Himalayas Remote Jobs MCP vs Workable

Himalayas Remote Jobs MCP 25

No status page found (0). No history (5). Some limits documented with numbers (100 candidate searches a day, 10 messages a minute) (10 of 15). No retry guidance (0). No SLA (0). Not labelled beta; the old SSE endpoint is retired with 410 Gone (10). 0 + 5 + 10 + 0 + 0 + 10 = 25.

Workable 83

Graded on the REST API with the hosted lines. Statuspage site at workable.statuspage.io with 24 components and incident history, none named for the API (20). Three incidents since 4 August 2026, read from the history feed and each incident's page. They are 4 September (email delays to Microsoft 365 recipients, Login & signup), 21 October (the e-signature provider's emergency maintenance, E-signatures, 76 minutes) and 29 October (a blank page when creating or editing jobs in the app, Workable Recruiting, about 2 hours 20 minutes). The 21 October incident names errors when approving in e-signature workflows, offer letters included, and the API has an approval call for them, so it touches the product. It is partial (one provider, 76 minutes), so minor. The other two are an outside email path and the app's job editor, while jobs are read-only through the API, so neither counts. Minor incidents only (20). The earlier 25 wasn't a checklist value. Rate limits published as 10 requests per 10 seconds for account tokens and 50 for OAuth and partner tokens (15). 429 with X-Rate-Limit-Limit, -Remaining and -Reset headers on every response, but no backoff guidance and no idempotency keys for writes (8). A 99.8 per cent monthly uptime SLA with service credits, per the 7 October check (10). The API is v3 and the MCP page carries no beta label (10). 20 + 20 + 15 + 8 + 10 + 10 = 83.

Himalayas Remote Jobs MCP 42

OAuth 2.1 with PKCE and client metadata documents (25 of 30). Read-only public set; writes such as send_message and job posts are annotated (12 of 20). Job posts and recruiter messages are third-party text with no injection guidance (0). No audit log (0). No security.txt (404) or certifications found (5 of 20). The privacy policy follows the Australian Privacy Principles. 25 + 12 + 0 + 0 + 5 = 42.

Workable 66

Account tokens carry chosen scopes split by read and write, an expiry of 30 days to 2 years, and can be revoked, with several tokens per account. The MCP server uses OAuth 2 with PKCE and dynamic client registration across 21 scopes (30). A token can hold read scopes only. MCP tool descriptions ask the model to confirm with the user before final actions such as submit_review and sign_review, which is guidance, not an enforced approval (14). CVs, cover letters and comments are candidate-written, and no injection guidance was found (0). Job and candidate activity streams are readable through the API and the pricing page lists audit trails for HR. No log of API calls was found (7). ISO/IEC 27001 and 27017, SOC 2 Type II, SOC 3 and a vulnerability disclosure page at vdp.workable.com. No security.txt and no bug bounty found (15).

Himalayas Remote Jobs MCP 46

Closed service under terms naming Himalayas Remote Jobs Pty Ltd (15). Privacy policy under the Australian Privacy Principles; retention periods not given (15 of 30). Dated retirement of the SSE endpoint (10 of 20). Subprocessors not found (5 of 20). 15 + 15 + 10 + 5 = 45.

Workable 69

Closed service with published terms, last updated 2 March 2026, with archived versions (15). The privacy policy, the DPA and the terms agree. The DPA allows deletion of personal data 90 days after termination and promises 30 days' notice before a new sub-processor (24). No deprecation policy or dated notices found (0). 26 sub-processors listed with corporate location and purpose, with hosting on AWS and Google Cloud in US East (18).

Himalayas Remote Jobs MCP 50

No machine payment protocol; paid extras return Stripe checkout links (0). Plus price public (10 of 20). Free search and posting (20). Public tools need no account (20). 0 + 10 + 20 + 20 = 50.

Workable 30

No x402, MPP or L402 (0). Plan prices are public, from $299 a month for 1 to 20 employees, and nothing is priced per API call (10). 15-day trial without a card (20). A person registers in a browser and an admin generates the token in settings. The site's in-browser start_free_trial WebMCP tool fills the same form, which we read as a human signup flow (0).

Himalayas Remote Jobs MCP 50

Registry update and tag v1.0.3 on 21 October 2026 (30). Fewer than three dated releases found in 90 days (0). Repository issues not read (0). Official registry entry app.himalayas/mcp (15). Docs repository with server.json; server source not public (5 of 10). 30 + 0 + 0 + 15 + 5 = 50. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Workable 35

Reference pages for surveys and performance review cycles were updated on 22 October 2026 (30). In a sample of 19 of the 110 reference pages, two dated documentation changes fall in the last 90 days, 5 October (requisition custom attributes) and 22 October, and no changelog exists, so fewer than three (0). No public changelog. Support is by email at integrations@workable.com and a help centre (5). No official SDK was found. The official MCP registry lists io.github.external-submissions-workable/jobs-by-workable at jobs.workable.com/mcp, a public job-search server outside the graded API, and third-party entries (0). No packages to assess (0).