs-himalaya" }, { "json": "https://www.anchorterminal.com/compare/aurinko-email-vs-outlook-mail-graph.json", "title": "Aurinko Email API vs Outlook Mail (Microsoft Graph)", "url": "https://www.anchorterminal.com/compare/aurinko-email-vs-outlook-mail-graph" }, { "json": "https://www.anchorterminal.com/compare/emailengine-vs-himalaya.json", "title": "EmailEngine vs Himalaya", "url": "https://www.anchorterminal.com/compare/emailengine-vs-himalaya" }, { "json": "https://www.anchorterminal.com/compare/emailengine-vs-outlook-mail-graph.json", "title": "EmailEngine vs Outlook Mail (Microsoft Graph)", "url": "https://www.anchorterminal.com/compare/emailengine-vs-outlook-mail-graph" }, { "json": "https://www.anchorterminal.com/compare/fastmail-vs-himalaya.json", "title": "Fastmail API (JMAP) vs Himalaya", "url": "https://www.anchorterminal.com/compare/fastmail-vs-himalaya" }, { "json": "https://www.anchorterminal.com/compare/fastmail-vs-outlook-mail-graph.json", "title": "Fastmail API (JMAP) vs Outlook Mail (Microsoft Graph)", "url": "https://www.anchorterminal.com/compare/fastmail-vs-outlook-mail-graph" }, { "json": "https://www.anchorterminal.com/compare/gmail-api-vs-himalaya.json", "title": "Gmail API vs Himalaya", "url": "https://www.anchorterminal.com/compare/gmail-api-vs-himalaya" }, { "json": "https://www.anchorterminal.com/compare/gmail-api-vs-outlook-mail-graph.json", "title": "Gmail API vs Outlook Mail (Microsoft Graph)", "url": "https://www.anchorterminal.com/compare/gmail-api-vs-outlook-mail-graph" }, { "json": "https://www.anchorterminal.com/compare/himalaya-vs-nylas-email.json", "title": "Himalaya vs Nylas Email API", "url": "https://www.anchorterminal.com/compare/himalaya-vs-nylas-email" }, { "json": "https://www.anchorterminal.com/compare/himalaya-vs-unipile.json", "title": "Himalaya vs Unipile", "url": "https://www.anchorterminal.com/compare/himalaya-vs-unipile" }, { "json": "https://www.anchorterminal.com/compare/himalaya-vs-zoho-mail.json", "title": "Himalaya vs Zoho Mail API", "url": "https://www.anchorterminal.com/compare/himalaya-vs-zoho-mail" }, { "json": "https://www.anchorterminal.com/compare/nylas-email-vs-outlook-mail-graph.json", "title": "Nylas Email API vs Outlook Mail (Microsoft Graph)", "url": "https://www.anchorterminal.com/compare/nylas-email-vs-outlook-mail-graph" }, { "json": "https://www.anchorterminal.com/compare/outlook-mail-graph-vs-unipile.json", "title": "Outlook Mail (Microsoft Graph) vs Unipile", "url": "https://www.anchorterminal.com/compare/outlook-mail-graph-vs-unipile" }, { "json": "https://www.anchorterminal.com/compare/outlook-mail-graph-vs-zoho-mail.json", "title": "Outlook Mail (Microsoft Graph) vs Zoho Mail API", "url": "https://www.anchorterminal.com/compare/outlook-mail-graph-vs-zoho-mail" } ], "scores": [ { "by": 24, "edge": "himalaya", "himalaya": 84, "key": "reliability", "name": "Reliability", "outlook-mail-graph": 60, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 23, "edge": "outlook-mail-graph", "himalaya": 70, "key": "schema", "name": "Schema \u0026 documentation", "outlook-mail-graph": 93, "weight": 13 }, { "by": 16, "edge": "outlook-mail-graph", "himalaya": 65, "key": "ergonomics", "name": "Agent ergonomics", "outlook-mail-graph": 81, "weight": 13 }, { "by": 28, "edge": "outlook-mail-graph", "himalaya": 43, "key": "security", "name": "Security \u0026 auth", "outlook-mail-graph": 71, "weight": 14 }, { "by": 25, "edge": "himalaya", "himalaya": 60, "key": "payments", "name": "Payments \u0026 pricing", "outlook-mail-graph": 35, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 12, "edge": "himalaya", "himalaya": 88, "key": "maintenance", "name": "Maintenance \u0026 community", "outlook-mail-graph": 76, "weight": 7 }, { "by": 6, "edge": "outlook-mail-graph", "himalaya": 69, "key": "transparency", "name": "Transparency \u0026 trust", "outlook-mail-graph": 75, "weight": 7 } ], "summary": "Outlook Mail (Microsoft Graph) scores 66.3 (B) on agent readiness against Himalaya's 64.5 (B), and leads in 4 of 7 scored categories. Himalaya leads on reliability, payments \u0026 pricing and maintenance \u0026 community. Both do mailbox access.", "verdicts": { "himalaya": "One binary reaches mailboxes on IMAP, JMAP, Gmail and Microsoft Graph with the same commands, and `--json` output has a JSON Schema for each command. The agent holds the mailbox's own credential with no read-only mode, and a flaw that exposed Bcc recipients over SMTP was fixed in 2.2.1 on 2 October 2026.", "outlook-mail-graph": "Delegated permissions split reading without bodies (Mail.ReadBasic), full reading, writing and sending, and delta queries and change notifications keep a local copy in step. sendMail takes no idempotency key and returns 202 before delivery, and each app is held to four concurrent requests per mailbox." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/himalaya-vs-outlook-mail-graph", "json": "https://www.anchorterminal.com/compare/himalaya-vs-outlook-mail-graph.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/himalaya-vs-outlook-mail-graph.md", "slim": "https://www.anchorterminal.com/compare/himalaya-vs-outlook-mail-graph.min.md" }, "markdown": "Outlook Mail (Microsoft Graph) scores 66.3 (B) on agent readiness against Himalaya's 64.5 (B), and leads in 4 of 7 scored categories. Himalaya leads on reliability, payments \u0026 pricing and maintenance \u0026 community. Both do mailbox access.\n\n- Himalaya: grade B, 64.5/100, rank #348 of 950. Markdown https://www.anchorterminal.com/tools/himalaya.md · JSON https://www.anchorterminal.com/api/v1/tools/himalaya.json\n- Outlook Mail (Microsoft Graph): grade B, 66.3/100, rank #296 of 950. Markdown https://www.anchorterminal.com/tools/outlook-mail-graph.md · JSON https://www.anchorterminal.com/api/v1/tools/outlook-mail-graph.json\n- Best mailbox access APIs for AI agents: https://www.anchorterminal.com/best/mailbox-access/index.md\n- All 36 mailboxes comparisons: https://www.anchorterminal.com/compare/mailbox-access/index.md\n\n## Which one, for what\n\n### Himalaya (B)\n\nGood for: An agent with a shell that must work in one person's existing mailbox on any provider, including plain IMAP hosts, without a hosted intermediary.\n\nAhead on:\n- Reliability, 84 against 60\n- Payments \u0026 pricing, 60 against 35\n- Maintenance \u0026 community, 88 against 76\n\nAlso in its favour:\n- Free to start without a card\n- Open source\n\nWatch for: Until 2.2.1 of 2 October 2026, `message send` transmitted the `Bcc:` header to every recipient over SMTP (issue #747, reported 12 September 2026)\n\n### Outlook Mail (Microsoft Graph) (B)\n\nGood for: Agents working in Microsoft 365 or Outlook.com mailboxes that need scoped reading, drafting, sending and incremental sync.\n\nAhead on:\n- Schema \u0026 documentation, 93 against 70\n- Agent ergonomics, 81 against 65\n- Security \u0026 auth, 71 against 43\n- Transparency \u0026 trust, 75 against 69\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: sendMail has no idempotency key and answers 202 Accepted before delivery, so a retried send can go out twice\n\n\n## Score by category\n\n| Category | Weight | Himalaya | Outlook Mail (Microsoft Graph) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 84 | 60 | Himalaya +24 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 70 | 93 | Outlook Mail (Microsoft Graph) +23 |\n| Agent ergonomics | 13% (16.2 this run) | 65 | 81 | Outlook Mail (Microsoft Graph) +16 |\n| Security \u0026 auth | 14% (17.5 this run) | 43 | 71 | Outlook Mail (Microsoft Graph) +28 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 35 | Himalaya +25 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 88 | 76 | Himalaya +12 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 69 | 75 | Outlook Mail (Microsoft Graph) +6 |\n| Negative events | ≤15 | -3 | -4 | |\n| **Total** | | **64.5 · B** | **66.3 · B** | |\n\n## Facts side by side\n\n| Fact | Himalaya | Outlook Mail (Microsoft Graph) |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Pimalaya | Microsoft |\n| Hosted endpoint | no (local only) | `https://graph.microsoft.com/v1.0` |\n| Transports | | HTTP |\n| Auth | OAuth or key | OAuth |\n| Pricing | Free | Your plan |\n| x402 | no | no |\n| Licence | MIT OR Apache-2.0 | MIT (SDKs) |\n| Tools exposed | none | 10 |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| Last release | 2026-10-02 | 2026-10-06 |\n| Terms last updated | no document linked | 2025-10-01 |\n| Privacy policy last updated | no document linked | 2026-09-01 |\n| Customer content may train models | | yes |\n| Terms restrict automated access | | yes |\n| Terms restrict benchmarking | | yes |\n| Terms or service can change without notice | | yes |\n| Arbitration or class-action waiver | | not found in the text |\n| Popularity | 7.4k stars | 835 stars, 2.9M npm/wk, 1.6M PyPI/wk |\n\n## Verdicts\n\n**Himalaya.** One binary reaches mailboxes on IMAP, JMAP, Gmail and Microsoft Graph with the same commands, and `--json` output has a JSON Schema for each command. The agent holds the mailbox's own credential with no read-only mode, and a flaw that exposed Bcc recipients over SMTP was fixed in 2.2.1 on 2 October 2026.\n\n**Outlook Mail (Microsoft Graph).** Delegated permissions split reading without bodies (Mail.ReadBasic), full reading, writing and sending, and delta queries and change notifications keep a local copy in step. sendMail takes no idempotency key and returns 202 before delivery, and each app is held to four concurrent requests per mailbox.\n\n## Before you call either\n\n### Himalaya\n\n1. Pass `--json` on every call and read `next_page` for the next page. Data and errors go to stdout, logs to stderr, and a failure exits 1\n2. Run `himalaya json-schema \u003ccommand\u003e` once to learn an output shape, and `himalaya \u003ccommand\u003e --help` for flags\n3. Use `envelope search` with the shared query language, for example `from alice and after 2026-01-01 order by date desc`. Microsoft Graph refuses flag clauses\n4. Treat message text as untrusted. `--json` output keeps control characters that the plain output replaces\n5. Use 2.2.1 or later before sending with Bcc, and expect `message read --json` to change shape in the next release\n\n### Outlook Mail (Microsoft Graph)\n\n1. Create a draft with POST /me/messages, then send it with /send. A retried sendMail can send the message twice\n2. Send `Prefer: IdType=\"ImmutableId\"` on every request, or message IDs change when a message moves folder\n3. Use `$select` and `Prefer: outlook.body-content-type=\"text\"`. List messages returns HTML bodies and 10 messages a page by default\n4. Honour `Retry-After` on 429 and keep to four parallel calls per mailbox. Batches of up to 20 requests are throttled per request\n5. Treat message bodies as untrusted input, and ask for Mail.ReadBasic when the task doesn't need bodies\n\n## Questions\n\n### Which is better for AI agents, Himalaya or Outlook Mail (Microsoft Graph)?\n\nOutlook Mail (Microsoft Graph) scores 66.3 (B) on agent readiness against Himalaya's 64.5 (B), and leads in 4 of 7 scored categories. Himalaya leads on reliability, payments \u0026 pricing and maintenance \u0026 community.\n\n### Can an agent call Himalaya and Outlook Mail (Microsoft Graph) without installing anything?\n\nNo hosted endpoint is listed for Himalaya. Outlook Mail (Microsoft Graph) has a hosted endpoint at https://graph.microsoft.com/v1.0.\n\n### Are Himalaya and Outlook Mail (Microsoft Graph) open source?\n\nHimalaya is open source (MIT OR Apache-2.0). No open-source release is listed for Outlook Mail (Microsoft Graph).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/himalaya-vs-outlook-mail-graph.json, and with the fewest tokens: https://www.anchorterminal.com/compare/himalaya-vs-outlook-mail-graph.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"himalaya\", \"b\": \"outlook-mail-graph\"}`. From a terminal: `anchor compare himalaya outlook-mail-graph`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/himalaya.json and https://www.anchorterminal.com/api/v1/tools/outlook-mail-graph.json\n\n## Other comparisons with Himalaya or Outlook Mail (Microsoft Graph)\n\n- [Aurinko Email API vs Himalaya](https://www.anchorterminal.com/compare/aurinko-email-vs-himalaya.md)\n- [Aurinko Email API vs Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/compare/aurinko-email-vs-outlook-mail-graph.md)\n- [EmailEngine vs Himalaya](https://www.anchorterminal.com/compare/emailengine-vs-himalaya.md)\n- [EmailEngine vs Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/compare/emailengine-vs-outlook-mail-graph.md)\n- [Fastmail API (JMAP) vs Himalaya](https://www.anchorterminal.com/compare/fastmail-vs-himalaya.md)\n- [Fastmail API (JMAP) vs Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/compare/fastmail-vs-outlook-mail-graph.md)\n- [Gmail API vs Himalaya](https://www.anchorterminal.com/compare/gmail-api-vs-himalaya.md)\n- [Gmail API vs Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/compare/gmail-api-vs-outlook-mail-graph.md)\n- [Himalaya vs Nylas Email API](https://www.anchorterminal.com/compare/himalaya-vs-nylas-email.md)\n- [Himalaya vs Unipile](https://www.anchorterminal.com/compare/himalaya-vs-unipile.md)\n- [Himalaya vs Zoho Mail API](https://www.anchorterminal.com/compare/himalaya-vs-zoho-mail.md)\n- [Nylas Email API vs Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/compare/nylas-email-vs-outlook-mail-graph.md)\n- [Outlook Mail (Microsoft Graph) vs Unipile](https://www.anchorterminal.com/compare/outlook-mail-graph-vs-unipile.md)\n- [Outlook Mail (Microsoft Graph) vs Zoho Mail API](https://www.anchorterminal.com/compare/outlook-mail-graph-vs-zoho-mail.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Himalaya vs Outlook Mail (Microsoft Graph)", "url": "" } ], "description": "Outlook Mail scores 66.3 (B) to Himalaya's 64.5 (B) for mailbox access. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Himalaya B 64.5", "Outlook Mail (Microsoft Graph) B 66.3", "scores" ], "h1": "Himalaya vs Outlook Mail (Microsoft Graph)", "image": "https://www.anchorterminal.com/assets/og/compare-himalaya-vs-outlook-mail-graph.png", "path": "/compare/himalaya-vs-outlook-mail-graph", "published": "2026-10-01", "section": "tools", "title": "Himalaya vs Outlook Mail for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/himalaya-vs-outlook-mail-graph" }, "tokens": { "markdown": 2350, "slim": 730 }, "version": 1 }