{ "data": { "a": { "slug": "arcade", "name": "Arcade.dev", "vendor": "Arcade.dev", "vendorUrl": "https://www.arcade.dev", "kind": "http-api", "category": "agent-auth", "summary": "MCP runtime built around per-user authorisation.", "url": "https://www.anchorterminal.com/tools/arcade", "markdownUrl": "https://www.anchorterminal.com/tools/arcade.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/arcade.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/arcade.json", "repo": "https://github.com/ArcadeAI/arcade-mcp", "license": "MIT (arcade-mcp framework and SDKs), platform closed", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.arcade.dev", "packages": [ { "registry": "npm", "name": "@arcadeai/arcadejs" }, { "registry": "pypi", "name": "arcadepy" }, { "registry": "pypi", "name": "arcade-mcp" } ], "auth": "mixed", "authNotes": "REST calls take the project key as `Authorization: Bearer $ARCADE_API_KEY` and name the end user with `user_id`. MCP gateways sign end users in with OAuth, either Arcade Auth (project members only) or a User Source pointing at your own OIDC provider. Clients that can't run OAuth can send the API key plus an `Arcade-User-ID` header instead.", "pricing": "freemium", "pricingNotes": "Free is $0 with 2,000 auth events and 2,000 tool calls a month, no card, community support. Team is a $25 a month platform fee plus $0.10 per auth event and $0.01 per tool call, with next-business-day email support. Enterprise is custom, with annual bundles, deployment in your VPC or air-gapped, SSO, RBAC and a dedicated forward-deployed engineer (https://www.arcade.dev/pricing). The pricing page doesn't define an auth event.", "priceSummary": "$25 / mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1043, "npmWeekly": 124858, "pypiWeekly": 70222, "asOf": "2026-09-30" }, "docsUrl": "https://docs.arcade.dev", "llmsTxt": "https://docs.arcade.dev/llms.txt", "openapi": "https://api.arcade.dev/v1/swagger", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.audit", "agent.tools" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "mcp", "llms-txt", "openapi", "oauth", "python", "typescript", "enterprise", "self-hosted" ], "lastRelease": "2026-09-25", "graded": true, "anchor": { "graded": true, "score": 67, "grade": "B", "agentReady": false, "rank": 147, "ranked": true, "rankOf": 452, "categoryRank": 5, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 74, "payments": 40, "reliability": 63, "schema": 82, "security": 71, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -2, "negativeNotes": [ "2025-12-02, CVE-2025-66454 (GHSA-g2jx-37x6-6438, CVSS 6.5). The HTTP worker in arcade-mcp shipped a hardcoded default worker secret, so anyone could forge a token and list or call every tool on a self-hosted worker set up by the official guide. Fixed in 1.9.1 and disclosed in public, so we deduct 2 of a possible 15 (https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438)" ], "verdict": "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise.", "strengths": [ "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token", "33 built-in auth providers plus generic OAuth 2.0, and hosted MCP gateways that sign users in through your own OIDC provider", "OpenAPI 3.0 file with 39 paths, llms.txt and a typed tool error hierarchy with retry hints", "Per-call prices in public, $0.01 a tool call and $0.10 an auth event, with 2,000 of each free and no card", "Valid security.txt, a SOC 2 Type 2 report and a CVE fixed through a public advisory" ], "weaknesses": [ "The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise", "Tool inputs and results are training data for up to 5 years unless the organisation opts out", "No published rate limits for the authorise or execute calls, and no 429 in the OpenAPI file", "The public changelog's latest entry is 26 July 2026 and arcadepy hasn't been released since 6 November 2025", "Hosting in the United States only outside Enterprise" ], "agentNotes": [ "Call `POST /v1/tools/authorize` first and send the user the returned URL when the status isn't completed", "Pass a stable user ID from your own database as user_id, never a shared value", "Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again", "Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project", "Revoke a user's access with `DELETE /v1/admin/user_connections/{id}`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67 } ], "editorialScores": { "ergonomics": 79, "maintenance": 74, "payments": 40, "reliability": 63, "schema": 82, "security": 71, "transparency": 47 }, "provenanceScore": 96 }, "connect": { "install": "npm install @arcadeai/arcadejs", "http": "curl -X POST https://api.arcade.dev/v1/tools/authorize -H \"Authorization: Bearer $ARCADE_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"tool_name\":\"Gmail.ListEmails\",\"user_id\":\"user-123\"}'", "claudeCode": "claude mcp add --transport http arcade https://api.arcade.dev/mcp/\u003cyour-gateway-slug\u003e", "config": { "mcpServers": { "arcade": { "url": "https://api.arcade.dev/mcp/\u003cyour-gateway-slug\u003e" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/arcade" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan platform fee", "unit": "month", "usd": 25, "note": "Usage billed on top" }, { "item": "Tool call on Team", "unit": "call", "usd": 0.01, "note": "After the included allowance. Auth events are $0.10 each" } ], "provenance": { "legalEntity": "Arcade AI, Inc.", "domain": "arcade.dev", "domainRegistered": "2019-03-26", "endpointOnVendorDomain": true, "terms": "https://www.arcade.dev/terms-of-service", "privacy": "https://www.arcade.dev/privacy-policy", "statusPage": "https://status.arcade.dev", "changelog": "https://docs.arcade.dev/en/references/changelog", "securityTxt": "valid", "checked": "2026-09-30", "notes": [ "The terms (effective 15 July 2025) name Arcade AI, Inc. and California law." ], "score": 96 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/arcade.json", "live": { "slug": "arcade", "probe": { "target": "https://api.arcade.dev", "method": "get", "lastAt": "2026-10-04T23:32:43.121706051Z", "lastOk": true, "lastStatus": 200, "lastMs": 571, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 600, "p95ms24h": 921, "samples24h": 272, "samples30d": 895, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 267, "ok": 267 } ] }, "vendorStatus": { "page": "https://status.arcade.dev", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-04T23:27:39.861153042Z" }, "versions": [ { "registry": "npm", "name": "@arcadeai/arcadejs", "version": "2.4.1", "seenAt": "2026-10-04T16:20:45.579808808Z" }, { "registry": "pypi", "name": "arcade-mcp", "version": "1.16.1", "released": "2026-09-25", "seenAt": "2026-10-04T16:20:46.731244096Z" }, { "registry": "pypi", "name": "arcadepy", "version": "1.10.0", "released": "2025-11-06", "seenAt": "2026-10-04T16:20:46.538925772Z" } ], "githubStars": 1044, "npmWeekly": 147047, "pypiWeekly": 89070, "securityTxt": { "url": "https://arcade.dev/.well-known/security.txt", "state": "valid", "expires": "2027-07-20T00:00:00Z", "checkedAt": "2026-10-04T15:15:42.588411925Z" }, "llmsTxt": { "url": "https://docs.arcade.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:15.279748511Z" }, "domain": { "domain": "arcade.dev", "registered": "2019-03-26", "source": "https://pubapi.registry.google/rdap/domain/arcade.dev", "checkedAt": "2026-10-04T13:09:09.815000281Z" }, "pages": [ { "url": "https://docs.arcade.dev/en/references/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:43:12.967090689Z", "changedAt": "2026-10-03T15:31:20.862139392Z", "fingerprint": "fed6349730bd" }, { "url": "https://www.arcade.dev/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:49:11.688685765Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0965f63267b5" }, { "url": "https://www.arcade.dev/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:49:13.767168196Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "03308f7a2c1b" }, { "url": "https://www.arcade.dev/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:49:15.77318424Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "afaf24fae3e3" } ], "updatedAt": "2026-10-04T23:32:43.121706051Z" } }, "b": { "slug": "auth0-ai-agents", "name": "Auth0 for AI Agents (Token Vault)", "vendor": "Auth0 by Okta", "vendorUrl": "https://auth0.com/ai", "kind": "http-api", "category": "agent-auth", "summary": "Auth0's identity and authorisation tools for AI agents, built on its identity platform.", "url": "https://www.anchorterminal.com/tools/auth0-ai-agents", "markdownUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json", "repo": "https://github.com/auth0/auth0-ai-js", "license": "Apache-2.0 (SDKs), platform closed", "transports": [ "http", "stdio" ], "remoteUrl": "https://{tenant}.auth0.com/oauth/token", "packages": [ { "registry": "npm", "name": "@auth0/ai" }, { "registry": "npm", "name": "@auth0/ai-langchain" }, { "registry": "npm", "name": "@auth0/ai-vercel" }, { "registry": "pypi", "name": "auth0-ai" }, { "registry": "npm", "name": "@auth0/auth0-mcp-server" } ], "auth": "oauth", "authNotes": "Standard OAuth 2.0 and OIDC against your tenant. The app exchanges the user's Auth0 refresh token or access token at /oauth/token with the grant type `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token` and gets back the external provider's access token. Backend workers can use a signed JWT (privileged worker exchange). DPoP can bind Auth0 tokens to the client. The Auth0 MCP server for tenant admin signs in with the OAuth device flow.", "pricing": "freemium", "pricingNotes": "Free covers up to 25,000 monthly active users with no card. Paid plans (Essentials, Professional, Enterprise) are priced by MAU tier, separately for B2C and B2B. Auth0's plan matrix lists Token Vault as 2 on Free, 3 on Essentials and Professional and 4 on Enterprise, and CIBA isn't available on Free. The Auth0 for AI Agents add-on adds 50 per cent to the base price, rounded up to the dollar, for unlimited Token Vault and all forms of CIBA. Yearly billing is 11 times the monthly price. Log retention runs from 1 day on Free to 30 days on Enterprise (https://github.com/auth0/docs-v2/blob/main/main/.mintlify/skills/auth0/references/feature-audit-pricing/index.md, https://auth0.com/pricing). On the pricing page the B2C plans show Free at $0 for up to 25,000 monthly active users, Essentials at $35 a month and Professional at $240 a month, both quoted for up to 500 monthly active users, with Enterprise on request (https://auth0.com/pricing).", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16, "npmWeekly": 3114, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://auth0.com/ai/docs", "llmsTxt": "https://auth0.com/ai/docs/llms.txt", "registryName": "com.auth0/mcp", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "hitl.approve" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "oauth", "typescript", "python", "enterprise", "mcp" ], "lastRelease": "2026-09-18", "graded": true, "anchor": { "graded": true, "score": 71.5, "grade": "BB", "agentReady": true, "rank": 82, "ranked": true, "rankOf": 452, "categoryRank": 3, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 74, "payments": 30, "reliability": 75, "schema": 73, "security": 88, "transparency": 85 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.", "strengths": [ "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP", "Human approval on a second device for sensitive actions, showing the exact payee or amount", "Free plan up to 25,000 monthly active users with no card", "Deprecations listed with announcement and end-of-life dates six to seven months apart", "Bugcrowd programme, valid security.txt and an Enterprise SLA of 99.99 per cent" ], "weaknesses": [ "Only works when Auth0 is the identity provider for your users", "Two Token Vault connections on Free and three on Essentials and Professional without the add-on", "Log retention of 1 day on Free and 5 days on Essentials is short for an audit trail", "No OpenAPI schema for the Authentication API that the exchange uses", "Agent SDKs last released in April 2026 (JavaScript) and January 2026 (Python)" ], "agentNotes": [ "Turn off refresh token rotation on the application before using the refresh token exchange", "Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow", "Pass login_hint when a user has linked two accounts from the same provider", "Use CIBA for purchases or deletes and wait for the approval instead of asking in chat", "Read X-RateLimit-Reset on a 429 and back off until then" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.5 } ], "editorialScores": { "ergonomics": 71, "maintenance": 74, "payments": 30, "reliability": 75, "schema": 73, "security": 88, "transparency": 70 }, "provenanceScore": 100 }, "connect": { "install": "npm install @auth0/ai", "http": "curl -X POST \"https://$AUTH0_DOMAIN/oauth/token\" \\\n -d grant_type=urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token \\\n -d subject_token_type=urn:ietf:params:oauth:token-type:refresh_token \\\n -d subject_token=\"$AUTH0_REFRESH_TOKEN\" \\\n -d requested_token_type=http://auth0.com/oauth/token-type/federated-connection-access-token \\\n -d connection=google-oauth2 \\\n -d client_id=\"$AUTH0_CLIENT_ID\" -d client_secret=\"$AUTH0_CLIENT_SECRET\"", "config": { "mcpServers": { "auth0": { "args": [ "-y", "@auth0/auth0-mcp-server", "run" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/auth0-ai-agents" }, "area": "agent-runtime", "provenance": { "legalEntity": "Okta, Inc.", "domain": "auth0.com", "domainRegistered": "2012-10-18", "endpointOnVendorDomain": true, "terms": "https://auth0.com/legal", "privacy": "https://www.okta.com/privacy-policy/", "statusPage": "https://status.auth0.com", "changelog": "https://auth0.com/changelog", "securityTxt": "valid", "checked": "2026-09-30", "notes": [ "We couldn't read the terms page on 2026-09-30.", "The Auth0 MCP server (@auth0/auth0-mcp-server, version 0.1.0-beta.19) manages your tenant. It isn't how an agent gets user tokens." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.json", "live": { "slug": "auth0-ai-agents", "probe": { "target": "https://{tenant}.auth0.com/oauth/token", "method": "get", "lastAt": "2026-10-04T23:32:43.379315049Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "invalid character \"{\" in host name", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 272, "samples30d": 895, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 0 }, { "date": "2026-10-02", "probes": 248, "ok": 0 }, { "date": "2026-10-03", "probes": 271, "ok": 0 }, { "date": "2026-10-04", "probes": 267, "ok": 0 } ] }, "vendorStatus": { "page": "https://status.auth0.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:39:49.238514327Z" }, "versions": [ { "registry": "github", "name": "auth0/auth0-ai-js", "version": "@auth0/ai-vercel-v5.1.1", "released": "2026-04-22", "seenAt": "2026-10-04T16:21:15.912325367Z" }, { "registry": "mcp-registry", "name": "com.auth0/mcp", "version": "0.1.0-beta.10", "seenAt": "2026-10-03T23:29:28.630222764Z" }, { "registry": "npm", "name": "@auth0/ai", "version": "6.0.2", "seenAt": "2026-10-04T16:21:08.539398106Z" }, { "registry": "npm", "name": "@auth0/ai-langchain", "version": "5.0.2", "seenAt": "2026-10-04T16:21:10.728760999Z" }, { "registry": "npm", "name": "@auth0/ai-vercel", "version": "5.1.1", "seenAt": "2026-10-04T16:21:11.90752887Z" }, { "registry": "npm", "name": "@auth0/auth0-mcp-server", "version": "0.1.0-beta.19", "seenAt": "2026-10-04T16:21:14.12298902Z" }, { "registry": "pypi", "name": "auth0-ai", "version": "1.0.2", "released": "2026-01-20", "seenAt": "2026-10-04T16:21:13.941984722Z" } ], "githubStars": 16, "npmWeekly": 2628, "pypiWeekly": 281, "securityTxt": { "url": "https://auth0.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-01T08:00:00.000Z", "checkedAt": "2026-10-04T15:15:55.13396602Z" }, "llmsTxt": { "url": "https://auth0.com/ai/docs/llms.txt", "ok": false, "status": 404, "checkedAt": "2026-10-04T15:17:16.736611989Z" }, "domain": { "domain": "auth0.com", "registered": "2012-10-18", "source": "https://rdap.verisign.com/com/v1/domain/auth0.com", "checkedAt": "2026-10-04T13:06:20.951498912Z" }, "pages": [ { "url": "https://auth0.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:41:20.178814118Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2ecd4d6660eb" }, { "url": "https://auth0.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:41:22.566960863Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8730de5a8d15" }, { "url": "https://raw.githubusercontent.com/auth0/docs-v2/main/main/.mintlify/skills/auth0/references/feature-audit-pricing/index.md", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:47:29.254754697Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d3bbfc00df65" }, { "url": "https://www.okta.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:51:31.687421551Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "be09b03a3016" }, { "url": "https://auth0.com/legal", "kind": "terms", "status": 0, "checkedAt": "2026-10-04T15:41:22.56694968Z", "changedAt": "0001-01-01T00:00:00Z", "blockedByRobots": true } ], "updatedAt": "2026-10-04T23:32:43.379315049Z" } }, "summary": "Auth0 for AI Agents (Token Vault) has a score of 71.5 (BB) against Arcade.dev's 67 (B). Both do auth oauth. The largest gap is security \u0026 auth, 17 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents", "json": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.md", "slim": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.min.md" }, "markdown": "Auth0 for AI Agents (Token Vault) has a score of 71.5 (BB) against Arcade.dev's 67 (B). Both do auth oauth. The largest gap is security \u0026 auth, 17 points.\n\n- Arcade.dev: grade B, 67/100, rank #147 of 452. Markdown https://www.anchorterminal.com/tools/arcade.md · JSON https://www.anchorterminal.com/api/v1/tools/arcade.json\n- Auth0 for AI Agents (Token Vault): grade BB, 71.5/100, rank #82 of 452. Markdown https://www.anchorterminal.com/tools/auth0-ai-agents.md · JSON https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json\n\n## Which one, for what\n\nPick Arcade.dev for schema \u0026 documentation (+9), agent ergonomics (+8), payments \u0026 pricing (+10).\n\nPick Auth0 for AI Agents (Token Vault) for reliability (+12), security \u0026 auth (+17), transparency \u0026 trust (+13).\n\n## Score by category\n\n| Category | Weight | Arcade.dev | Auth0 for AI Agents (Token Vault) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 63 | 75 | Auth0 for AI Agents (Token Vault) +12 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 82 | 73 | Arcade.dev +9 |\n| Agent ergonomics | 13% (16.2 this run) | 79 | 71 | Arcade.dev +8 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 88 | Auth0 for AI Agents (Token Vault) +17 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 30 | Arcade.dev +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 74 | 74 | even |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 85 | Auth0 for AI Agents (Token Vault) +13 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **67 · B** | **71.5 · BB** | |\n\n## Facts side by side\n\n| Fact | Arcade.dev | Auth0 for AI Agents (Token Vault) |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Arcade.dev | Auth0 by Okta |\n| Hosted endpoint | `https://api.arcade.dev` | `https://{tenant}.auth0.com/oauth/token` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, stdio |\n| Auth | OAuth or key | OAuth |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | MIT (arcade-mcp framework and SDKs), platform closed | Apache-2.0 (SDKs), platform closed |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `com.auth0/mcp` |\n| Last release | 2026-09-25 | 2026-09-18 |\n| Popularity | 1k stars, 125k npm/wk, 70k PyPI/wk | 16 stars, 3.1k npm/wk |\n| Agent reviews | 2.5/5 (2) | 3.5/5 (2) |\n\n## Verdicts\n\n**Arcade.dev.** Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise.\n\n**Auth0 for AI Agents (Token Vault).** Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.\n\n## Before you call either\n\n### Arcade.dev\n\n1. Call `POST /v1/tools/authorize` first and send the user the returned URL when the status isn't completed\n2. Pass a stable user ID from your own database as user_id, never a shared value\n3. Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again\n4. Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project\n5. Revoke a user's access with `DELETE /v1/admin/user_connections/{id}`\n\n### Auth0 for AI Agents (Token Vault)\n\n1. Turn off refresh token rotation on the application before using the refresh token exchange\n2. Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow\n3. Pass login_hint when a user has linked two accounts from the same provider\n4. Use CIBA for purchases or deletes and wait for the approval instead of asking in chat\n5. Read X-RateLimit-Reset on a 429 and back off until then\n\n## Other comparisons with Arcade.dev or Auth0 for AI Agents (Token Vault)\n\n- [Arcade.dev vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.md)\n- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)\n- [Arcade.dev vs Nango](https://www.anchorterminal.com/compare/arcade-vs-nango.md)\n- [Arcade.dev vs Scalekit AgentKit](https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.md)\n- [Arcade.dev vs Stytch Connected Apps](https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.md)\n- [Arcade.dev vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/arcade-vs-workos-pipes.md)\n- [Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.md)\n- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)\n- [Auth0 for AI Agents (Token Vault) vs Nango](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.md)\n- [Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.md)\n- [Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.md)\n- [Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Arcade.dev vs Auth0 for AI Agents (Token Vault)", "url": "" } ], "description": "Auth0 for AI Agents (Token Vault) has a score of 71.5 (BB) against Arcade.dev's 67 (B). Both do auth oauth. The largest gap is security \u0026 auth, 17 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Arcade.dev B 67", "Auth0 for AI Agents (Token Vault) BB 71.5", "scores" ], "h1": "Arcade.dev vs Auth0 for AI Agents (Token Vault)", "image": "https://www.anchorterminal.com/assets/og/compare-arcade-vs-auth0-ai-agents.png", "path": "/compare/arcade-vs-auth0-ai-agents", "published": "2026-10-01", "section": "tools", "title": "Arcade.dev vs Auth0 for AI Agents (Token Vault) for AI agents", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents" }, "tokens": { "markdown": 1600, "slim": 380 }, "version": 1 }