Clerk MCP server vs Microsoft Entra Agent ID

Clerk MCP server 65

Graded as a hosted service. incident.io status page at status.clerk.com with components for authentication, sessions, webhooks and SCIM, but none for the MCP server (15). The feed shows several resolved incidents since August (an upstream SMS issue on 29 October, Apple sign-in for development instances, an incident across all components on 3 November, resolved), none read as a long core outage (20). Backend API limits published with numbers (1,000 requests per 10 seconds in production), not for the MCP server itself (10 of 15). 429 with Retry-After documented, no idempotency guidance for writes (10 of 15). No SLA found; Business support has 'No response-time SLA' (0). The MCP server isn't labelled beta (10). 15 + 20 + 10 + 10 + 0 + 10 = 65.

Microsoft Entra Agent ID 91

Microsoft's SLA page for Entra ID points to the Azure status history for incidents, and that page was readable with dated entries and reviews (20). The 90 days to 1 November show two Azure incidents, on 29 September (Azure OpenAI and AI services) and 30 September 2026 (networking gateways, 20:30 UTC to 02:15 UTC on 1 October), and none after 30 September when the page was re-read on 1 November. The 23 July West US network fault, which listed Azure AD B2C, has left the window. Neither names Entra ID, and Microsoft's SLA performance page, updated 7 October and re-read on 1 November, reports 99.999 per cent authentication availability for July, August and September 2026. We scored between clean and minor because the page lists only wide incidents (25). Graph identity limits are published as numbers, such as 3,000 writes per 2 minutes 30 seconds per app and tenant, per the 8 October check (15). 429 carries Retry-After and the FAQ asks for exponential backoff, but there is no idempotency key and back-to-back creates can fail with 400 during replication (11). An SLA for Microsoft Entra ID is published and attainment is reported monthly. The SLA document itself didn't load for us (10). Agent ID has been generally available since April 2026 and the agentIdentity API is on Graph v1.0 (10). 20+25+15+11+10+10 = 91.

Clerk MCP server 65

Typed JSON Schema by protocol, not read because every tool needs sign-in (15 of 25). llms.txt and a .md copy of every docs page (10). The docs table says what each of the 14 tools is for (12 of 20). Input typing not verifiable without a session (5 of 15). Example prompts and an FAQ on permission errors (8 of 15). Dated public changelog with an MCP entry on 15 October 2026 (15). 15 + 10 + 12 + 5 + 8 + 15 = 65.

Microsoft Entra Agent ID 87

agentIdentity is in Microsoft's public Graph v1.0 OpenAPI file (25). learn.microsoft.com returns Markdown when asked with Accept: text/markdown, but learn.microsoft.com/llms.txt returned 404 (8). Concept, design-pattern and best-practice pages say when to use each flow and when to pick the sidecar over the .NET library (16). Graph resources are typed with required fields listed, though agentIdentity is an open type that inherits servicePrincipal properties that don't all apply (12). Request and response examples on each reference page and a list of 17 Agent ID error codes, without the HTTP status for each (11). v1.0 and beta versioning with a monthly dated Graph changelog and Entra release notes (15).

Clerk MCP server 40

No x402, MPP or L402 (0). Per-unit prices are public ($0.02 per retained user over the included 50,000, $0.01 per SMS) (20). Hobby is free with no card (20). A person signs up and approves OAuth in a browser (0). 0 + 20 + 20 + 0 + 0 = 40.

Microsoft Entra Agent ID 20

No x402, MPP or L402 (0). Agent 365 is listed at $15 a user a month and Microsoft 365 E7 at $99, and the docs say Agent ID is available to all Entra customers, but no page gives a per-agent price or says plainly which parts are free (10). Entra ID Free comes with a Microsoft cloud subscription. We didn't establish whether a new tenant can be opened without a card, so this line gets half (10). A person creates the tenant, holds an Agent ID role and creates the blueprint before any agent can act (0).

Clerk MCP server 65

OAuth with a published scope table and one workspace per connection (30). Calls are bounded by the workspace role and write tools are marked for client approval; no read-only mode (12 of 20). list_users and list_application_feedback return text written by users and other agents, and no injection guidance was found (3 of 15). No audit log of MCP calls found (0). security.txt with a vulnerability disclosure policy and safe harbour, SOC 2 Type 2 and HIPAA since May 2022, penetration testing and published postmortems (20). 30 + 12 + 3 + 0 + 20 = 65.

Microsoft Entra Agent ID 83

OAuth 2.0 with scoped Graph permissions. Agent identities can't hold credentials, the blueprint signs in with a managed identity or certificate, and client secrets are allowed but warned against (30). Entra refuses high-privilege roles and permissions such as Application.ReadWrite.All for agents, and an identity can be disabled. Conditional Access for agents needs an Agent 365 licence, and nothing asks a person to approve a destructive call (16). The service returns tokens and directory objects, not untrusted content (10). Audit and sign-in logs carry agentType and blueprintId, kept seven days on Free and 30 on P1 or P2, while the FAQ says Graph activity logs don't separate agents (12). MSRC disclosure policy and an identity bounty of $750 to $100,000, but microsoft.com's security.txt expired on 23 September 2026 and was still expired on 1 November and we didn't read certification reports (15).

Clerk MCP server 57

Closed service under terms naming Clerk, Inc., last updated 1 October 2026 (15). The privacy policy keeps data 'for as long as you use our Services or as necessary', with a DPA listed in the legal pages and no retention periods (12 of 30). No deprecation policy for the MCP server found (5 of 20). Subprocessors referenced through the DPA, list not read (8 of 20). 15 + 12 + 5 + 8 = 40.

Microsoft Entra Agent ID 75

Closed service under the Microsoft APIs terms of use, last updated October 2025, with MIT SDK source (15). The privacy statement was updated in September 2026, Entra publishes a data residency page and log retention periods, and we didn't read the DPA (20). Microsoft Graph gives at least 24 months' notice before retiring a GA API or version, while several Agent ID operations are still on /beta, which can change without notice (18). Entra documents where tenant data is stored by geography. We didn't read the sub-processor list (10).

Clerk MCP server 63

14 tools, two of them for sending feedback to Clerk (15). list_users takes filters; no paging documented (10 of 20). The FAQ explains permission errors and how to fix them (8 of 20). 'Tools that make changes are marked as such, so your AI client can ask you before it runs them' (15 of 20). Official SDKs in many languages and a CLI (15). 15 + 10 + 8 + 15 + 15 = 63.

Microsoft Entra Agent ID 71

List calls take $select, $top, $filter, $search and $count, with a default and maximum page of 100 (20). OData paging and filtering work on the main collection, but ownedObjects, deletedItems and owners can't filter by agent type and need client-side filtering (17). Named error codes such as AgentIdentity_CredentialsNotSupported say what to change (16). No idempotency key for creates, and sequential creates need retries. Token requests are safe to repeat (8). Creating an identity needs three fields, but getting a token is a two-step exchange that Microsoft's docs call complex and error-prone by hand, with an in-process library only for .NET and a sidecar container for everything else (10).