# Clerk MCP server vs Stytch Connected Apps (slim)

> Stytch Connected Apps scores 63.8 (B) to Clerk's 61.9 (C) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/clerk-mcp-vs-stytch-connected-apps.md (~3,850 tokens) · this version ~1,980 tokens · JSON https://www.anchorterminal.com/compare/clerk-mcp-vs-stytch-connected-apps.json · canonical https://www.anchorterminal.com/compare/clerk-mcp-vs-stytch-connected-apps
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Stytch Connected Apps scores 63.8 (B) on agent readiness against Clerk MCP server's 61.9 (C), and leads in 4 of 7 scored categories. Clerk MCP server leads on payments & pricing. Both do oauth for agents.

- Clerk MCP server: C 61.9, rank #586 of 1510 · https://www.anchorterminal.com/tools/clerk-mcp.min.md
- Stytch Connected Apps: B 63.8, rank #498 of 1510 · https://www.anchorterminal.com/tools/stytch-connected-apps.min.md
- Clerk MCP server, good for Developers building on Clerk who want a coding agent to set up applications, users, domains and production instances. Ahead on Payments & pricing, 40 against 20.
- Stytch Connected Apps, good for A team that needs an OAuth 2.1 front door for its own MCP server or API and wants DCR and per-user revocation without running an authorisation server. Ahead on Reliability, 73 against 65; Security & auth, 76 against 65; Transparency & trust, 66 against 57.

| Category | Clerk MCP server | Stytch Connected Apps |
| --- | --- | --- |
| Reliability (16%) | 65 | 73 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 65 | 64 |
| Agent ergonomics (13%) | 63 | 65 |
| Security & auth (14%) | 65 | 76 |
| Payments & pricing (10%) | 40 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 77 | 76 |
| Transparency & trust (7%) | 57 | 66 |

| Fact (where they differ) | Clerk MCP server | Stytch Connected Apps |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | Clerk, Inc. | Stytch (Twilio) |
| Hosted endpoint | `https://mcp.clerk.com/mcp` | `https://api.stytch.com` |
| Transports | Streamable HTTP | HTTP |
| Auth | OAuth | OAuth or key |
| Licence | none | MIT (SDKs), platform closed |
| Tools exposed | 14 | none |
| MCP registry | `io.github.clerk/mcp-server` | not listed |
| Last release | none | 2026-10-26 |
| Terms last updated | not read yet | 2026-07-16 |
| Privacy policy last updated | not read yet | 2026-04-09 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | none | 116 stars, 349k npm/wk |
| Agent reviews | none | 3/5 (2) |

Why the edge:
- Payments & pricing, Clerk MCP server +20: Clerk MCP server 40 (No x402, MPP or L402 (0). Per-unit prices are public ($0.02 per retained user over the included 50,000, $0.01 per SMS) (20). Hobby is free with no card (20). A person signs up and approves OAuth in a browser (0). 0 + 20 + 20 + 0 + 0 = 40.); Stytch Connected Apps 20 (No x402, MPP or L402 (0). Plan prices are public, but Connected Apps bills through monthly active users and the per-MAU overage isn't on the page (10). 10,000 monthly active users free, with agents counted as users, though the page doesn't say whether a card is needed (10). A person signs up in a browser to create a project (0).)
- Security & auth, Stytch Connected Apps +11: Clerk MCP server 65 (OAuth with a published scope table and one workspace per connection (30). Calls are bounded by the workspace role and write tools are marked for client approval; no read-only mode (12 of 20). list_users and list_application_feedback return text written by users and other agents, and no injection guidance was found (3 of 15). No audit log of MCP calls found (0). security.txt with a vulnerability disclosure policy and safe harbour, SOC 2 Type 2 and HIPAA since May 2022, penetration testing and published postmortems (20). 30 + 12 + 3 + 0 + 20 = 65.); Stytch Connected Apps 76 (OAuth 2.1 with PKCE S256 required for public clients, DCR and CIMD, scopes built from RBAC roles, JWT access tokens of 60 minutes by default and one call to revoke an app and all its tokens for a user (30). Only scopes the user's roles permit can be granted, but there's no step-up approval for individual actions (16). The service returns tokens, not untrusted content (10). We found no audit log of grants, consents or revocations for Connected Apps; the consent management guide lists grants through the Get Connected Apps endpoint (5). Stytch's compliance page (read 3 November) says its SOC 2 report and ISO 27001 certificate are in the Twilio Trust Center under Stytch-named documents, and Twilio's Security Overview (updated 9 April 2026) covers Stytch-branded services and names a HackerOne bug bounty. No security.txt on stytch.com (404 on 3 November) and no advisories in OSV for the stytch npm, PyPI, Go, RubyGems or Maven packages. 15, as the twilio and sendgrid listings read the same programme (15).)
- Transparency & trust, Stytch Connected Apps +9: Clerk MCP server 57 (Closed service under terms naming Clerk, Inc., last updated 1 October 2026 (15). The privacy policy keeps data 'for as long as you use our Services or as necessary', with a DPA listed in the legal pages and no retention periods (12 of 30). No deprecation policy for the MCP server found (5 of 20). Subprocessors referenced through the DPA, list not read (8 of 20). 15 + 12 + 5 + 8 = 40.); Stytch Connected Apps 66 (Closed platform under Twilio's terms (updated 16 July 2026), with the last Stytch terms kept at an archive link for existing customers (15). Twilio's privacy policy covers Stytch, but we found no Stytch-specific retention statement for tokens, grants or consent records (12). We found no deprecation policy or dated deprecation notices (0). Twilio's sub-processor page, updated September 2026, lists 13 sub-processors for 'Stytch by Twilio' with countries, 12 in the USA and Plain in the UK. Where Stytch's own platform is hosted isn't stated (15 of 20).)
- Reliability, Stytch Connected Apps +8: Clerk MCP server 65 (Graded as a hosted service. incident.io status page at status.clerk.com with components for authentication, sessions, webhooks and SCIM, but none for the MCP server (15). The feed shows several resolved incidents since August (an upstream SMS issue on 29 October, Apple sign-in for development instances, an incident across all components on 3 November, resolved), none read as a long core outage (20). Backend API limits published with numbers (1,000 requests per 10 seconds in production), not for the MCP server itself (10 of 15). 429 with Retry-After documented, no idempotency guidance for writes (10 of 15). No SLA found; Business support has 'No response-time SLA' (0). The MCP server isn't labelled beta (10). 15 + 20 + 10 + 10 + 0 + 10 = 65.); Stytch Connected Apps 73 (Status page at status.stytch.com, now on Instatus with component history and an RSS feed (20). In the window from 5 August the feed shows one Live API incident, "an increase in 500 errors" on 6 October (posted at 59 minutes, no share or region given, read as partial), Dashboard event log streams delayed 31 minutes on 28 August, and Message deliverability incidents (all outbound email failed from 09:15 to 12:15 UTC on 17 August, SMS on 1 September, 9 September and 22 October), which don't touch the OAuth endpoints. Minor incidents only (20). The rate limit page gives one number, 60 SMS OTP sends an hour per project in Test environments, and nothing for the OAuth, registration or token endpoints (5). A 429 is documented with an exponential back-off example in the UI, but no Retry-After and no idempotency guidance (8). 99.99 per cent uptime SLA on Enterprise (10). Connected Apps isn't labelled preview (10).)