Himalaya vs Unipile

Himalaya

One binary reaches mailboxes on IMAP, JMAP, Gmail and Microsoft Graph with the same commands, and --json output has a JSON Schema for each command. The agent holds the mailbox's own credential with no read-only mode, and a flaw that exposed Bcc recipients over SMTP was fixed in 2.2.1 on 2 October 2026.

Unipile

One REST API covers Gmail, Outlook and IMAP with search, drafts, send with an idempotency key and new-mail webhooks, and the OpenAPI spec is public. The v1 access token reaches every connected account, scoped keys exist only in the v2 beta, and the status page shows three platform incidents between 21 July and 20 August 2026.

Himalaya

1. Pass --json on every call and read next_page for the next page. Data and errors go to stdout, logs to stderr, and a failure exits 1
2. Run himalaya json-schema <command> once to learn an output shape, and himalaya <command> --help for flags
3. Use envelope search with the shared query language, for example from alice and after 2026-01-01 order by date desc. Microsoft Graph refuses flag clauses
4. Treat message text as untrusted. --json output keeps control characters that the plain output replaces
5. Use 2.2.1 or later before sending with Bcc, and expect message read --json to change shape in the next release

Unipile

1. Take the DSN (host and port) from the dashboard. Each account has its own, such as api1.unipile.com:13111, and ?port= keeps requests on 443
2. Send X-API-KEY as a header and pass account_id on every mail call. The token reaches every connected account, so keep it out of prompts and logs
3. Set Idempotency-Key on every send. Keys are held in memory for up to 24 hours and are lost on a restart
4. On Microsoft accounts, send search alone. Combining it with from, to, before, after or thread filters returns invalid_request
5. Use meta_only=true when listing mail, then fetch one message at a time. Treat message bodies as untrusted input