{ "data": { "a": { "slug": "arcade", "name": "Arcade.dev", "vendor": "Arcade.dev", "vendorUrl": "https://www.arcade.dev", "kind": "http-api", "category": "agent-auth", "summary": "MCP runtime built around per-user authorisation.", "url": "https://www.anchorterminal.com/tools/arcade", "markdownUrl": "https://www.anchorterminal.com/tools/arcade.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/arcade.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/arcade.json", "dns": "arcade.grade.anchorterminal.com", "repo": "https://github.com/ArcadeAI/arcade-mcp", "license": "MIT (arcade-mcp framework and SDKs), platform closed", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.arcade.dev", "packages": [ { "registry": "npm", "name": "@arcadeai/arcadejs" }, { "registry": "pypi", "name": "arcadepy" }, { "registry": "pypi", "name": "arcade-mcp" } ], "auth": "mixed", "authNotes": "REST calls take the project key as `Authorization: Bearer $ARCADE_API_KEY` and name the end user with `user_id`. MCP gateways sign end users in with OAuth, either Arcade Auth (project members only) or a User Source pointing at your own OIDC provider. Clients that can't run OAuth can send the API key plus an `Arcade-User-ID` header instead.", "pricing": "freemium", "pricingNotes": "Free is $0 with 2,000 tool calls a month, no card, community support on Discord and GitHub. Team is a $25 a month platform fee plus $0.01 per tool call, with next-business-day email support. Enterprise is custom, with annual bundles of tool calls, deployment on Arcade Cloud, in your VPC or air-gapped, SSO, RBAC, audit logs and a dedicated forward-deployed engineer (https://www.arcade.dev/pricing/). The pricing page listed $0.10 per auth event on 1 October and no auth-event charge on 1 November (checked 2026-11-01).", "priceSummary": "$25 / mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1043, "npmWeekly": 124858, "pypiWeekly": 70222, "asOf": "2026-09-30" }, "docsUrl": "https://docs.arcade.dev", "llmsTxt": "https://docs.arcade.dev/llms.txt", "openapi": "https://api.arcade.dev/v1/swagger", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.audit", "agent.tools" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "mcp", "llms-txt", "openapi", "oauth", "python", "typescript", "enterprise", "self-hosted" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 64, "grade": "B", "agentReady": false, "rank": 487, "ranked": true, "rankOf": 1486, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 86, "maintenance": 76, "payments": 40, "reliability": 63, "schema": 87, "security": 71, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -7, "negativeNotes": [ "2025-12-02, CVE-2025-66454 (GHSA-g2jx-37x6-6438, CVSS 6.5, Moderate). The HTTP worker in arcade-mcp shipped a hardcoded default worker secret, so anyone could forge a token and list or call every tool on a self-hosted worker set up by the official guide. Fixed in 1.9.1 and disclosed in public. A fixed Moderate published by the vendor costs 1, as for opensearch and github-mcp-server (-1) (https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438)", "2 to 28 October 2026, fixes of described flaws released with no advisory. Self-hosted 1.11.1 (2 October) and 1.11.2 (13 October) cut off disabled accounts whose dashboard sessions and tokens kept working, including to create project API keys, and stopped the suggestions Inbox showing suggestion text to readers in other projects. 1.11.3 (21 October) stopped disabled tools being listed or called and kept credentials out of tracing spans. 1.11.4 (28 October) refuses DNS-rebinding hostnames and blocks re-pointing an Arcade Deploy server at an internal address. arcade-core's fix of 22 October (#960) stopped rejected input values, tokens included, reaching tool-call stack traces. Arcade Cloud runs these releases ahead of self-hosted. No GHSA or OSV entry found on 1 November. One folded term, -3 (https://releases.arcade.dev/)", "13 and 21 October 2026, published API behaviour changed on Arcade Cloud with no advance notice. Self-hosted 1.11.2 (13 October) removed `GET .../gateways/{gateway_id}/suggestions`, which now answers 404, and cut list endpoints' maximum `limit` from 25,000 to 1,000. 1.11.3 (21 October) made an explicit `null` tool argument mean the default, so callers sending `null` get different results (Asana `CreateTask` and Linear `CreateIssue` assign to the caller, Insightly `SummarizePipeline` rolls up open opportunities only). Arcade Cloud runs this code before each self-hosted release, and the only page describing it ahead of release is a nightly preview of what Cloud already runs, so Cloud callers had no notice before the change. Repeats of one kind fold into one term, -3 (https://releases.arcade.dev/releases/1.11.3/upgrade/index.md)" ], "verdict": "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise, and October's self-hosted releases fixed several access-control flaws without an advisory.", "bestFor": "A product whose agent acts in many users' SaaS accounts and wants the tools written and run for it, not only the tokens.", "strengths": [ "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token", "33 built-in auth providers plus generic OAuth 2.0, and hosted MCP gateways that sign users in through your own OIDC provider", "OpenAPI 3.0 file with 51 paths, llms.txt and a typed tool error hierarchy with retry hints", "Per-call prices in public, $0.01 a tool call on Team, with 2,000 tool calls a month free and no card", "Valid security.txt, a SOC 2 Type 2 report and a CVE fixed through a public advisory", "Each tool declares read-only, destructive and idempotent flags, mapped to MCP's annotation hints" ], "weaknesses": [ "The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise", "Tool inputs and results are training data for up to 5 years unless the organisation opts out", "No published rate limits for the authorise or execute calls, and no 429 in the OpenAPI file", "arcadepy hasn't been released since 6 November 2025, and @arcadeai/arcadejs since 21 April 2026", "Hosting in the United States only outside Enterprise", "Self-hosted releases from 2 to 28 October 2026 fixed access-control and credential-exposure flaws with no published advisory" ], "agentNotes": [ "Call `POST /v1/tools/authorize` first and send the user the returned URL when the status isn't completed", "Pass a stable user ID from your own database as user_id, never a shared value", "Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again", "Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project", "Revoke a user's access with `DELETE /v1/admin/user_connections/{id}`", "Filter formatted_tools on `read_only` or `destructive` before handing a toolkit to an agent that shouldn't write" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64 } ], "editorialScores": { "ergonomics": 86, "maintenance": 76, "payments": 40, "reliability": 63, "schema": 87, "security": 71, "transparency": 47 }, "provenanceScore": 94, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @arcadeai/arcadejs", "http": "curl -X POST https://api.arcade.dev/v1/tools/authorize -H \"Authorization: Bearer $ARCADE_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"tool_name\":\"Gmail.ListEmails\",\"user_id\":\"user-123\"}'", "claudeCode": "claude mcp add --transport http arcade https://api.arcade.dev/mcp/\u003cyour-gateway-slug\u003e", "config": { "mcpServers": { "arcade": { "url": "https://api.arcade.dev/mcp/\u003cyour-gateway-slug\u003e" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/arcade" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan platform fee", "unit": "month", "usd": 25, "note": "Usage billed on top" }, { "item": "Tool call on Team", "unit": "call", "usd": 0.01, "note": "After the included allowance" } ], "provenance": { "legalEntity": "Arcade AI, Inc.", "domain": "arcade.dev", "domainRegistered": "2019-03-26", "endpointOnVendorDomain": true, "terms": "https://www.arcade.dev/terms-of-service", "privacy": "https://www.arcade.dev/privacy-policy", "statusPage": "https://status.arcade.dev", "changelog": "https://releases.arcade.dev/", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "The terms (effective 15 July 2025) name Arcade AI, Inc. and California law.", "The docs changelog at docs.arcade.dev/en/references/changelog redirects to releases.arcade.dev, dated release notes for each self-hosted version (1 November 2026)." ], "score": 94 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/arcade.json", "live": { "slug": "arcade", "probe": { "target": "https://api.arcade.dev", "method": "get", "lastAt": "2026-11-07T18:20:10.906624192Z", "lastOk": true, "lastStatus": 200, "lastMs": 730, "authRequired": false, "uptime24h": 100, "uptime30d": 99.96, "p50ms24h": 625, "p95ms24h": 956, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 266 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 248 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.arcade.dev", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:20:32.839153231Z" }, "versions": [ { "registry": "npm", "name": "@arcadeai/arcadejs", "version": "2.4.1", "seenAt": "2026-11-06T23:06:54.409613244Z" }, { "registry": "pypi", "name": "arcade-mcp", "version": "1.17.2", "released": "2026-11-05", "seenAt": "2026-11-06T23:06:54.815298139Z" }, { "registry": "pypi", "name": "arcadepy", "version": "1.10.0", "released": "2025-11-06", "seenAt": "2026-11-06T23:06:54.629098435Z" } ], "githubStars": 1081, "npmWeekly": 183631, "pypiWeekly": 60276, "securityTxt": { "url": "https://arcade.dev/.well-known/security.txt", "state": "valid", "expires": "2027-07-20T00:00:00Z", "checkedAt": "2026-11-07T16:00:08.069303281Z" }, "llmsTxt": { "url": "https://docs.arcade.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:34.307036325Z" }, "domain": { "domain": "arcade.dev", "registered": "2019-03-26", "source": "https://pubapi.registry.google/rdap/domain/arcade.dev", "checkedAt": "2026-11-01T14:15:00.835182451Z" }, "pages": [ { "url": "https://docs.arcade.dev/en/references/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-01T06:40:41.325577059Z", "changedAt": "2026-11-01T06:40:41.325577059Z", "fingerprint": "398df7c2431f" }, { "url": "https://releases.arcade.dev/", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:18:15.562159686Z", "changedAt": "2026-11-07T14:18:15.562159686Z", "fingerprint": "4990f0924f8d" }, { "url": "https://www.arcade.dev/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-01T06:56:44.188375284Z", "changedAt": "2026-10-29T05:19:46.273001841Z", "fingerprint": "1432aacad91d" }, { "url": "https://www.arcade.dev/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:24:53.720001332Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1432aacad91d" }, { "url": "https://www.arcade.dev/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:24:55.799459702Z", "changedAt": "2026-10-29T05:19:48.398492297Z", "fingerprint": "46eec3a5cacb" }, { "url": "https://www.arcade.dev/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:57.800296611Z", "changedAt": "2026-10-29T05:19:50.596361802Z", "fingerprint": "5b1fd1e04263" } ], "github": { "repo": "arcadeai/arcade-mcp", "checkedAt": "2026-11-02T08:31:27.749207808Z", "stars": 1071, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T00:24:41Z", "openIssues": 12, "openPRs": 8, "issuesOpened90d": 9, "issuesClosed90d": 7, "prsMerged90d": 41, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-10-29T21:20:44Z" }, "advisories": [ { "ghsa": "GHSA-g2jx-37x6-6438", "cve": "CVE-2025-66454", "severity": "medium", "published": "2025-12-02T00:58:19Z" } ], "replies": { "sampled": 25, "unanswered": 8, "medianDays": 4 } }, "updatedAt": "2026-11-07T18:20:10.906624192Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Arcade.dev's 64 (B), and leads in 5 of 7 scored categories. Arcade.dev leads on agent ergonomics.", "b": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "edges": [ { "by": 15, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed platform under terms that name Arcade AI, Inc. and California law, with the MIT arcade-mcp framework beside it (15). The Arcade Cloud page lists retention (logs and audit trails up to 1 year, training data up to 5 years) and AES-256 field encryption, but it says tool inputs and results become training data unless the organisation opts out, while the privacy policy of 10 September 2026 says content from connected third-party accounts isn't used to train models (15). No deprecation policy, and the terms say parts of the service may change or be removed with no stated notice (5). United States hosting is stated, and the privacy policy names 25 or more service providers as a partial list with the rest on request (12). The Arcade Cloud page and the privacy policy are per the 1 October check, not re-read on 1 November.", "b": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77." }, "scores": { "a": 71, "b": 86 } }, { "by": 12, "category": "ergonomics", "leads": "arcade", "name": "Agent ergonomics", "reasons": { "a": "Gateways expose a chosen subset of tools, and formatted_tools filters by toolkit with limit and offset, so context can be sized (20). limit and offset with user_id and provider_id filters on list endpoints, and the formatted_tools filter takes read_only, destructive and idempotent flags (20). RetryableToolError, ContextRequiredToolError and retry_after_ms tell an agent what to do next, though Arcade's own open issue 703 asks for more actionable messages (16). Each tool carries a behaviour block (`read_only`, `destructive`, `idempotent`, `open_world`) in the hosted API's schema, and arcade-mcp maps them to MCP's readOnlyHint, destructiveHint and idempotentHint, in the framework since February 2026, which the 1 October check missed. Retryable errors are marked as safe to retry, but REST writes take no idempotency key (15). Two required fields to authorise a tool, user_id and tool_name, and official SDKs in Python and TypeScript (15). 20 + 20 + 16 + 15 + 15 = 86.", "b": "Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74." }, "scores": { "a": 86, "b": 74 } }, { "by": 11, "category": "reliability", "leads": "cloudflare-workers-oauth-provider", "name": "Reliability", "reasons": { "a": "Atlassian Statuspage at status.arcade.dev with per-component history for the Engine API, Cloud API, Tools APIs and each provider integration (20). Three incidents from 3 August to 1 November, read from history.atom. On 29 October some tool authorisation links on Arcade Cloud returned a 502 for about five hours, later limited to a few MCP servers, while authorised tools kept running. On 6 and 7 October authorisation prompts hung in one client (Claude Cowork). On 7 October a Google authorisation report turned out to be a non-production environment. All partial, so minor only (20). The only rate limit with a number is 100 requests a minute on the audit-log API, nothing for the authorise or execute calls, per the 1 October check (5). Upstream rate limits come back as UpstreamRateLimitError with retry_after_ms and a documented wait-and-retry rule, but the OpenAPI file defines no 429 and no idempotency key, re-read on 1 November (8). Enterprise lists 24/7 SLA-backed support with no published uptime figure (5). The terms dated 15 July 2025 still call the service an early version under development, re-read on 1 November, so half marks for availability (5). 20 + 20 + 5 + 8 + 5 + 5 = 63.", "b": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74." }, "scores": { "a": 63, "b": 74 } }, { "by": 11, "category": "maintenance", "leads": "cloudflare-workers-oauth-provider", "name": "Maintenance \u0026 community", "reasons": { "a": "arcade-mcp 1.17.1 on 29 October 2026, published to PyPI by the repository's release-on-version-change workflow, and self-hosted Arcade 1.11.4 on 28 October (30). In the last 90 days arcade-mcp moved to 1.15.2, 1.16.0, 1.16.1, 1.16.2, 1.16.3, 1.17.0 and 1.17.1, and self-hosted Arcade shipped eleven dated releases from 1.9.5 (6 August) to 1.11.4 (20). Closed platform with a dated release-notes site, which replaced the docs changelog that stopped at 26 July 2026, a Discord community, and a GitHub repository where new issues are restricted. Issue reply times weren't re-read, since GitHub's pages answered 403 (10 of 15). The REST clients lag. arcadepy's newest tag is v1.10.0 of 6 November 2025 and @arcadeai/arcadejs's v2.4.1 of 21 April 2026, from clones on 1 November (8). CI workflows run on arcade-mcp, which supports Python 3.10 to 3.13 (8). 30 + 20 + 10 + 8 + 8 = 76.", "b": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87." }, "scores": { "a": 76, "b": 87 } }, { "by": 10, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Per-unit prices published without a login, $0.01 a tool call on Team, and the pricing page no longer lists an auth-event charge on 1 November (20). Free tier of 2,000 tool calls a month with no card (20). A person signs up in a browser to get a project key (0). 0 + 20 + 20 + 0 = 40.", "b": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50." }, "scores": { "a": 40, "b": 50 } }, { "by": 9, "category": "security", "leads": "cloudflare-workers-oauth-provider", "name": "Security \u0026 auth", "reasons": { "a": "Gateways sign end users in with OAuth through Arcade Auth or your own OIDC provider, and provider tokens are requested per tool scope, but the REST fallback is one project API key plus an `Arcade-User-ID` header that can name any user (22). Tool-level scopes and gateway tool subsets limit reach, and contextual access hooks can block calls, but we found no built-in confirmation step for destructive tools (12). Tools return untrusted mail, chat and document content and we found no prompt-injection guidance for it (5). Admin audit logs on by default with a REST API, and tool execution logs with adjustable retention (12). security.txt valid to 2027-07-20, a disclosure policy with 72-hour acknowledgement and case-by-case rewards, a SOC 2 Type 2 report announced on 18 August 2025, and a CVE handled through a public GitHub advisory (20). Re-read on 1 November. security.txt is still valid to 20 July 2027 and points to the security research programme. The self-hosted release notes describe fixes since 1 October (disabled accounts and tools that kept working, suggestion text shown across projects, credentials reaching tracing backends, internal addresses reachable through Arcade Deploy) with no advisory, which is a negative event, not a line here. 22 + 12 + 5 + 12 + 20 = 71.", "b": "OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80." }, "scores": { "a": 71, "b": 80 } } ], "facts": [ { "a": "HTTP API", "b": "SDK + MCP", "name": "Kind" }, { "a": "Arcade.dev", "b": "Cloudflare", "name": "Vendor" }, { "a": "https://api.arcade.dev", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT (arcade-mcp framework and SDKs), platform closed", "b": "MIT", "name": "Licence" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-10-29", "b": "2026-10-22", "name": "Last release" }, { "a": "2025-07-15", "b": "2025-09-12", "name": "Terms last updated" }, { "a": "2026-09-10", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1k stars, 125k npm/wk, 70k PyPI/wk", "b": "1.9k stars, 1.1M npm/wk", "name": "Popularity" }, { "a": "2.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Arcade.dev's 64 (B), and leads in 5 of 7 scored categories. Arcade.dev leads on agent ergonomics.", "question": "Which is better for AI agents, Arcade.dev or Cloudflare Workers OAuth Provider?" }, { "answer": "Arcade.dev has a hosted endpoint at https://api.arcade.dev. No hosted endpoint is listed for Cloudflare Workers OAuth Provider.", "question": "Can an agent call Arcade.dev and Cloudflare Workers OAuth Provider without installing anything?" }, { "answer": "No open-source release is listed for Arcade.dev. Cloudflare Workers OAuth Provider is open source (MIT).", "question": "Are Arcade.dev and Cloudflare Workers OAuth Provider open source?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 86 against 74" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine", "Free to start without a card" ], "goodFor": "A product whose agent acts in many users' SaaS accounts and wants the tools written and run for it, not only the tokens.", "slug": "arcade", "watchFor": "The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise" }, { "aheadOn": [ "Reliability, 74 against 63", "Security \u0026 auth, 80 against 71", "Payments \u0026 pricing, 50 against 40", "Maintenance \u0026 community, 87 against 76", "Transparency \u0026 trust, 86 against 71" ], "also": [ "Agent-ready, a grade of BB or better", "Open source", "No incidents deducted, where Arcade.dev loses 7 points for them" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" } ], "history": { "arcade": [ { "causes": [ "evidence", "correction", "event" ], "date": "2026-11-01", "delta": -2.9, "from": 66.9, "fromGrade": "B", "to": 64, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.1, "from": 67, "fromGrade": "B", "to": 66.9, "toGrade": "B" } ], "cloudflare-workers-oauth-provider": null }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-arcade.json", "title": "Aembit vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/aembit-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.json", "title": "Amazon Bedrock AgentCore Identity vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.json", "title": "Arcade.dev vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.json", "title": "Arcade.dev vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-keycard.json", "title": "Arcade.dev vs Keycard", "url": "https://www.anchorterminal.com/compare/arcade-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.json", "title": "Arcade.dev vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-nango.json", "title": "Arcade.dev vs Nango", "url": "https://www.anchorterminal.com/compare/arcade-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.json", "title": "Arcade.dev vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.json", "title": "Arcade.dev vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.json", "title": "Arcade.dev vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-workos-pipes.json", "title": "Arcade.dev vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/arcade-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" } ], "panel": null, "scores": [ { "arcade": 63, "by": 11, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "arcade": 87, "by": 1, "cloudflare-workers-oauth-provider": 86, "edge": "arcade", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "arcade": 86, "by": 12, "cloudflare-workers-oauth-provider": 74, "edge": "arcade", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "arcade": 71, "by": 9, "cloudflare-workers-oauth-provider": 80, "edge": "cloudflare-workers-oauth-provider", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "arcade": 40, "by": 10, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "arcade": 76, "by": 11, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "arcade": 71, "by": 15, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Arcade.dev's 64 (B), and leads in 5 of 7 scored categories. Arcade.dev leads on agent ergonomics. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "arcade": "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise, and October's self-hosted releases fixed several access-control flaws without an advisory.", "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider", "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Arcade.dev's 64 (B), and leads in 5 of 7 scored categories. Arcade.dev leads on agent ergonomics. Both do oauth for agents.\n\n- Arcade.dev: grade B, 64/100, rank #487 of 1486. Markdown https://www.anchorterminal.com/tools/arcade.md · JSON https://www.anchorterminal.com/api/v1/tools/arcade.json\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Arcade.dev (B)\n\nGood for: A product whose agent acts in many users' SaaS accounts and wants the tools written and run for it, not only the tokens.\n\nAhead on:\n- Agent ergonomics, 86 against 74\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Reliability, 74 against 63\n- Security \u0026 auth, 80 against 71\n- Payments \u0026 pricing, 50 against 40\n- Maintenance \u0026 community, 87 against 76\n- Transparency \u0026 trust, 86 against 71\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n- No incidents deducted, where Arcade.dev loses 7 points for them\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +15\n\n- Arcade.dev (71): Closed platform under terms that name Arcade AI, Inc. and California law, with the MIT arcade-mcp framework beside it (15). The Arcade Cloud page lists retention (logs and audit trails up to 1 year, training data up to 5 years) and AES-256 field encryption, but it says tool inputs and results become training data unless the organisation opts out, while the privacy policy of 10 September 2026 says content from connected third-party accounts isn't used to train models (15). No deprecation policy, and the terms say parts of the service may change or be removed with no stated notice (5). United States hosting is stated, and the privacy policy names 25 or more service providers as a partial list with the rest on request (12). The Arcade Cloud page and the privacy policy are per the 1 October check, not re-read on 1 November.\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n\n### Agent ergonomics: Arcade.dev +12\n\n- Arcade.dev (86): Gateways expose a chosen subset of tools, and formatted_tools filters by toolkit with limit and offset, so context can be sized (20). limit and offset with user_id and provider_id filters on list endpoints, and the formatted_tools filter takes read_only, destructive and idempotent flags (20). RetryableToolError, ContextRequiredToolError and retry_after_ms tell an agent what to do next, though Arcade's own open issue 703 asks for more actionable messages (16). Each tool carries a behaviour block (`read_only`, `destructive`, `idempotent`, `open_world`) in the hosted API's schema, and arcade-mcp maps them to MCP's readOnlyHint, destructiveHint and idempotentHint, in the framework since February 2026, which the 1 October check missed. Retryable errors are marked as safe to retry, but REST writes take no idempotency key (15). Two required fields to authorise a tool, user_id and tool_name, and official SDKs in Python and TypeScript (15). 20 + 20 + 16 + 15 + 15 = 86.\n- Cloudflare Workers OAuth Provider (74): Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.\n\n### Reliability: Cloudflare Workers OAuth Provider +11\n\n- Arcade.dev (63): Atlassian Statuspage at status.arcade.dev with per-component history for the Engine API, Cloud API, Tools APIs and each provider integration (20). Three incidents from 3 August to 1 November, read from history.atom. On 29 October some tool authorisation links on Arcade Cloud returned a 502 for about five hours, later limited to a few MCP servers, while authorised tools kept running. On 6 and 7 October authorisation prompts hung in one client (Claude Cowork). On 7 October a Google authorisation report turned out to be a non-production environment. All partial, so minor only (20). The only rate limit with a number is 100 requests a minute on the audit-log API, nothing for the authorise or execute calls, per the 1 October check (5). Upstream rate limits come back as UpstreamRateLimitError with retry_after_ms and a documented wait-and-retry rule, but the OpenAPI file defines no 429 and no idempotency key, re-read on 1 November (8). Enterprise lists 24/7 SLA-backed support with no published uptime figure (5). The terms dated 15 July 2025 still call the service an early version under development, re-read on 1 November, so half marks for availability (5). 20 + 20 + 5 + 8 + 5 + 5 = 63.\n- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.\n\n### Maintenance \u0026 community: Cloudflare Workers OAuth Provider +11\n\n- Arcade.dev (76): arcade-mcp 1.17.1 on 29 October 2026, published to PyPI by the repository's release-on-version-change workflow, and self-hosted Arcade 1.11.4 on 28 October (30). In the last 90 days arcade-mcp moved to 1.15.2, 1.16.0, 1.16.1, 1.16.2, 1.16.3, 1.17.0 and 1.17.1, and self-hosted Arcade shipped eleven dated releases from 1.9.5 (6 August) to 1.11.4 (20). Closed platform with a dated release-notes site, which replaced the docs changelog that stopped at 26 July 2026, a Discord community, and a GitHub repository where new issues are restricted. Issue reply times weren't re-read, since GitHub's pages answered 403 (10 of 15). The REST clients lag. arcadepy's newest tag is v1.10.0 of 6 November 2025 and @arcadeai/arcadejs's v2.4.1 of 21 April 2026, from clones on 1 November (8). CI workflows run on arcade-mcp, which supports Python 3.10 to 3.13 (8). 30 + 20 + 10 + 8 + 8 = 76.\n- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +10\n\n- Arcade.dev (40): No x402, MPP or L402 (0). Per-unit prices published without a login, $0.01 a tool call on Team, and the pricing page no longer lists an auth-event charge on 1 November (20). Free tier of 2,000 tool calls a month with no card (20). A person signs up in a browser to get a project key (0). 0 + 20 + 20 + 0 = 40.\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n\n### Security \u0026 auth: Cloudflare Workers OAuth Provider +9\n\n- Arcade.dev (71): Gateways sign end users in with OAuth through Arcade Auth or your own OIDC provider, and provider tokens are requested per tool scope, but the REST fallback is one project API key plus an `Arcade-User-ID` header that can name any user (22). Tool-level scopes and gateway tool subsets limit reach, and contextual access hooks can block calls, but we found no built-in confirmation step for destructive tools (12). Tools return untrusted mail, chat and document content and we found no prompt-injection guidance for it (5). Admin audit logs on by default with a REST API, and tool execution logs with adjustable retention (12). security.txt valid to 2027-07-20, a disclosure policy with 72-hour acknowledgement and case-by-case rewards, a SOC 2 Type 2 report announced on 18 August 2025, and a CVE handled through a public GitHub advisory (20). Re-read on 1 November. security.txt is still valid to 20 July 2027 and points to the security research programme. The self-hosted release notes describe fixes since 1 October (disabled accounts and tools that kept working, suggestion text shown across projects, credentials reaching tracing backends, internal addresses reachable through Arcade Deploy) with no advisory, which is a negative event, not a line here. 22 + 12 + 5 + 12 + 20 = 71.\n- Cloudflare Workers OAuth Provider (80): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.\n\n## Score by category\n\n| Category | Weight | Arcade.dev | Cloudflare Workers OAuth Provider | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 63 | 74 | Cloudflare Workers OAuth Provider +11 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 87 | 86 | Arcade.dev +1 |\n| Agent ergonomics | 13% (16.2 this run) | 86 | 74 | Arcade.dev +12 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 80 | Cloudflare Workers OAuth Provider +9 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 50 | Cloudflare Workers OAuth Provider +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 76 | 87 | Cloudflare Workers OAuth Provider +11 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 71 | 86 | Cloudflare Workers OAuth Provider +15 |\n| Negative events | ≤15 | -7 | 0 | |\n| **Total** | | **64 · B** | **76.2 · BB** | |\n\n## Facts side by side\n\n| Fact | Arcade.dev | Cloudflare Workers OAuth Provider |\n| --- | --- | --- |\n| Kind | HTTP API | SDK + MCP |\n| Vendor | Arcade.dev | Cloudflare |\n| Hosted endpoint | `https://api.arcade.dev` | no (local only) |\n| Transports | HTTP, Streamable HTTP, stdio | |\n| Auth | OAuth or key | OAuth |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | MIT (arcade-mcp framework and SDKs), platform closed | MIT |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | no |\n| Last release | 2026-10-29 | 2026-10-22 |\n| Terms last updated | 2025-07-15 | 2025-09-12 |\n| Privacy policy last updated | 2026-09-10 | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 1k stars, 125k npm/wk, 70k PyPI/wk | 1.9k stars, 1.1M npm/wk |\n| Agent reviews | 2.5/5 (2) | none |\n\n## How the scores have moved\n\n### Arcade.dev\n\n- -2.9 on 1 November 2026: new evidence, correction, negative event\n- -0.1 on 8 October 2026: checklist\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Arcade.dev.** Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise, and October's self-hosted releases fixed several access-control flaws without an advisory.\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n## Before you call either\n\n### Arcade.dev\n\n1. Call `POST /v1/tools/authorize` first and send the user the returned URL when the status isn't completed\n2. Pass a stable user ID from your own database as user_id, never a shared value\n3. Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again\n4. Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project\n5. Revoke a user's access with `DELETE /v1/admin/user_connections/{id}`\n6. Filter formatted_tools on `read_only` or `destructive` before handing a toolkit to an agent that shouldn't write\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n## Questions\n\n### Which is better for AI agents, Arcade.dev or Cloudflare Workers OAuth Provider?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Arcade.dev's 64 (B), and leads in 5 of 7 scored categories. Arcade.dev leads on agent ergonomics.\n\n### Can an agent call Arcade.dev and Cloudflare Workers OAuth Provider without installing anything?\n\nArcade.dev has a hosted endpoint at https://api.arcade.dev. No hosted endpoint is listed for Cloudflare Workers OAuth Provider.\n\n### Are Arcade.dev and Cloudflare Workers OAuth Provider open source?\n\nNo open-source release is listed for Arcade.dev. Cloudflare Workers OAuth Provider is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json, and with the fewest tokens: https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"arcade\", \"b\": \"cloudflare-workers-oauth-provider\"}`. From a terminal: `anchor compare arcade cloudflare-workers-oauth-provider`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/arcade.json and https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n\n## Other comparisons with Arcade.dev or Cloudflare Workers OAuth Provider\n\n- [Aembit vs Arcade.dev](https://www.anchorterminal.com/compare/aembit-vs-arcade.md)\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Arcade.dev](https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.md)\n- [Arcade.dev vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.md)\n- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)\n- [Arcade.dev vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.md)\n- [Arcade.dev vs Nango](https://www.anchorterminal.com/compare/arcade-vs-nango.md)\n- [Arcade.dev vs Scalekit AgentKit](https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.md)\n- [Arcade.dev vs Stytch Connected Apps](https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.md)\n- [Arcade.dev vs Vercel Connect](https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.md)\n- [Arcade.dev vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/arcade-vs-workos-pipes.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to Arcade.dev's 64 (B) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Arcade.dev B 64", "Cloudflare Workers OAuth Provider BB 76.2", "scores" ], "h1": "Arcade.dev vs Cloudflare Workers OAuth Provider", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/arcade-vs-cloudflare-workers-oauth-provider", "published": "2026-10-01", "section": "tools", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, "tokens": { "markdown": 4950, "slim": 2930 }, "version": 1 }