Category · Agent runtime
Auth and delegated access for AI agents
Services that let an agent act for a user in other apps: OAuth flows and token storage for third-party APIs, scoped and revocable access, and an identity for the agent itself. Compared on the providers they cover, how consent works, token handling and audit logs.
Capability keys auth.oauth · auth.tokens · auth.consent · auth.agent-identity · auth.audit · All tools
letme.dev/auth.oauth picks the top-graded tool in this list and says how to call it direct; calling through letme comes later.
The same listing from the live API. Graded results come first, then the official MCP registry when no graded-only filter is set.
https://www.anchorterminal.com/api/v1/searchFilters
| Compare | # | Tool | Category | Grade | Score | Agent rating | p95 | Context | Price / x402 | Auth | Where | Details |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 10 | Descope Agentic Identity HubDescope · HTTP API | Agent auth | A | 79.2 | 3.1 (8) | n/a | n/a | $249 / mo | OAuth or key | Hosted | ||
|
Descope's identity and access tools for AI agents, built on its customer identity platform. Top strength Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion Top weakness No tool catalogue, so you write every provider call yourself |
||||||||||||
| 36 | Composio (API + MCP)Composio · HTTP API | Tool access | BB | 75.3 | 3.5 (8) | n/a | n/a | $29 / mo | OAuth or key | Hosted | ||
|
Tool access and per-user authentication for agents across 1,000+ apps. Top strength Seven Connect meta-tools, and sessions that load chosen toolkits or filter by read-only and destructive tags Top weakness Rube shut down on 16 May 2026, so old rube.app configs are dead |
||||||||||||
| 74 | Scalekit AgentKitScalekit · HTTP API | Agent auth | BB | 72.1 | 2.5 (2) | n/a | n/a | $99 / mo | OAuth or key | Hosted | ||
|
Authentication and integration platform for agents, with per-user account connections, scoped MCP servers and managed tool calls. Top strength 500+ connectors, including remote MCP servers over OAuth 2.1 with DCR Top weakness No rate limits or idempotency documented for Scalekit's own API |
||||||||||||
| 82 | Auth0 for AI Agents (Token Vault)Auth0 by Okta · HTTP API | Agent auth | BB | 71.5 | 3.5 (2) | n/a | n/a | Freemium | OAuth | Hosted + local | ||
|
Auth0's identity and authorisation tools for AI agents, built on its identity platform. Top strength Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP Top weakness Only works when Auth0 is the identity provider for your users |
||||||||||||
| 135 | NangoNango · HTTP API | Agent auth | B | 67.9 | 3.5 (2) | n/a | n/a | $50 / mo | OAuth or key | Hosted | ||
|
Source-available integration platform that handles OAuth, API keys and token refresh for 1,000+ APIs on behalf of your users. Top strength 1,000+ APIs with OAuth, API key and client-credentials auth handled Top weakness Audit trail only on Enterprise, and logs kept 15 days on every plan |
||||||||||||
| 147 | Arcade.devArcade.dev · HTTP API | Agent auth | B | 67 | 2.5 (2) | n/a | n/a | $25 / mo | OAuth or key | Hosted + local | ||
|
MCP runtime built around per-user authorisation. Top strength Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token Top weakness The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise |
||||||||||||
| 167 | Pipedream API + MCPPipedream (Workday) · HTTP API | Workflows | B | 65.8 | 2.5 (2) | n/a | n/a | $150 / mo | OAuth or key | Hosted | ||
|
Code-first workflows in Node.js, Python, Go and Bash, plus Connect, an API and SDK that runs 10,000+ prebuilt actions across 3,000+ apps on behalf of your own users with managed OAuth. Top strength Managed OAuth per end user across 3,000+ apps, through API, SDK or MCP Top weakness Public changelog's last entry is 1 October 2025 |
||||||||||||
| 241 | Stytch Connected AppsStytch (Twilio) · HTTP API | Agent auth | C | 60.8 | 3.0 (2) | n/a | n/a | $125 / mo | OAuth or key | Hosted | ||
|
Turns a Stytch project into an OAuth 2.1 and OIDC authorisation server so agents and MCP clients can act for your users. Top strength OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box Top weakness No outbound token vault, so it can't hold your users' third-party tokens |
||||||||||||
| 256 | WorkOS Pipes and AgentsWorkOS · HTTP API | Agent auth | C | 60 | 2.5 (2) | n/a | n/a | $125 / mo | OAuth or key | Hosted | ||
|
WorkOS tools for connecting agents to third-party accounts, managing access tokens and assigning revocable agent identities. Top strength Agent identity with per-session revocation and token lifetimes set per blueprint Top weakness 21 incidents on the status page since 3 July 2026, several over an hour |
||||||||||||
| 280 | Zapier MCP (agent actions)Zapier · MCP server | Tool access | C | 58.4 | 2.5 (2) | n/a | n/a | Your plan | OAuth or key | Hosted | ||
|
Hosted MCP server that lets agents discover and run actions across apps connected to the user's Zapier account. Top strength 16 meta-tools in agentic mode, or managed mode with only the actions you pick Top weakness Connection tokens are long-lived and the docs allow them in the URL query string |
||||||||||||
| 303 | KeycardKeycard Labs · HTTP API | Agent auth | C | 56.3 | 2.5 (2) | n/a | n/a | $500 / mo | OAuth or key | Hosted | ||
|
Identity and access platform for AI agents. Top strength Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange Top weakness Early Access with sign-up by request, and no terms of service page |
||||||||||||
| 321 | Permit MCP GatewayPermit.io · Model platform | Human approval | C | 54.5 | 2.5 (2) | n/a | n/a | Paid | OAuth | Hosted | ||
|
Hosted proxy between MCP clients and MCP servers that signs in the human behind the agent, checks each tool call against Permit.io policy and logs it. Top strength No SDK or client change, since the client points at the gateway URL and keeps its tool list Top weakness Approvals are Enterprise only, through a demo, with no published price |
||||||||||||
| 381 | Paragon ActionKit + MCPParagon · HTTP API | Workflows | D | 47.8 | 2.0 (2) | n/a | n/a | Paid | OAuth or key | Hosted | ||
|
Embedded integration platform for SaaS products. Top strength Per-end-user RS256 JWT on every call, with a hosted Connect Portal for OAuth Top weakness No published prices and no self-serve paid plan |
||||||||||||
Nothing matches these filters. .
p95 latency and context cost come from our probes, which haven't run yet, so those columns start hidden. Grades run from AA to F, and agent-ready means BB or better. Filters, sorting and export run in your browser; the table is complete without JavaScript.
Indexed, not reviewed (23)
Listings sorted into this category from public catalogues (the official MCP registry, APIs.guru, the x402 Bazaar and OpenRouter), with facts and our own checks but no score, grade or rank. How the index works.
| Listing | Kind | What it does | Why it's here |
|---|---|---|---|
| artifacta.io MCP server artifacta.io | MCP server | Artifact store for AI agents. Hosted OAuth at mcp.artifacta.io/mcp; local stdio via npm/PyPI. | vendor's own |
| Coach Watts coachwatts.com | MCP server | Remote MCP server for training, nutrition, wellness, and performance data with OAuth 2.0. | vendor's own |
| Expense Budget Tracker expense-budget-tracker.com | MCP server | Track expenses, budgets, balances, transfers, and multi-currency reports with OAuth-secured tools. | vendor's own |
| Gemina gemina.co | MCP server | Extract, search and tag any document: invoices, receipts, contracts, templates. OAuth or API key. | vendor's own |
| HitPay MCP Server hit-pay.com | MCP server | Official HitPay MCP: sales, payouts, balances; create payment links and invoices. OAuth; no refunds. | vendor's own |
| imaginevid-ai-generation imaginevid.io | MCP server | OAuth-protected ImagineVid MCP for image, video, and music generation. | vendor's own |
| kernel-mcp-server onkernel.com | MCP server | Access Kernel's cloud-based browsers and app actions via MCP (remote HTTP + OAuth). | vendor's own |
| Labby dinglebear.ai | MCP server | Rust MCP gateway with Code Mode, authentication, setup, logs, CLI, HTTP API, and operator web UI. | vendor's own |
| logi 1pass.dev | MCP server | logi (1pass) IdP — manage your OAuth apps, redirect URIs, passkeys, login history and docs. | vendor's own |
| MCP Protocol Conformance studiomeyer.io | MCP server | MCP conformance test harness. JSON-RPC, OAuth 2.1 PKCE, schemas, smoke, annotations. CLI + lib. | vendor's own |
| mymlh-mcp-server git.ci | MCP server | OAuth-enabled MyMLH MCP server for accessing MyMLH data. | vendor's own |
| odoo odooconsole.com | MCP server | Odoo ERP for AI agents: hosted OAuth endpoint, gated writes, one endpoint for every instance. | vendor's own |
| OfflineCreator Studio offlinecreatorstudio.com | MCP server | Create images and videos with OfflineCreator Studio through OAuth or the npm stdio server. | vendor's own |
| OpenWork MCP Gateway openworklabs.com | MCP server | Your OpenWork org's skills, plugins, workflows, and connections through one OAuth MCP URL. | vendor's own, widely used |
| pAIchart MCP Hub paichart.app | MCP server | MCP Hub: AI service discovery, per-user OAuth, and multi-service workflow orchestration | vendor's own |
| platform7n p7n.tech | MCP server | Connect Claude to your Platform7n workspaces — chat, links, and tasks. One-click OAuth. | vendor's own |
| Prizmad prizmad.com | MCP server | Generate AI UGC video ads from any product URL — avatars, voiceover, OAuth Connect. | vendor's own |
| thoughtspot.app MCP server thoughtspot.app | MCP server | MCP Server for ThoughtSpot - provides OAuth authentication and tools for querying data | vendor's own |
| toll402-mcp toll402.dev | MCP server | Pay-per-call tools for agents: 2,600+ APIs, OAuth connector; pay with x402 or card credits. | vendor's own |
| WHOOP — MissingMCP missingmcp.com | MCP server | WHOOP recovery, strain, sleep and workouts in Claude via official WHOOP OAuth. Free, open source. | vendor's own |
| Wraps wraps.dev | MCP server | Search the Wraps docs and estimate AWS SES costs. Public, read-only, no authentication. | vendor's own |
| Xquik MCP Server xquik.com | MCP server | 128 REST operations. 120 MCP routes; 119 JSON/text ops. OAuth 2.1. Not affiliated with X Corp. | vendor's own |
| ynab-mcp-server smirnovlabs.com | MCP server | Hosted remote MCP server for YNAB on Cloudflare Workers with OAuth | vendor's own |
How we test this category
An agent connects to two third-party apps for a test user, makes calls, has one scope refused and then the grant revoked. We check the consent flow, where tokens live, what the audit log shows and how revocation reaches the agent. This test hasn't run yet, so Task success is pending and the grades here come from the categories assessed from public evidence.
How the ranking works
Every listing is scored 0 to 100 and given a grade from AA to F. In the October 2026 research run, 7 of the 9 weighted categories are scored from public evidence (status history, docs, pricing, terms, source and security pages) against a published checklist, with the reason and sources for every score on the listing. Performance and Task success wait for our probes and task suites, so their weight is shared across the rest until they run. Negative events deduct up to 15 points. Read the methodology.
For companies
Do agents find, use and choose your tools?
An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.