{ "data": { "a": { "slug": "arcade", "name": "Arcade.dev", "vendor": "Arcade.dev", "vendorUrl": "https://www.arcade.dev", "kind": "http-api", "category": "agent-auth", "summary": "MCP runtime built around per-user authorisation.", "url": "https://www.anchorterminal.com/tools/arcade", "markdownUrl": "https://www.anchorterminal.com/tools/arcade.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/arcade.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/arcade.json", "dns": "arcade.grade.anchorterminal.com", "repo": "https://github.com/ArcadeAI/arcade-mcp", "license": "MIT (arcade-mcp framework and SDKs), platform closed", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.arcade.dev", "packages": [ { "registry": "npm", "name": "@arcadeai/arcadejs" }, { "registry": "pypi", "name": "arcadepy" }, { "registry": "pypi", "name": "arcade-mcp" } ], "auth": "mixed", "authNotes": "REST calls take the project key as `Authorization: Bearer $ARCADE_API_KEY` and name the end user with `user_id`. MCP gateways sign end users in with OAuth, either Arcade Auth (project members only) or a User Source pointing at your own OIDC provider. Clients that can't run OAuth can send the API key plus an `Arcade-User-ID` header instead.", "pricing": "freemium", "pricingNotes": "Free is $0 with 2,000 tool calls a month, no card, community support on Discord and GitHub. Team is a $25 a month platform fee plus $0.01 per tool call, with next-business-day email support. Enterprise is custom, with annual bundles of tool calls, deployment on Arcade Cloud, in your VPC or air-gapped, SSO, RBAC, audit logs and a dedicated forward-deployed engineer (https://www.arcade.dev/pricing/). The pricing page listed $0.10 per auth event on 1 October and no auth-event charge on 1 November (checked 2026-11-01).", "priceSummary": "$25 / mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1043, "npmWeekly": 124858, "pypiWeekly": 70222, "asOf": "2026-09-30" }, "docsUrl": "https://docs.arcade.dev", "llmsTxt": "https://docs.arcade.dev/llms.txt", "openapi": "https://api.arcade.dev/v1/swagger", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.audit", "agent.tools" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "mcp", "llms-txt", "openapi", "oauth", "python", "typescript", "enterprise", "self-hosted" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 64, "grade": "B", "agentReady": false, "rank": 489, "ranked": true, "rankOf": 1510, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 86, "maintenance": 76, "payments": 40, "reliability": 63, "schema": 87, "security": 71, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -7, "negativeNotes": [ "2025-12-02, CVE-2025-66454 (GHSA-g2jx-37x6-6438, CVSS 6.5, Moderate). The HTTP worker in arcade-mcp shipped a hardcoded default worker secret, so anyone could forge a token and list or call every tool on a self-hosted worker set up by the official guide. Fixed in 1.9.1 and disclosed in public. A fixed Moderate published by the vendor costs 1, as for opensearch and github-mcp-server (-1) (https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438)", "2 to 28 October 2026, fixes of described flaws released with no advisory. Self-hosted 1.11.1 (2 October) and 1.11.2 (13 October) cut off disabled accounts whose dashboard sessions and tokens kept working, including to create project API keys, and stopped the suggestions Inbox showing suggestion text to readers in other projects. 1.11.3 (21 October) stopped disabled tools being listed or called and kept credentials out of tracing spans. 1.11.4 (28 October) refuses DNS-rebinding hostnames and blocks re-pointing an Arcade Deploy server at an internal address. arcade-core's fix of 22 October (#960) stopped rejected input values, tokens included, reaching tool-call stack traces. Arcade Cloud runs these releases ahead of self-hosted. No GHSA or OSV entry found on 1 November. One folded term, -3 (https://releases.arcade.dev/)", "13 and 21 October 2026, published API behaviour changed on Arcade Cloud with no advance notice. Self-hosted 1.11.2 (13 October) removed `GET .../gateways/{gateway_id}/suggestions`, which now answers 404, and cut list endpoints' maximum `limit` from 25,000 to 1,000. 1.11.3 (21 October) made an explicit `null` tool argument mean the default, so callers sending `null` get different results (Asana `CreateTask` and Linear `CreateIssue` assign to the caller, Insightly `SummarizePipeline` rolls up open opportunities only). Arcade Cloud runs this code before each self-hosted release, and the only page describing it ahead of release is a nightly preview of what Cloud already runs, so Cloud callers had no notice before the change. Repeats of one kind fold into one term, -3 (https://releases.arcade.dev/releases/1.11.3/upgrade/index.md)" ], "verdict": "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise, and October's self-hosted releases fixed several access-control flaws without an advisory.", "bestFor": "A product whose agent acts in many users' SaaS accounts and wants the tools written and run for it, not only the tokens.", "strengths": [ "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token", "33 built-in auth providers plus generic OAuth 2.0, and hosted MCP gateways that sign users in through your own OIDC provider", "OpenAPI 3.0 file with 51 paths, llms.txt and a typed tool error hierarchy with retry hints", "Per-call prices in public, $0.01 a tool call on Team, with 2,000 tool calls a month free and no card", "Valid security.txt, a SOC 2 Type 2 report and a CVE fixed through a public advisory", "Each tool declares read-only, destructive and idempotent flags, mapped to MCP's annotation hints" ], "weaknesses": [ "The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise", "Tool inputs and results are training data for up to 5 years unless the organisation opts out", "No published rate limits for the authorise or execute calls, and no 429 in the OpenAPI file", "arcadepy hasn't been released since 6 November 2025, and @arcadeai/arcadejs since 21 April 2026", "Hosting in the United States only outside Enterprise", "Self-hosted releases from 2 to 28 October 2026 fixed access-control and credential-exposure flaws with no published advisory" ], "agentNotes": [ "Call `POST /v1/tools/authorize` first and send the user the returned URL when the status isn't completed", "Pass a stable user ID from your own database as user_id, never a shared value", "Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again", "Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project", "Revoke a user's access with `DELETE /v1/admin/user_connections/{id}`", "Filter formatted_tools on `read_only` or `destructive` before handing a toolkit to an agent that shouldn't write" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64 } ], "editorialScores": { "ergonomics": 86, "maintenance": 76, "payments": 40, "reliability": 63, "schema": 87, "security": 71, "transparency": 47 }, "provenanceScore": 94, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @arcadeai/arcadejs", "http": "curl -X POST https://api.arcade.dev/v1/tools/authorize -H \"Authorization: Bearer $ARCADE_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"tool_name\":\"Gmail.ListEmails\",\"user_id\":\"user-123\"}'", "claudeCode": "claude mcp add --transport http arcade https://api.arcade.dev/mcp/\u003cyour-gateway-slug\u003e", "config": { "mcpServers": { "arcade": { "url": "https://api.arcade.dev/mcp/\u003cyour-gateway-slug\u003e" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/arcade" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan platform fee", "unit": "month", "usd": 25, "note": "Usage billed on top" }, { "item": "Tool call on Team", "unit": "call", "usd": 0.01, "note": "After the included allowance" } ], "provenance": { "legalEntity": "Arcade AI, Inc.", "domain": "arcade.dev", "domainRegistered": "2019-03-26", "endpointOnVendorDomain": true, "terms": "https://www.arcade.dev/terms-of-service", "privacy": "https://www.arcade.dev/privacy-policy", "statusPage": "https://status.arcade.dev", "changelog": "https://releases.arcade.dev/", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "The terms (effective 15 July 2025) name Arcade AI, Inc. and California law.", "The docs changelog at docs.arcade.dev/en/references/changelog redirects to releases.arcade.dev, dated release notes for each self-hosted version (1 November 2026)." ], "score": 94 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/arcade.json", "live": { "slug": "arcade", "probe": { "target": "https://api.arcade.dev", "method": "get", "lastAt": "2026-11-07T23:26:18.704216133Z", "lastOk": true, "lastStatus": 200, "lastMs": 578, "authRequired": false, "uptime24h": 100, "uptime30d": 99.96, "p50ms24h": 627, "p95ms24h": 943, "samples24h": 243, "samples30d": 7961, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 266 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 248 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 238, "ok": 238 } ] }, "vendorStatus": { "page": "https://status.arcade.dev", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T23:31:06.783521079Z" }, "versions": [ { "registry": "npm", "name": "@arcadeai/arcadejs", "version": "2.4.1", "seenAt": "2026-11-06T23:06:54.409613244Z" }, { "registry": "pypi", "name": "arcade-mcp", "version": "1.17.2", "released": "2026-11-05", "seenAt": "2026-11-06T23:06:54.815298139Z" }, { "registry": "pypi", "name": "arcadepy", "version": "1.10.0", "released": "2025-11-06", "seenAt": "2026-11-06T23:06:54.629098435Z" } ], "githubStars": 1081, "npmWeekly": 183631, "pypiWeekly": 60276, "securityTxt": { "url": "https://arcade.dev/.well-known/security.txt", "state": "valid", "expires": "2027-07-20T00:00:00Z", "checkedAt": "2026-11-07T16:00:08.069303281Z" }, "llmsTxt": { "url": "https://docs.arcade.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:34.307036325Z" }, "domain": { "domain": "arcade.dev", "registered": "2019-03-26", "source": "https://pubapi.registry.google/rdap/domain/arcade.dev", "checkedAt": "2026-11-01T14:15:00.835182451Z" }, "pages": [ { "url": "https://docs.arcade.dev/en/references/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-01T06:40:41.325577059Z", "changedAt": "2026-11-01T06:40:41.325577059Z", "fingerprint": "398df7c2431f" }, { "url": "https://releases.arcade.dev/", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:18:15.562159686Z", "changedAt": "2026-11-07T14:18:15.562159686Z", "fingerprint": "4990f0924f8d" }, { "url": "https://www.arcade.dev/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-01T06:56:44.188375284Z", "changedAt": "2026-10-29T05:19:46.273001841Z", "fingerprint": "1432aacad91d" }, { "url": "https://www.arcade.dev/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:24:53.720001332Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1432aacad91d" }, { "url": "https://www.arcade.dev/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:24:55.799459702Z", "changedAt": "2026-10-29T05:19:48.398492297Z", "fingerprint": "46eec3a5cacb" }, { "url": "https://www.arcade.dev/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:57.800296611Z", "changedAt": "2026-10-29T05:19:50.596361802Z", "fingerprint": "5b1fd1e04263" } ], "github": { "repo": "arcadeai/arcade-mcp", "checkedAt": "2026-11-02T08:31:27.749207808Z", "stars": 1071, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T00:24:41Z", "openIssues": 12, "openPRs": 8, "issuesOpened90d": 9, "issuesClosed90d": 7, "prsMerged90d": 41, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-10-29T21:20:44Z" }, "advisories": [ { "ghsa": "GHSA-g2jx-37x6-6438", "cve": "CVE-2025-66454", "severity": "medium", "published": "2025-12-02T00:58:19Z" } ], "replies": { "sampled": 25, "unanswered": 8, "medianDays": 4 } }, "updatedAt": "2026-11-07T23:31:06.783521079Z" } }, "answer": "Arcade.dev scores 64 (B) on agent readiness against Clerk MCP server's 61.9 (C), and leads in 4 of 7 scored categories.", "b": { "slug": "clerk-mcp", "name": "Clerk MCP server", "vendor": "Clerk, Inc.", "vendorUrl": "https://clerk.com", "kind": "mcp", "category": "agent-auth", "summary": "Clerk's hosted MCP server lets an agent manage a Clerk account, applications, users, domains and production instances, and fetch Clerk SDK snippets. Sign-in is OAuth with published scopes.", "url": "https://www.anchorterminal.com/tools/clerk-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/clerk-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/clerk-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/clerk-mcp.json", "dns": "clerk-mcp.grade.anchorterminal.com", "transports": [ "streamable-http" ], "remoteUrl": "https://mcp.clerk.com/mcp", "packages": [], "auth": "oauth", "authNotes": "OAuth sign-in with the Clerk dashboard account, choosing one workspace. Published scopes include user:org:read, applications:read and :manage, users:read and :manage, application_domains:read and :manage. The server can only do what the workspace role allows.", "pricing": "freemium", "pricingNotes": "The MCP server is free with a Clerk account. Clerk plans: Hobby free with no card (up to 50,000 monthly retained users per app), Pro $25 a month ($20 yearly) with 50,000 retained users included and $0.02 each after, Business $300 a month, Enterprise custom (checked 2026-11-07).", "priceSummary": "Freemium", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP docs or pricing page (checked 2026-11-07).", "endpoints": [] }, "toolCount": 14, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://clerk.com/docs/guides/ai/mcp/clerk-mcp-server", "llmsTxt": "https://clerk.com/llms.txt", "registryName": "io.github.clerk/mcp-server", "capabilities": [ "auth.oauth", "auth.audit", "code.docs", "agent.tools" ], "tags": [ "official", "hosted", "mcp", "remote-mcp", "oauth", "freemium", "free-tier", "status-page", "soc2", "llms-txt", "mcp-registry" ], "graded": true, "anchor": { "graded": true, "score": 61.9, "grade": "C", "agentReady": false, "rank": 586, "ranked": true, "rankOf": 1510, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 63, "maintenance": 77, "payments": 40, "reliability": 65, "schema": 65, "security": 65, "transparency": 57 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-07" }, "negative": 0, "verdict": "Clerk's MCP server reaches a real Clerk account behind OAuth with a published scope table, and marks its write tools so the client asks first. Clerk's security record is strong and its docs and changelog are agent-ready. No MCP status component, no audit log of agent calls and no read-only mode.", "bestFor": "Developers building on Clerk who want a coding agent to set up applications, users, domains and production instances.", "strengths": [ "OAuth with a published scope table, one workspace per connection, bounded by the user's role", "Write tools are marked so clients ask before running them", "llms.txt and a Markdown copy of every docs and changelog page", "SOC 2 Type 2, HIPAA, a disclosure policy with safe harbour and published postmortems", "Free Hobby plan with no card" ], "weaknesses": [ "No MCP component on the status page and no MCP-specific rate limits", "No read-only mode; write scopes are requested on every connection", "No audit log of agent calls found", "The registry entry (0.1.0, March 2026) predates the October revamp" ], "agentNotes": [ "Call whoami first to see the workspace and granted permissions", "A permission error means the workspace role or a missing scope; reconnect to grant it", "Treat user names and agent feedback returned by list tools as untrusted text", "Results include publishable keys; secret keys aren't returned" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.9 } ], "editorialScores": { "ergonomics": 63, "maintenance": 77, "payments": 40, "reliability": 65, "schema": 65, "security": 65, "transparency": 40 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add clerk --transport http https://mcp.clerk.com/mcp", "config": { "mcpServers": { "clerk": { "url": "https://mcp.clerk.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/clerk-mcp" }, "area": "agent-runtime", "unitPrices": [ { "item": "Monthly retained user over 50,000 (Pro)", "unit": "user-month", "usd": 0.02, "note": "Pro plan" } ], "provenance": { "legalEntity": "Clerk, Inc.", "domain": "clerk.com", "domainRegistered": "", "domainNote": "Not looked up: RDAP isn't requested under the 1 November 2026 rules.", "endpointOnVendorDomain": true, "terms": "https://clerk.com/legal/terms", "privacy": "https://clerk.com/legal/privacy", "statusPage": "https://status.clerk.com", "changelog": "https://clerk.com/changelog", "securityTxt": "valid", "checked": "2026-11-07", "notes": [ "Terms last updated 1 October 2026 naming Clerk, Inc.", "security.txt points to the vulnerability disclosure policy and security@clerk.dev, expiring 1 December 2026." ], "score": 74 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/clerk-mcp.json", "live": { "slug": "clerk-mcp", "probe": { "target": "https://mcp.clerk.com/mcp", "method": "mcp-initialize", "lastAt": "2026-11-07T23:26:24.547451095Z", "lastOk": true, "lastStatus": 401, "lastMs": 55, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 90, "p95ms24h": 179, "samples24h": 48, "samples30d": 48, "days": [ { "date": "2026-11-07", "probes": 48, "ok": 48 } ] }, "vendorStatus": { "page": "https://status.clerk.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T23:31:13.237574084Z" }, "updatedAt": "2026-11-07T23:31:13.237574084Z" } }, "edges": [ { "by": 23, "category": "ergonomics", "leads": "arcade", "name": "Agent ergonomics", "reasons": { "a": "Gateways expose a chosen subset of tools, and formatted_tools filters by toolkit with limit and offset, so context can be sized (20). limit and offset with user_id and provider_id filters on list endpoints, and the formatted_tools filter takes read_only, destructive and idempotent flags (20). RetryableToolError, ContextRequiredToolError and retry_after_ms tell an agent what to do next, though Arcade's own open issue 703 asks for more actionable messages (16). Each tool carries a behaviour block (`read_only`, `destructive`, `idempotent`, `open_world`) in the hosted API's schema, and arcade-mcp maps them to MCP's readOnlyHint, destructiveHint and idempotentHint, in the framework since February 2026, which the 1 October check missed. Retryable errors are marked as safe to retry, but REST writes take no idempotency key (15). Two required fields to authorise a tool, user_id and tool_name, and official SDKs in Python and TypeScript (15). 20 + 20 + 16 + 15 + 15 = 86.", "b": "14 tools, two of them for sending feedback to Clerk (15). list_users takes filters; no paging documented (10 of 20). The FAQ explains permission errors and how to fix them (8 of 20). 'Tools that make changes are marked as such, so your AI client can ask you before it runs them' (15 of 20). Official SDKs in many languages and a CLI (15). 15 + 10 + 8 + 15 + 15 = 63." }, "scores": { "a": 86, "b": 63 } }, { "by": 22, "category": "schema", "leads": "arcade", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI 3.0 at api.arcade.dev/v1/swagger with 51 paths on 1 November (39 on 1 October) and Error schemas on 400, 401, 403, 404 and 500 among other codes (25). llms.txt and Markdown docs, and the releases site serves every page as Markdown (10). Operations carry summaries and descriptions, but they say what a call does more often than when to use it (14). Required fields and limits are typed (limit max 1,000 since 1.11.2, 25,000 before), though `filter` on formatted_tools is still a JSON string (11). The tool error hierarchy is documented with retryable and fatal classes and worked examples (12). Versioned under /v1, and the docs changelog now redirects to releases.arcade.dev, dated release notes for each version (1.11.4 on 28 October, 1.11.3 on 21 October, 1.11.2 on 13 October, 1.11.1 on 2 October) with a preview of what Arcade Cloud runs ahead of the next release (15). 25 + 10 + 14 + 11 + 12 + 15 = 87.", "b": "Typed JSON Schema by protocol, not read because every tool needs sign-in (15 of 25). llms.txt and a .md copy of every docs page (10). The docs table says what each of the 14 tools is for (12 of 20). Input typing not verifiable without a session (5 of 15). Example prompts and an FAQ on permission errors (8 of 15). Dated public changelog with an MCP entry on 15 October 2026 (15). 15 + 10 + 12 + 5 + 8 + 15 = 65." }, "scores": { "a": 87, "b": 65 } }, { "by": 14, "category": "transparency", "leads": "arcade", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed platform under terms that name Arcade AI, Inc. and California law, with the MIT arcade-mcp framework beside it (15). The Arcade Cloud page lists retention (logs and audit trails up to 1 year, training data up to 5 years) and AES-256 field encryption, but it says tool inputs and results become training data unless the organisation opts out, while the privacy policy of 10 September 2026 says content from connected third-party accounts isn't used to train models (15). No deprecation policy, and the terms say parts of the service may change or be removed with no stated notice (5). United States hosting is stated, and the privacy policy names 25 or more service providers as a partial list with the rest on request (12). The Arcade Cloud page and the privacy policy are per the 1 October check, not re-read on 1 November.", "b": "Closed service under terms naming Clerk, Inc., last updated 1 October 2026 (15). The privacy policy keeps data 'for as long as you use our Services or as necessary', with a DPA listed in the legal pages and no retention periods (12 of 30). No deprecation policy for the MCP server found (5 of 20). Subprocessors referenced through the DPA, list not read (8 of 20). 15 + 12 + 5 + 8 = 40." }, "scores": { "a": 71, "b": 57 } }, { "by": 6, "category": "security", "leads": "arcade", "name": "Security \u0026 auth", "reasons": { "a": "Gateways sign end users in with OAuth through Arcade Auth or your own OIDC provider, and provider tokens are requested per tool scope, but the REST fallback is one project API key plus an `Arcade-User-ID` header that can name any user (22). Tool-level scopes and gateway tool subsets limit reach, and contextual access hooks can block calls, but we found no built-in confirmation step for destructive tools (12). Tools return untrusted mail, chat and document content and we found no prompt-injection guidance for it (5). Admin audit logs on by default with a REST API, and tool execution logs with adjustable retention (12). security.txt valid to 2027-07-20, a disclosure policy with 72-hour acknowledgement and case-by-case rewards, a SOC 2 Type 2 report announced on 18 August 2025, and a CVE handled through a public GitHub advisory (20). Re-read on 1 November. security.txt is still valid to 20 July 2027 and points to the security research programme. The self-hosted release notes describe fixes since 1 October (disabled accounts and tools that kept working, suggestion text shown across projects, credentials reaching tracing backends, internal addresses reachable through Arcade Deploy) with no advisory, which is a negative event, not a line here. 22 + 12 + 5 + 12 + 20 = 71.", "b": "OAuth with a published scope table and one workspace per connection (30). Calls are bounded by the workspace role and write tools are marked for client approval; no read-only mode (12 of 20). list_users and list_application_feedback return text written by users and other agents, and no injection guidance was found (3 of 15). No audit log of MCP calls found (0). security.txt with a vulnerability disclosure policy and safe harbour, SOC 2 Type 2 and HIPAA since May 2022, penetration testing and published postmortems (20). 30 + 12 + 3 + 0 + 20 = 65." }, "scores": { "a": 71, "b": 65 } } ], "facts": [ { "a": "HTTP API", "b": "MCP server", "name": "Kind" }, { "a": "Arcade.dev", "b": "Clerk, Inc.", "name": "Vendor" }, { "a": "https://api.arcade.dev", "b": "https://mcp.clerk.com/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT (arcade-mcp framework and SDKs), platform closed", "b": "none", "name": "Licence" }, { "a": "none", "b": "14", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "io.github.clerk/mcp-server", "name": "MCP registry" }, { "a": "2026-10-29", "b": "none", "name": "Last release" }, { "a": "2025-07-15", "b": "not read yet", "name": "Terms last updated" }, { "a": "2026-09-10", "b": "not read yet", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "1k stars, 125k npm/wk, 70k PyPI/wk", "b": "none", "name": "Popularity" }, { "a": "2.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Arcade.dev scores 64 (B) on agent readiness against Clerk MCP server's 61.9 (C), and leads in 4 of 7 scored categories.", "question": "Which is better for AI agents, Arcade.dev or Clerk MCP server?" }, { "answer": "Arcade.dev takes an API key or an OAuth sign-in. Clerk MCP server uses an OAuth sign-in.", "question": "Do Arcade.dev and Clerk MCP server need an API key?" }, { "answer": "Yes. Arcade.dev has a hosted endpoint at https://api.arcade.dev and Clerk MCP server at https://mcp.clerk.com/mcp.", "question": "Can an agent call Arcade.dev and Clerk MCP server without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 87 against 65", "Agent ergonomics, 86 against 63", "Security \u0026 auth, 71 against 65", "Transparency \u0026 trust, 71 against 57" ], "also": [ "Runs on your own machine", "Free to start without a card" ], "goodFor": "A product whose agent acts in many users' SaaS accounts and wants the tools written and run for it, not only the tokens.", "slug": "arcade", "watchFor": "The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise" }, { "aheadOn": null, "also": [ "No incidents deducted, where Arcade.dev loses 7 points for them" ], "goodFor": "Developers building on Clerk who want a coding agent to set up applications, users, domains and production instances.", "slug": "clerk-mcp", "watchFor": "No MCP component on the status page and no MCP-specific rate limits" } ], "history": { "arcade": [ { "causes": [ "evidence", "correction", "event" ], "date": "2026-11-01", "delta": -2.9, "from": 66.9, "fromGrade": "B", "to": 64, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.1, "from": 67, "fromGrade": "B", "to": 66.9, "toGrade": "B" } ], "clerk-mcp": null }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-arcade.json", "title": "Aembit vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/aembit-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-clerk-mcp.json", "title": "Aembit vs Clerk MCP server", "url": "https://www.anchorterminal.com/compare/aembit-vs-clerk-mcp" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.json", "title": "Amazon Bedrock AgentCore Identity vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-clerk-mcp.json", "title": "Amazon Bedrock AgentCore Identity vs Clerk MCP server", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-clerk-mcp" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.json", "title": "Arcade.dev vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.json", "title": "Arcade.dev vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-keycard.json", "title": "Arcade.dev vs Keycard", "url": "https://www.anchorterminal.com/compare/arcade-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.json", "title": "Arcade.dev vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-nango.json", "title": "Arcade.dev vs Nango", "url": "https://www.anchorterminal.com/compare/arcade-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.json", "title": "Arcade.dev vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.json", "title": "Arcade.dev vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.json", "title": "Arcade.dev vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-workos-pipes.json", "title": "Arcade.dev vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/arcade-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-clerk-mcp.json", "title": "Auth0 for AI Agents (Token Vault) vs Clerk MCP server", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-clerk-mcp" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-cloudflare-workers-oauth-provider.json", "title": "Clerk MCP server vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-descope-agentic-identity.json", "title": "Clerk MCP server vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-keycard.json", "title": "Clerk MCP server vs Keycard", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-microsoft-entra-agent-id.json", "title": "Clerk MCP server vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-nango.json", "title": "Clerk MCP server vs Nango", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-scalekit-agentkit.json", "title": "Clerk MCP server vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-stytch-connected-apps.json", "title": "Clerk MCP server vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-vercel-connect.json", "title": "Clerk MCP server vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/clerk-mcp-vs-workos-pipes.json", "title": "Clerk MCP server vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/clerk-mcp-vs-workos-pipes" } ], "panel": null, "scores": [ { "arcade": 63, "by": 2, "clerk-mcp": 65, "edge": "clerk-mcp", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "arcade": 87, "by": 22, "clerk-mcp": 65, "edge": "arcade", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "arcade": 86, "by": 23, "clerk-mcp": 63, "edge": "arcade", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "arcade": 71, "by": 6, "clerk-mcp": 65, "edge": "arcade", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "arcade": 40, "by": 0, "clerk-mcp": 40, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "arcade": 76, "by": 1, "clerk-mcp": 77, "edge": "clerk-mcp", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "arcade": 71, "by": 14, "clerk-mcp": 57, "edge": "arcade", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Arcade.dev scores 64 (B) on agent readiness against Clerk MCP server's 61.9 (C), and leads in 4 of 7 scored categories. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "arcade": "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise, and October's self-hosted releases fixed several access-control flaws without an advisory.", "clerk-mcp": "Clerk's MCP server reaches a real Clerk account behind OAuth with a published scope table, and marks its write tools so the client asks first. Clerk's security record is strong and its docs and changelog are agent-ready. No MCP status component, no audit log of agent calls and no read-only mode." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/arcade-vs-clerk-mcp", "json": "https://www.anchorterminal.com/compare/arcade-vs-clerk-mcp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/arcade-vs-clerk-mcp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/arcade-vs-clerk-mcp.min.md" }, "markdown": "Arcade.dev scores 64 (B) on agent readiness against Clerk MCP server's 61.9 (C), and leads in 4 of 7 scored categories. Both do oauth for agents.\n\n- Arcade.dev: grade B, 64/100, rank #489 of 1510. Markdown https://www.anchorterminal.com/tools/arcade.md · JSON https://www.anchorterminal.com/api/v1/tools/arcade.json\n- Clerk MCP server: grade C, 61.9/100, rank #586 of 1510. Markdown https://www.anchorterminal.com/tools/clerk-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/clerk-mcp.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 151 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Arcade.dev (B)\n\nGood for: A product whose agent acts in many users' SaaS accounts and wants the tools written and run for it, not only the tokens.\n\nAhead on:\n- Schema \u0026 documentation, 87 against 65\n- Agent ergonomics, 86 against 63\n- Security \u0026 auth, 71 against 65\n- Transparency \u0026 trust, 71 against 57\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise\n\n### Clerk MCP server (C)\n\nGood for: Developers building on Clerk who want a coding agent to set up applications, users, domains and production instances.\n\nAlso in its favour:\n- No incidents deducted, where Arcade.dev loses 7 points for them\n\nWatch for: No MCP component on the status page and no MCP-specific rate limits\n\n\n## Why the edge\n\n### Agent ergonomics: Arcade.dev +23\n\n- Arcade.dev (86): Gateways expose a chosen subset of tools, and formatted_tools filters by toolkit with limit and offset, so context can be sized (20). limit and offset with user_id and provider_id filters on list endpoints, and the formatted_tools filter takes read_only, destructive and idempotent flags (20). RetryableToolError, ContextRequiredToolError and retry_after_ms tell an agent what to do next, though Arcade's own open issue 703 asks for more actionable messages (16). Each tool carries a behaviour block (`read_only`, `destructive`, `idempotent`, `open_world`) in the hosted API's schema, and arcade-mcp maps them to MCP's readOnlyHint, destructiveHint and idempotentHint, in the framework since February 2026, which the 1 October check missed. Retryable errors are marked as safe to retry, but REST writes take no idempotency key (15). Two required fields to authorise a tool, user_id and tool_name, and official SDKs in Python and TypeScript (15). 20 + 20 + 16 + 15 + 15 = 86.\n- Clerk MCP server (63): 14 tools, two of them for sending feedback to Clerk (15). list_users takes filters; no paging documented (10 of 20). The FAQ explains permission errors and how to fix them (8 of 20). 'Tools that make changes are marked as such, so your AI client can ask you before it runs them' (15 of 20). Official SDKs in many languages and a CLI (15). 15 + 10 + 8 + 15 + 15 = 63.\n\n### Schema \u0026 documentation: Arcade.dev +22\n\n- Arcade.dev (87): OpenAPI 3.0 at api.arcade.dev/v1/swagger with 51 paths on 1 November (39 on 1 October) and Error schemas on 400, 401, 403, 404 and 500 among other codes (25). llms.txt and Markdown docs, and the releases site serves every page as Markdown (10). Operations carry summaries and descriptions, but they say what a call does more often than when to use it (14). Required fields and limits are typed (limit max 1,000 since 1.11.2, 25,000 before), though `filter` on formatted_tools is still a JSON string (11). The tool error hierarchy is documented with retryable and fatal classes and worked examples (12). Versioned under /v1, and the docs changelog now redirects to releases.arcade.dev, dated release notes for each version (1.11.4 on 28 October, 1.11.3 on 21 October, 1.11.2 on 13 October, 1.11.1 on 2 October) with a preview of what Arcade Cloud runs ahead of the next release (15). 25 + 10 + 14 + 11 + 12 + 15 = 87.\n- Clerk MCP server (65): Typed JSON Schema by protocol, not read because every tool needs sign-in (15 of 25). llms.txt and a .md copy of every docs page (10). The docs table says what each of the 14 tools is for (12 of 20). Input typing not verifiable without a session (5 of 15). Example prompts and an FAQ on permission errors (8 of 15). Dated public changelog with an MCP entry on 15 October 2026 (15). 15 + 10 + 12 + 5 + 8 + 15 = 65.\n\n### Transparency \u0026 trust: Arcade.dev +14\n\n- Arcade.dev (71): Closed platform under terms that name Arcade AI, Inc. and California law, with the MIT arcade-mcp framework beside it (15). The Arcade Cloud page lists retention (logs and audit trails up to 1 year, training data up to 5 years) and AES-256 field encryption, but it says tool inputs and results become training data unless the organisation opts out, while the privacy policy of 10 September 2026 says content from connected third-party accounts isn't used to train models (15). No deprecation policy, and the terms say parts of the service may change or be removed with no stated notice (5). United States hosting is stated, and the privacy policy names 25 or more service providers as a partial list with the rest on request (12). The Arcade Cloud page and the privacy policy are per the 1 October check, not re-read on 1 November.\n- Clerk MCP server (57): Closed service under terms naming Clerk, Inc., last updated 1 October 2026 (15). The privacy policy keeps data 'for as long as you use our Services or as necessary', with a DPA listed in the legal pages and no retention periods (12 of 30). No deprecation policy for the MCP server found (5 of 20). Subprocessors referenced through the DPA, list not read (8 of 20). 15 + 12 + 5 + 8 = 40.\n\n### Security \u0026 auth: Arcade.dev +6\n\n- Arcade.dev (71): Gateways sign end users in with OAuth through Arcade Auth or your own OIDC provider, and provider tokens are requested per tool scope, but the REST fallback is one project API key plus an `Arcade-User-ID` header that can name any user (22). Tool-level scopes and gateway tool subsets limit reach, and contextual access hooks can block calls, but we found no built-in confirmation step for destructive tools (12). Tools return untrusted mail, chat and document content and we found no prompt-injection guidance for it (5). Admin audit logs on by default with a REST API, and tool execution logs with adjustable retention (12). security.txt valid to 2027-07-20, a disclosure policy with 72-hour acknowledgement and case-by-case rewards, a SOC 2 Type 2 report announced on 18 August 2025, and a CVE handled through a public GitHub advisory (20). Re-read on 1 November. security.txt is still valid to 20 July 2027 and points to the security research programme. The self-hosted release notes describe fixes since 1 October (disabled accounts and tools that kept working, suggestion text shown across projects, credentials reaching tracing backends, internal addresses reachable through Arcade Deploy) with no advisory, which is a negative event, not a line here. 22 + 12 + 5 + 12 + 20 = 71.\n- Clerk MCP server (65): OAuth with a published scope table and one workspace per connection (30). Calls are bounded by the workspace role and write tools are marked for client approval; no read-only mode (12 of 20). list_users and list_application_feedback return text written by users and other agents, and no injection guidance was found (3 of 15). No audit log of MCP calls found (0). security.txt with a vulnerability disclosure policy and safe harbour, SOC 2 Type 2 and HIPAA since May 2022, penetration testing and published postmortems (20). 30 + 12 + 3 + 0 + 20 = 65.\n\n## Score by category\n\n| Category | Weight | Arcade.dev | Clerk MCP server | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 63 | 65 | Clerk MCP server +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 87 | 65 | Arcade.dev +22 |\n| Agent ergonomics | 13% (16.2 this run) | 86 | 63 | Arcade.dev +23 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 65 | Arcade.dev +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 40 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 76 | 77 | Clerk MCP server +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 71 | 57 | Arcade.dev +14 |\n| Negative events | ≤15 | -7 | 0 | |\n| **Total** | | **64 · B** | **61.9 · C** | |\n\n## Facts side by side\n\n| Fact | Arcade.dev | Clerk MCP server |\n| --- | --- | --- |\n| Kind | HTTP API | MCP server |\n| Vendor | Arcade.dev | Clerk, Inc. |\n| Hosted endpoint | `https://api.arcade.dev` | `https://mcp.clerk.com/mcp` |\n| Transports | HTTP, Streamable HTTP, stdio | Streamable HTTP |\n| Auth | OAuth or key | OAuth |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | MIT (arcade-mcp framework and SDKs), platform closed | none |\n| Tools exposed | none | 14 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `io.github.clerk/mcp-server` |\n| Last release | 2026-10-29 | none |\n| Terms last updated | 2025-07-15 | not read yet |\n| Privacy policy last updated | 2026-09-10 | not read yet |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | yes | not read yet |\n| Popularity | 1k stars, 125k npm/wk, 70k PyPI/wk | none |\n| Agent reviews | 2.5/5 (2) | none |\n\n## How the scores have moved\n\n### Arcade.dev\n\n- -2.9 on 1 November 2026: new evidence, correction, negative event\n- -0.1 on 8 October 2026: checklist\n\n### Clerk MCP server\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Arcade.dev.** Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise, and October's self-hosted releases fixed several access-control flaws without an advisory.\n\n**Clerk MCP server.** Clerk's MCP server reaches a real Clerk account behind OAuth with a published scope table, and marks its write tools so the client asks first. Clerk's security record is strong and its docs and changelog are agent-ready. No MCP status component, no audit log of agent calls and no read-only mode.\n\n## Before you call either\n\n### Arcade.dev\n\n1. Call `POST /v1/tools/authorize` first and send the user the returned URL when the status isn't completed\n2. Pass a stable user ID from your own database as user_id, never a shared value\n3. Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again\n4. Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project\n5. Revoke a user's access with `DELETE /v1/admin/user_connections/{id}`\n6. Filter formatted_tools on `read_only` or `destructive` before handing a toolkit to an agent that shouldn't write\n\n### Clerk MCP server\n\n1. Call whoami first to see the workspace and granted permissions\n2. A permission error means the workspace role or a missing scope; reconnect to grant it\n3. Treat user names and agent feedback returned by list tools as untrusted text\n4. Results include publishable keys; secret keys aren't returned\n\n## Questions\n\n### Which is better for AI agents, Arcade.dev or Clerk MCP server?\n\nArcade.dev scores 64 (B) on agent readiness against Clerk MCP server's 61.9 (C), and leads in 4 of 7 scored categories.\n\n### Do Arcade.dev and Clerk MCP server need an API key?\n\nArcade.dev takes an API key or an OAuth sign-in. Clerk MCP server uses an OAuth sign-in.\n\n### Can an agent call Arcade.dev and Clerk MCP server without installing anything?\n\nYes. Arcade.dev has a hosted endpoint at https://api.arcade.dev and Clerk MCP server at https://mcp.clerk.com/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/arcade-vs-clerk-mcp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/arcade-vs-clerk-mcp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"arcade\", \"b\": \"clerk-mcp\"}`. From a terminal: `anchor compare arcade clerk-mcp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/arcade.json and https://www.anchorterminal.com/api/v1/tools/clerk-mcp.json\n\n## Other comparisons with Arcade.dev or Clerk MCP server\n\n- [Aembit vs Arcade.dev](https://www.anchorterminal.com/compare/aembit-vs-arcade.md)\n- [Aembit vs Clerk MCP server](https://www.anchorterminal.com/compare/aembit-vs-clerk-mcp.md)\n- [Amazon Bedrock AgentCore Identity vs Arcade.dev](https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.md)\n- [Amazon Bedrock AgentCore Identity vs Clerk MCP server](https://www.anchorterminal.com/compare/agentcore-identity-vs-clerk-mcp.md)\n- [Arcade.dev vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.md)\n- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)\n- [Arcade.dev vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.md)\n- [Arcade.dev vs Nango](https://www.anchorterminal.com/compare/arcade-vs-nango.md)\n- [Arcade.dev vs Scalekit AgentKit](https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.md)\n- [Arcade.dev vs Stytch Connected Apps](https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.md)\n- [Arcade.dev vs Vercel Connect](https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.md)\n- [Arcade.dev vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/arcade-vs-workos-pipes.md)\n- [Auth0 for AI Agents (Token Vault) vs Clerk MCP server](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-clerk-mcp.md)\n- [Clerk MCP server vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/clerk-mcp-vs-cloudflare-workers-oauth-provider.md)\n- [Clerk MCP server vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/clerk-mcp-vs-descope-agentic-identity.md)\n- [Clerk MCP server vs Keycard](https://www.anchorterminal.com/compare/clerk-mcp-vs-keycard.md)\n- [Clerk MCP server vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/clerk-mcp-vs-microsoft-entra-agent-id.md)\n- [Clerk MCP server vs Nango](https://www.anchorterminal.com/compare/clerk-mcp-vs-nango.md)\n- [Clerk MCP server vs Scalekit AgentKit](https://www.anchorterminal.com/compare/clerk-mcp-vs-scalekit-agentkit.md)\n- [Clerk MCP server vs Stytch Connected Apps](https://www.anchorterminal.com/compare/clerk-mcp-vs-stytch-connected-apps.md)\n- [Clerk MCP server vs Vercel Connect](https://www.anchorterminal.com/compare/clerk-mcp-vs-vercel-connect.md)\n- [Clerk MCP server vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/clerk-mcp-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Arcade.dev vs Clerk MCP server", "url": "" } ], "description": "Arcade.dev scores 64 (B) to Clerk's 61.9 (C) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Arcade.dev B 64", "Clerk MCP server C 61.9", "scores" ], "h1": "Arcade.dev vs Clerk MCP server", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/arcade-vs-clerk-mcp", "published": "2026-10-01", "section": "tools", "title": "Arcade.dev vs Clerk for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/arcade-vs-clerk-mcp" }, "tokens": { "markdown": 4050, "slim": 2230 }, "version": 1 }