Himalayas Remote Jobs MCP vs Zoho Recruit

Himalayas Remote Jobs MCP 25

No status page found (0). No history (5). Some limits documented with numbers (100 candidate searches a day, 10 messages a minute) (10 of 15). No retry guidance (0). No SLA (0). Not labelled beta; the old SSE endpoint is retired with 410 Gone (10). 0 + 5 + 10 + 0 + 0 + 10 = 25.

Zoho Recruit 56

Graded on the REST API v2, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which listed a Zoho Recruit component per the 8 October check (20, kept as on the other Zoho listings). On 4 November that host answered our robots.txt request with a 404 carrying an access-denied error page, read as blocked as on zoho-books and zoho-zeptomail, so the 8 October incident reading is struck and no incident history for the last 90 days could be read (5). Daily credits per rolling 24 hours and concurrency limits are published with numbers per edition (15). 429 is documented for the daily and concurrency limits, with no Retry-After or backoff guidance found. Upsert on duplicate check fields makes creates safer to retry (6 of 15). No SLA found (0). v2 is the current documented version (10). 20 + 5 + 15 + 6 + 0 + 10 = 56.

Himalayas Remote Jobs MCP 46

Closed service under terms naming Himalayas Remote Jobs Pty Ltd (15). Privacy policy under the Australian Privacy Principles; retention periods not given (15 of 30). Dated retirement of the SSE endpoint (10 of 20). Subprocessors not found (5 of 20). 15 + 15 + 10 + 5 = 45.

Zoho Recruit 77

Closed service under the Zoho Terms of Service, last updated 2 March 2022, re-read 4 November (15 of 30). The privacy policy of 22 December 2025 says Zoho does not sell personal information, and that data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email, per the 8 October check, not re-read on 4 November (24 of 30). No API deprecation policy found. One dated notice was found, the retirement of auth tokens on 28 February 2021 (5 of 20). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names locations and their certifications (15 of 20).

Himalayas Remote Jobs MCP 50

No machine payment protocol; paid extras return Stripe checkout links (0). Plus price public (10 of 20). Free search and posting (20). Public tools need no account (20). 0 + 10 + 20 + 20 = 50.

Zoho Recruit 20

No x402, MPP or L402 (0). The pricing page and its Markdown twin name the editions, and the pricing page and the plan comparison name the per-licence monthly and yearly billing and an API call add-on sold per 250 calls, but every amount is filled in by script from a price data file, which this run doesn't read. The 8 October figures came from that file and are struck, so no price could be read (0 of 20). The Free edition includes 5,000 API credits a day, and the home page says no credit card is required (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0). 0 + 0 + 20 + 0 = 20.

Himalayas Remote Jobs MCP 70

79 tools read from tools/list (78 visible without sign-in) with JSON Schema inputs and 33 enums (25). llms.txt (10). Clear descriptions with when to use them (15 of 20). Mostly typed, with comma-separated string lists and two free-form objects (8 of 15). Example prompts and parameter tables (7 of 15). Registry version 1.0.3 and repository tags, no changelog (5 of 15). 25 + 10 + 15 + 8 + 7 + 5 = 70.

Zoho Recruit 46

No OpenAPI description found, and the public repository zoho/recruit-oas has no commits (0 of 25). The developer guide has an llms.txt index of 77 pages (79 recorded on 8 October), each with a Markdown twin (10). Each endpoint page states a purpose, URL, method and scopes, with little on when not to use a call (12 of 20). Parameter tables give types, defaults and possible values, and a field-type table gives length limits. Record bodies accept any field because modules are customisable, and search criteria are a string grammar (8 of 15). Pages carry curl samples, sample responses and a Possible Errors table, though the upload page's sample URL omits /v2 and the status code page is generic (11 of 15). The version is in the path. What's New in API v2 is undated, and the limits page, the What's New page and the Corporate HR plan comparison disagree on daily allowances (5 of 15).

Himalayas Remote Jobs MCP 42

OAuth 2.1 with PKCE and client metadata documents (25 of 30). Read-only public set; writes such as send_message and job posts are annotated (12 of 20). Job posts and recruiter messages are third-party text with no injection guidance (0). No audit log (0). No security.txt (404) or certifications found (5 of 20). The privacy policy follows the Australian Privacy Principles. 25 + 12 + 0 + 0 + 5 = 42.

Zoho Recruit 65

OAuth 2.0 with scopes down to one module and one operation, one-hour access tokens and revocable refresh tokens (30). Less 10 because the documented refresh and revoke calls carry the refresh token and client secret in the URL query string (20 of 30). READ-only scopes per module, and calls are bound by the user's profile (the Notes module answers admins only). No approval step for deletes, which take 100 records a call (13 of 20). Candidate records and résumés hold text from outside parties and no prompt-injection guidance was found (3 of 15). Audit logs kept 60 days and activity logs 90 days per the shared responsibility page, per the 8 October check, not re-read on 4 November. No per-application API usage view was found in the reviewed pages (9 of 15). security.txt valid to 30 June 2028 (re-read 4 November), a bug bounty, SOC 2 Type 2 and ISO/IEC 27001, 27701, 27017 and 27018 (20).

Himalayas Remote Jobs MCP 58

79 tools, about 78 KB (5), split into public, job-seeker and employer sets (5 back). Filters and paging on search (15 of 20). Errors not documented (5 of 20). All visible tools annotated, 34 read-only (20). Public tools work with no setup (8 of 15). 10 + 15 + 5 + 20 + 8 = 58.

Zoho Recruit 64

Graded on the REST API. fields is optional on list calls and per_page goes to 200, so responses can be narrowed, but the default returns every field (18 of 25). page, per_page and more_records, sorting, custom views, If-Modified-Since, search by criteria, email, phone or word, and bulk read for large exports (18 of 20). Errors carry a code, message, details and status, with a table per endpoint, some of them short (14 of 20). Upsert on duplicate_check_fields, with no idempotency key (9 of 20). No official SDK for Recruit was found. Defaults are sensible, but the one-hour token, the refresh step and per-data-centre hosts add setup (5 of 15).