Arcade.dev vs Cloudflare Workers OAuth Provider

Arcade.dev 71

Closed platform under terms that name Arcade AI, Inc. and California law, with the MIT arcade-mcp framework beside it (15). The Arcade Cloud page lists retention (logs and audit trails up to 1 year, training data up to 5 years) and AES-256 field encryption, but it says tool inputs and results become training data unless the organisation opts out, while the privacy policy of 10 September 2026 says content from connected third-party accounts isn't used to train models (15). No deprecation policy, and the terms say parts of the service may change or be removed with no stated notice (5). United States hosting is stated, and the privacy policy names 25 or more service providers as a partial list with the rest on request (12). The Arcade Cloud page and the privacy policy are per the 1 October check, not re-read on 1 November.

Cloudflare Workers OAuth Provider 86

MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating resolveExternalToken, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.

Arcade.dev 86

Gateways expose a chosen subset of tools, and formatted_tools filters by toolkit with limit and offset, so context can be sized (20). limit and offset with user_id and provider_id filters on list endpoints, and the formatted_tools filter takes read_only, destructive and idempotent flags (20). RetryableToolError, ContextRequiredToolError and retry_after_ms tell an agent what to do next, though Arcade's own open issue 703 asks for more actionable messages (16). Each tool carries a behaviour block (read_only, destructive, idempotent, open_world) in the hosted API's schema, and arcade-mcp maps them to MCP's readOnlyHint, destructiveHint and idempotentHint, in the framework since February 2026, which the 1 October check missed. Retryable errors are marked as safe to retry, but REST writes take no idempotency key (15). Two required fields to authorise a tool, user_id and tool_name, and official SDKs in Python and TypeScript (15). 20 + 20 + 16 + 15 + 15 = 86.

Cloudflare Workers OAuth Provider 74

Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.

Arcade.dev 63

Atlassian Statuspage at status.arcade.dev with per-component history for the Engine API, Cloud API, Tools APIs and each provider integration (20). Three incidents from 3 August to 1 November, read from history.atom. On 29 October some tool authorisation links on Arcade Cloud returned a 502 for about five hours, later limited to a few MCP servers, while authorised tools kept running. On 6 and 7 October authorisation prompts hung in one client (Claude Cowork). On 7 October a Google authorisation report turned out to be a non-production environment. All partial, so minor only (20). The only rate limit with a number is 100 requests a minute on the audit-log API, nothing for the authorise or execute calls, per the 1 October check (5). Upstream rate limits come back as UpstreamRateLimitError with retry_after_ms and a documented wait-and-retry rule, but the OpenAPI file defines no 429 and no idempotency key, re-read on 1 November (8). Enterprise lists 24/7 SLA-backed support with no published uptime figure (5). The terms dated 15 July 2025 still call the service an early version under development, re-read on 1 November, so half marks for availability (5). 20 + 20 + 5 + 8 + 5 + 5 = 63.

Cloudflare Workers OAuth Provider 74

Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.

Arcade.dev 76

arcade-mcp 1.17.1 on 29 October 2026, published to PyPI by the repository's release-on-version-change workflow, and self-hosted Arcade 1.11.4 on 28 October (30). In the last 90 days arcade-mcp moved to 1.15.2, 1.16.0, 1.16.1, 1.16.2, 1.16.3, 1.17.0 and 1.17.1, and self-hosted Arcade shipped eleven dated releases from 1.9.5 (6 August) to 1.11.4 (20). Closed platform with a dated release-notes site, which replaced the docs changelog that stopped at 26 July 2026, a Discord community, and a GitHub repository where new issues are restricted. Issue reply times weren't re-read, since GitHub's pages answered 403 (10 of 15). The REST clients lag. arcadepy's newest tag is v1.10.0 of 6 November 2025 and @arcadeai/arcadejs's v2.4.1 of 21 April 2026, from clones on 1 November (8). CI workflows run on arcade-mcp, which supports Python 3.10 to 3.13 (8). 30 + 20 + 10 + 8 + 8 = 76.

Cloudflare Workers OAuth Provider 87

1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.

Arcade.dev 40

No x402, MPP or L402 (0). Per-unit prices published without a login, $0.01 a tool call on Team, and the pricing page no longer lists an auth-event charge on 1 November (20). Free tier of 2,000 tool calls a month with no card (20). A person signs up in a browser to get a project key (0). 0 + 20 + 20 + 0 = 40.

Cloudflare Workers OAuth Provider 50

Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.

Arcade.dev 71

Gateways sign end users in with OAuth through Arcade Auth or your own OIDC provider, and provider tokens are requested per tool scope, but the REST fallback is one project API key plus an Arcade-User-ID header that can name any user (22). Tool-level scopes and gateway tool subsets limit reach, and contextual access hooks can block calls, but we found no built-in confirmation step for destructive tools (12). Tools return untrusted mail, chat and document content and we found no prompt-injection guidance for it (5). Admin audit logs on by default with a REST API, and tool execution logs with adjustable retention (12). security.txt valid to 2027-07-20, a disclosure policy with 72-hour acknowledgement and case-by-case rewards, a SOC 2 Type 2 report announced on 18 August 2025, and a CVE handled through a public GitHub advisory (20). Re-read on 1 November. security.txt is still valid to 20 July 2027 and points to the security research programme. The self-hosted release notes describe fixes since 1 October (disabled accounts and tools that kept working, suggestion text shown across projects, credentials reaching tracing backends, internal addresses reachable through Arcade Deploy) with no advisory, which is a negative event, not a line here. 22 + 12 + 5 + 12 + 20 = 71.

Cloudflare Workers OAuth Provider 80

OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.