Manatal vs NeverApply

Manatal 6

Findings per the 9 October check, not re-read on 4 November (terms pause). The newest API reference page read carried an update date of 6 July 2026 (the candidate skills bulk endpoint), but the record shows no API change on that date, and a page date that records no change doesn't set recency. No dated API change was found (0). The product changelog is drawn by script inside an embedded frame and went unread, so no dated entries in the last 90 days could be counted (0). The help centre's sitemap dated changes to the MCP articles on 23 September, 2 October and 9 October 2026. Support is by email and chat, with priority support on Enterprise Plus (6). No official SDK was found (0). No packages to assess (0). 0+0+6+0+0 = 6.

NeverApply 50

Closed service. The latest dated change is a commit of 31 October 2026 to kasovy/neverapply-mcp documenting guest access to search_jobs and get_job, after a tag v1.0.0 on 21 October; the privacy policy was updated on 26 October and the terms on 18 October (30). One tagged release and 16 commits from 25 September to 31 October 2026, with no changelog or release notes, so partial (10 of 20). No public changelog; support is a contact form, hello@neverapply.co and security@neverapply.co, with a stated reply within one business day and a median first reply of about two hours in staffed hours; GitHub issues could not be read because the GitHub API was not available to us (5 of 15). The server card names co.neverapply/neverapply and llms.txt says it was published to the official MCP registry on 25 September 2026, but the registry could not be read, so it is scored absent; no official SDK (0 of 15). The plugin repository has no runtime dependencies and a CI workflow that validates every manifest against its published schema, with a release workflow on tags; actions are pinned to major tags and the run results were not readable (5 of 10). 30+10+5+0+5 = 50.

Manatal 75

Graded on the Open API with the hosted lines. Manatal's Terms and Conditions bar using its website content and services through programs that send automatic requests, so status.manatal.com and the docs weren't re-read on 4 November and their findings are per the 9 October check, not re-read on 4 November. Statuspage site at status.manatal.com with an API component and incident history (20). The feed showed only scheduled database maintenance between 11 July and 9 October 2026, and the last incident was increased latency on app.manatal.com on 10 July 2026. The window since 10 October is unread, so the line keeps its recorded award and gains nothing for the unread part (30). The MCP help article gives the standard API rate limit as 100 requests a minute. The API reference states no limit (15). No 429 handling, backoff guidance or idempotency keys were found in the reviewed documentation (0). The security page states uptime of 99.9 per cent or higher, and the Terms of Service of 25 March 2024 allow refunds at Manatal's discretion up to the monthly fee. A stated uptime figure with no committed percentage or credit isn't an SLA, so 0 (was 5). The API is at v3 with no beta label, though the docs call it a work in progress covering a subset of the product (10). 20+30+15+0+0+10 = 75.

NeverApply 45

Hosted reading, for the MCP server at https://neverapply.co/mcp with the Jobs API described. No status page was found. None is linked from the home page, llms.txt (which lists none) or the MCP page, and https://neverapply.co/status answered a client error (0). No readable incident history, so the floor (5). auth.md publishes budgets with numbers per member and OAuth client, 60 requests a minute on Free and 300 with full access, 50 or 2,000 read calls and 500 or 10,000 search rows a day, 3 or 30 application sends a day and 5 concurrent requests per token, with daily resets at midnight UTC; the page says they are monitor-only for now, and the OpenAPI file gives the Jobs API 1,000 to 250,000 calls a month by plan (15). auth.md says to respect Retry-After on 429 and the reset and retry fields on MCP limit errors, to retry safe reads with bounded backoff and never to repeat an application action blindly; the apply-to-jobs skill passes an idempotency_key on apply_to_job and a review_version on approvals and answers (15). No SLA on any plan was found (0). Nothing on the MCP page, auth.md or llms.txt labels the server beta or preview; the Telegram agent and Envoy marked 'soon' are not this surface (10). 0+5+15+15+0+10 = 45.

Manatal 43

All findings per the 9 October check, not re-read on 4 November (terms pause). List endpoints take page_size, with no field selection found (10). page and page_size, with filters by name, email, owner, tags and created or updated date ranges on candidates and jobs (17). Errors are not documented beyond a few status codes on some reference pages. The 9 October note also leaned on an unauthenticated test request, which this run strikes; the line keeps its earlier partial, flagged (6). No idempotency keys. external_id on candidates and matches allows a lookup before a retry, and a candidate can be matched to a job only once (4). Few required parameters, and no official SDK was found (6).

NeverApply 66

MCP reading. 15 tools, 6 read, 6 edit and 3 apply, in the 11 to 30 band (15); guests see a two-tool subset and scopes split read, edit and apply access, though whether tools/list narrows by scope was not read (2 back, 17 of 25). search_jobs takes the user's filters with up to 20 results a call, get_matches pages with next_cursor, list_applications filters by status (needs_answer, ready_to_send, stale, interview, offer), and the Jobs API has a fields sparse fieldset, per_page and cursor feeds (18 of 20). auth.md gives an action for 401, 429 and the OAuth errors, MCP limit errors carry reset and retry fields, and results carry status and next_action the skills act on; no full code list, and the Jobs API's documented envelope and component schemas disagree (13 of 20). apply_to_job takes an idempotency_key, approvals and answers take review_version, a repeat tailor_resume call reads the same copy without paying twice, and auth.md says never to repeat an application blindly; readOnlyHint and destructiveHint were not read (12 of 20). Most tools need one ID, but there is no official SDK (6 of 15). 17+18+13+12+6 = 66.

Manatal 45

Findings per the 9 October check, not re-read on 4 November (terms pause), except the terms, re-read on 4 November. Graded on the Open API. An admin generates tokens in the account settings, can hold several and can delete them, and they travel in the Authorization header. No scopes or expiry were found, which we score as plain revocable keys (20). No read-only token or confirmation step for deletes was found on the API. The MCP help article advises keeping the client's per-action approval on (2). CVs, notes and attachments are candidate-written, and no injection guidance was found (3). The security page says all access is logged and audited and that a customer can ask for a report of who accessed its data. No per-token call log was found (6). SOC 2 Type II is stated, a vulnerability disclosure programme dated 31 July 2026 has discretionary rewards, safe harbour and a five-business-day acknowledgement target, and there is no security.txt (14). No deduction is taken on the API for the custom MCP Server URL, which the docs call a credential with admin-level access.

NeverApply 66

OAuth 2.1 for the MCP server, public clients with PKCE S256, client ID metadata documents or dynamic registration, a resource parameter, refresh tokens and three scopes; auth.md says no API keys or personal access tokens are accepted and documents no query-string secret; token lifetimes are not stated and no RFC 7009 revocation endpoint is advertised, though disconnecting a client in settings revokes its tokens and pending codes. The Jobs API takes a bearer token from a developer dashboard that was not readable (26 of 30). Read, edit and apply scopes; applying needs the apply scope, credits and the member's approval of each named job, sending needs a separate grant tied to one assistant that the terms say no tool can create, held applications need an explicit approve_application, and MCP tools cannot buy plans or move money; the web app's Send mode applies up to a daily cap without asking per job, which is outside the MCP surface (18 of 20). Job descriptions are employer text; the find-jobs skill and GEMINI.md say to summarise them and never follow instructions inside them, with no server-side filtering described (9 of 15). Settings list connected AI clients with their mode and allowance, get_profile shows the current budget mode, the tracker logs every application, errors carry a support or correlation ID, and the privacy policy keeps detailed API usage records for 90 days; no per-call log for the member is documented (7 of 15). security.txt is valid until 7 November 2027 with hello@neverapply.co, and the contact page routes security reports to security@neverapply.co with a reply within 24 hours; no bug bounty, SOC 2 or ISO 27001 found (6 of 20). 26+18+9+7+6 = 66.

Manatal 30

All findings per the 9 October check, not re-read on 4 November (terms pause). No x402, MPP or L402 (0). Plan prices are public per user per month, $15, $35 and $55 billed annually or $19, $39 and $59 monthly, with API access only on the $55 plan (10). 14-day trial without a card. The trial covers what all three plans include, with some exceptions, and the Open API must still be enabled by support (20). A person signs up in a browser and an admin generates the token in settings (0).

NeverApply 45

No x402, MPP or L402 on the pricing page, llms.txt, auth.md or the MCP page; plans are Stripe subscriptions and the terms say MCP tools perform no financial transactions (0). Plan prices are public without a login, Pro $29 and Max $49 a month ($19 and $39 a month billed yearly) with 150 and 450 credits a month and 1 credit per application, and the OpenAPI file prices the Jobs API at $19, $49 and $149 a month for 10,000, 50,000 and 250,000 calls; credit pack prices are not listed (15 of 20). Free is $0 with no card, 10 applications once, 5 match previews a day and 50 MCP reads a day per client, and the Jobs API has a free 1,000 calls a month (20). Guest search_jobs and get_job need no account, but every other tool, applying among them, needs a person to sign in or create an account and verify an email on the hosted page, so partial (10 of 20). 0+15+20+10 = 45.