Himalayas Remote Jobs MCP vs Lever

Himalayas Remote Jobs MCP 25

No status page found (0). No history (5). Some limits documented with numbers (100 candidate searches a day, 10 messages a minute) (10 of 15). No retry guidance (0). No SLA (0). Not labelled beta; the old SSE endpoint is retired with 410 Gone (10). 0 + 5 + 10 + 0 + 0 + 10 = 25.

Lever 85

Graded on the hosted lines for the Data API and the Postings API. Statuspage at status.lever.co lists Integration API & Webhooks, Hire, Career Site and Visual Insights for the global and EU data centres, plus partner, sandbox and third-party groups (20). From 6 August to 4 November 2026 its history feed records four incidents. Offer letter conversion failed on 7 August (offer letters only). A 15-minute outage on 12 August caused failed page loads on hire.lever.co. 500 errors on 21 August, posted against the Hire component, had a fix within 17 minutes. A server rotation caused 504s on page loads at hire.eulever.co for 45 minutes on 25 August. Each names one function, the web app or one region, so all read as minor (20). hire.lever.co, the developer documentation host, answers robots.txt with a redirect to its sign-in page, read as a refusal, so the 7 October readings from it are struck, among them the Data API's request limits and backoff guidance. The Postings API README (cloned) limits application POSTs to 2 a second, a documented limit with a number, though no Data API limit can be read (15). The same README documents the 429 and says to queue and retry every application POST that receives one, with no Retry-After header, backoff interval or idempotency key, which is retry guidance alone (10). The SLA, re-read, commits to 99.9% uptime for all customers with automatic service credits (10). The readable docs carry no beta or preview label, and the Postman collection and README use the production /v1 and /v0 paths (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.

Himalayas Remote Jobs MCP 70

79 tools read from tools/list (78 visible without sign-in) with JSON Schema inputs and 33 enums (25). llms.txt (10). Clear descriptions with when to use them (15 of 20). Mostly typed, with comma-separated string lists and two free-form objects (8 of 15). Example prompts and parameter tables (7 of 15). Registry version 1.0.3 and repository tags, no changelog (5 of 15). 25 + 10 + 15 + 8 + 7 + 5 = 70.

Lever 22

hire.lever.co, the developer documentation host, answers robots.txt with a redirect to its sign-in page, read as a refusal, so the 7 October readings from it are struck. What remains is in Lever's GitHub repositories. No OpenAPI file found. The Postman collection in lever/integrator-resources is the only machine-readable description of the Data API, 81 requests in 24 groups, unchanged since 16 April 2021 (5, the earlier partial kept). No llms.txt, and www.lever.co/llms.txt returned 404 on 7 October (0). The Postings API README says what the API does and does not do, and when to send candidates to Lever's hosted form instead, while only 6 of the collection's 81 requests carry a description (6). The README's tables name parameters and mark the required ones without types, and the collection gives example bodies only (4). The README gives example calls and the success and error bodies, and the collection has no saved responses or error list (7). Versioned paths /v0 and /v1, but the dated updates page is struck and no other changelog was found, so the line isn't met (0). 5 + 0 + 6 + 4 + 7 + 0 = 22.

Himalayas Remote Jobs MCP 50

No machine payment protocol; paid extras return Stripe checkout links (0). Plus price public (10 of 20). Free search and posting (20). Public tools need no account (20). 0 + 10 + 20 + 20 = 50.

Lever 5

No x402, MPP or L402 (0). Pricing is by quote only (0). No free tier or trial found, and the sandbox goes only to approved partners (0). API keys and OAuth apps need a person, a customer contract or Lever's partner team. We gave 5 because the Postings API returns any customer's published jobs without a key or account (5).

Himalayas Remote Jobs MCP 50

Registry update and tag v1.0.3 on 21 October 2026 (30). Fewer than three dated releases found in 90 days (0). Repository issues not read (0). Official registry entry app.himalayas/mcp (15). Docs repository with server.json; server source not public (5 of 10). 30 + 0 + 0 + 15 + 5 = 50. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Lever 7

The newest dated API change was on the updates page at hire.lever.co, which now answers robots.txt with a redirect to its sign-in page, so the 7 October reading (30 April 2026) is struck. The other dated sources of Lever's own were looked for. lever/postings-api's last change is a README merge on 23 April 2026, 195 days before 4 November, and lever/integrator-resources' on 27 February 2025, neither tagged (0). No dated entry in the window from 6 August (0). Closed service with no changelog readable today. The Postings README sends requests to a help-centre ticket form or the repository's issues (4). No official SDK, and no Lever-published MCP server found (0). No packages to assess. The example repository has CodeQL and dependency review workflows and was last changed in February 2025 (3). 0 + 0 + 4 + 0 + 3 = 7.

Himalayas Remote Jobs MCP 46

Closed service under terms naming Himalayas Remote Jobs Pty Ltd (15). Privacy policy under the Australian Privacy Principles; retention periods not given (15 of 30). Dated retirement of the SSE endpoint (10 of 20). Subprocessors not found (5 of 20). 15 + 15 + 10 + 5 = 45.

Lever 71

Closed service with public terms of service (25 August 2023), an SLA and Developer Sandbox Terms. The terms bar access for benchmarking or competitive purposes (15). A DPA (updated 20 May 2025), a services privacy notice (25 September 2023) and a security page give retention and deletion periods. They disagree on one figure, with deletion starting 30 days after termination in the DPA and 90 days on the security page, both ending by day 45 (20). The deprecated Candidates section and the field-removal promise were read on hire.lever.co, now struck (its robots.txt redirects to a sign-in page), and no deprecation notice or policy is readable elsewhere (0). Sub-processor list effective 21 September 2025 with purposes and locations, and hosting regions named (18). 15 + 20 + 0 + 18 = 53.

Himalayas Remote Jobs MCP 42

OAuth 2.1 with PKCE and client metadata documents (25 of 30). Read-only public set; writes such as send_message and job posts are annotated (12 of 20). Job posts and recruiter messages are third-party text with no injection guidance (0). No audit log (0). No security.txt (404) or certifications found (5 of 20). The privacy policy follows the Australian Privacy Principles. 25 + 12 + 0 + 0 + 5 = 42.

Lever 53

hire.lever.co, the developer documentation host, answers robots.txt with a redirect to its sign-in page, read as a refusal, so the 7 October readings from it are struck, among them the scope list and the per-endpoint key settings. The example OAuth app in lever/integrator-resources runs the OAuth 2.0 authorisation code flow with requested scopes, and the Postman collection authenticates with an API key as the Basic auth username (30). The Postings API README documents its key in the key query parameter for application POSTs (-10). Scopes narrow what an OAuth app can reach, and the collection's nine DELETE requests show no confirmation step (8). Resumes, notes and application answers are written by outside parties and no prompt-injection guidance was found (3). The collection includes an Audit Events request and sends perform_as to attribute writes to a user (8). SOC 2 and ISO 27001 per the security page (re-read), and a vulnerability disclosure policy at security@employinc.com in SECURITY.md with no acknowledgement time. No bug bounty and no security.txt (14). 20 + 8 + 3 + 8 + 14 = 53.