Lever vs NeverApply

Lever 7

The newest dated API change was on the updates page at hire.lever.co, which now answers robots.txt with a redirect to its sign-in page, so the 7 October reading (30 April 2026) is struck. The other dated sources of Lever's own were looked for. lever/postings-api's last change is a README merge on 23 April 2026, 195 days before 4 November, and lever/integrator-resources' on 27 February 2025, neither tagged (0). No dated entry in the window from 6 August (0). Closed service with no changelog readable today. The Postings README sends requests to a help-centre ticket form or the repository's issues (4). No official SDK, and no Lever-published MCP server found (0). No packages to assess. The example repository has CodeQL and dependency review workflows and was last changed in February 2025 (3). 0 + 0 + 4 + 0 + 3 = 7.

NeverApply 50

Closed service. The latest dated change is a commit of 31 October 2026 to kasovy/neverapply-mcp documenting guest access to search_jobs and get_job, after a tag v1.0.0 on 21 October; the privacy policy was updated on 26 October and the terms on 18 October (30). One tagged release and 16 commits from 25 September to 31 October 2026, with no changelog or release notes, so partial (10 of 20). No public changelog; support is a contact form, hello@neverapply.co and security@neverapply.co, with a stated reply within one business day and a median first reply of about two hours in staffed hours; GitHub issues could not be read because the GitHub API was not available to us (5 of 15). The server card names co.neverapply/neverapply and llms.txt says it was published to the official MCP registry on 25 September 2026, but the registry could not be read, so it is scored absent; no official SDK (0 of 15). The plugin repository has no runtime dependencies and a CI workflow that validates every manifest against its published schema, with a release workflow on tags; actions are pinned to major tags and the run results were not readable (5 of 10). 30+10+5+0+5 = 50.

Lever 85

Graded on the hosted lines for the Data API and the Postings API. Statuspage at status.lever.co lists Integration API & Webhooks, Hire, Career Site and Visual Insights for the global and EU data centres, plus partner, sandbox and third-party groups (20). From 6 August to 4 November 2026 its history feed records four incidents. Offer letter conversion failed on 7 August (offer letters only). A 15-minute outage on 12 August caused failed page loads on hire.lever.co. 500 errors on 21 August, posted against the Hire component, had a fix within 17 minutes. A server rotation caused 504s on page loads at hire.eulever.co for 45 minutes on 25 August. Each names one function, the web app or one region, so all read as minor (20). hire.lever.co, the developer documentation host, answers robots.txt with a redirect to its sign-in page, read as a refusal, so the 7 October readings from it are struck, among them the Data API's request limits and backoff guidance. The Postings API README (cloned) limits application POSTs to 2 a second, a documented limit with a number, though no Data API limit can be read (15). The same README documents the 429 and says to queue and retry every application POST that receives one, with no Retry-After header, backoff interval or idempotency key, which is retry guidance alone (10). The SLA, re-read, commits to 99.9% uptime for all customers with automatic service credits (10). The readable docs carry no beta or preview label, and the Postman collection and README use the production /v1 and /v0 paths (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.

NeverApply 45

Hosted reading, for the MCP server at https://neverapply.co/mcp with the Jobs API described. No status page was found. None is linked from the home page, llms.txt (which lists none) or the MCP page, and https://neverapply.co/status answered a client error (0). No readable incident history, so the floor (5). auth.md publishes budgets with numbers per member and OAuth client, 60 requests a minute on Free and 300 with full access, 50 or 2,000 read calls and 500 or 10,000 search rows a day, 3 or 30 application sends a day and 5 concurrent requests per token, with daily resets at midnight UTC; the page says they are monitor-only for now, and the OpenAPI file gives the Jobs API 1,000 to 250,000 calls a month by plan (15). auth.md says to respect Retry-After on 429 and the reset and retry fields on MCP limit errors, to retry safe reads with bounded backoff and never to repeat an application action blindly; the apply-to-jobs skill passes an idempotency_key on apply_to_job and a review_version on approvals and answers (15). No SLA on any plan was found (0). Nothing on the MCP page, auth.md or llms.txt labels the server beta or preview; the Telegram agent and Envoy marked 'soon' are not this surface (10). 0+5+15+15+0+10 = 45.

Lever 5

No x402, MPP or L402 (0). Pricing is by quote only (0). No free tier or trial found, and the sandbox goes only to approved partners (0). API keys and OAuth apps need a person, a customer contract or Lever's partner team. We gave 5 because the Postings API returns any customer's published jobs without a key or account (5).

NeverApply 45

No x402, MPP or L402 on the pricing page, llms.txt, auth.md or the MCP page; plans are Stripe subscriptions and the terms say MCP tools perform no financial transactions (0). Plan prices are public without a login, Pro $29 and Max $49 a month ($19 and $39 a month billed yearly) with 150 and 450 credits a month and 1 credit per application, and the OpenAPI file prices the Jobs API at $19, $49 and $149 a month for 10,000, 50,000 and 250,000 calls; credit pack prices are not listed (15 of 20). Free is $0 with no card, 10 applications once, 5 match previews a day and 50 MCP reads a day per client, and the Jobs API has a free 1,000 calls a month (20). Guest search_jobs and get_job need no account, but every other tool, applying among them, needs a person to sign in or create an account and verify an email on the hosted page, so partial (10 of 20). 0+15+20+10 = 45.

Lever 22

hire.lever.co, the developer documentation host, answers robots.txt with a redirect to its sign-in page, read as a refusal, so the 7 October readings from it are struck. What remains is in Lever's GitHub repositories. No OpenAPI file found. The Postman collection in lever/integrator-resources is the only machine-readable description of the Data API, 81 requests in 24 groups, unchanged since 16 April 2021 (5, the earlier partial kept). No llms.txt, and www.lever.co/llms.txt returned 404 on 7 October (0). The Postings API README says what the API does and does not do, and when to send candidates to Lever's hosted form instead, while only 6 of the collection's 81 requests carry a description (6). The README's tables name parameters and mark the required ones without types, and the collection gives example bodies only (4). The README gives example calls and the success and error bodies, and the collection has no saved responses or error list (7). Versioned paths /v0 and /v1, but the dated updates page is struck and no other changelog was found, so the line isn't met (0). 5 + 0 + 6 + 4 + 7 + 0 = 22.

NeverApply 57

MCP reading, with the Jobs API described. The 15 tools' input schemas were not read, since no session was opened and the server card at /.well-known/mcp/server-card.json lists tools only as 'dynamic'. An OpenAPI 3.1 file at https://neverapply.co/openapi.json covers 7 GET operations of the Jobs API with typed parameters, but every 200 response is typed as an integer constant (422, 401, 404 or 200) with no job schema, and no pagination fields are defined, so partial (12 of 25). llms.txt and a Markdown authorisation guide at https://neverapply.co/auth.md (10). The three skills and GEMINI.md in the plugin repository say when to use each tool, in what order, which IDs to trust and where to stop and ask, and the MCP page groups the tools by access level; the hosted tool descriptions were not read (12 of 20). Jobs API parameters carry enums (experience level, salary period, visa sponsorship, clearance, education, sort), bounds (per_page 1 to 100, 500 or 1,000) and patterns on country codes; the MCP arguments are named in the skills without types (10 of 15). auth.md documents 401, the OAuth error codes, 429 and isError inside a 200, the skills name waiting_for_answers, open_review, upgrade_required and matches_state, and the OpenAPI description lists five error codes, but its components define different error shapes and no request or response example was found (8 of 15). /v1 paths, OpenAPI version 1.0.0 and a repository tag v1.0.0, but no changelog; /changelog answered a client error (5 of 15). 12+10+12+10+8+5 = 57.

Lever 48

hire.lever.co, the developer documentation host, answers robots.txt with a redirect to its sign-in page, read as a refusal, so the 7 October readings from it are struck, among them field selection, expand and the Data API's pagination. The Postings API takes limit and mode, and nothing readable sizes Data API responses (5). Postings lists page with skip and limit and filter by location, commitment, team, department and level, with grouping (20). The README gives an HTTP status with a body of {ok:false, error:<string>}, with no list of codes. Kept as a partial (12). No idempotency keys. The README says candidates are merged by email address, which limits duplicate people on a retried application. Kept as a partial (5). Postings applications need only name and email, the Postman collection sends perform_as with a user id on writes, and there is no official SDK. Kept as a partial (6). 5 + 20 + 12 + 5 + 6 = 48.

NeverApply 66

MCP reading. 15 tools, 6 read, 6 edit and 3 apply, in the 11 to 30 band (15); guests see a two-tool subset and scopes split read, edit and apply access, though whether tools/list narrows by scope was not read (2 back, 17 of 25). search_jobs takes the user's filters with up to 20 results a call, get_matches pages with next_cursor, list_applications filters by status (needs_answer, ready_to_send, stale, interview, offer), and the Jobs API has a fields sparse fieldset, per_page and cursor feeds (18 of 20). auth.md gives an action for 401, 429 and the OAuth errors, MCP limit errors carry reset and retry fields, and results carry status and next_action the skills act on; no full code list, and the Jobs API's documented envelope and component schemas disagree (13 of 20). apply_to_job takes an idempotency_key, approvals and answers take review_version, a repeat tailor_resume call reads the same copy without paying twice, and auth.md says never to repeat an application blindly; readOnlyHint and destructiveHint were not read (12 of 20). Most tools need one ID, but there is no official SDK (6 of 15). 17+18+13+12+6 = 66.

Lever 71

Closed service with public terms of service (25 August 2023), an SLA and Developer Sandbox Terms. The terms bar access for benchmarking or competitive purposes (15). A DPA (updated 20 May 2025), a services privacy notice (25 September 2023) and a security page give retention and deletion periods. They disagree on one figure, with deletion starting 30 days after termination in the DPA and 90 days on the security page, both ending by day 45 (20). The deprecated Candidates section and the field-removal promise were read on hire.lever.co, now struck (its robots.txt redirects to a sign-in page), and no deprecation notice or policy is readable elsewhere (0). Sub-processor list effective 21 September 2025 with purposes and locations, and hosting regions named (18). 15 + 20 + 0 + 18 = 53.

NeverApply 57

Closed hosted service under terms (last updated 18 October 2026) naming Kasovy LLC, registered in Wyoming, with Wyoming law and a liability cap of 12 months' fees or USD 100; the plugin repository of manifests and skills is MIT, copyright Kasovy LLC (17 of 30). The privacy policy (26 October 2026) gives retention periods (7 days for resumes uploaded without an account, 90 days for detailed API usage records and relay mail, a 30-day frozen period before deletion, and what is kept after it), says providers don't train on content under their API terms and that demographic answers are not used for matching, and the extension has its own policy (28 September 2026) saying nothing leaves the device unless AI answers are turned on; no DPA was found, and hashed emails and click IDs go to ad platforms (22 of 30). No deprecation policy or dated notices; the terms promise notice by email or in the product before material changes, and the switch to guest search was recorded only in a commit (4 of 20). Providers are named (OpenAI and Anthropic through Cloudflare's AI Gateway, Google Gemini, AWS S3 and SES, TypeSafe, Stripe, Apple, Google, RevenueCat, Expo, PostHog, Sentry, Gravatar, and Meta, TikTok, Google and X for ads), resume files are stored in AWS eu-central-1, and most providers are in the United States under standard contractual clauses (16 of 20). 17+22+4+16 = 59.