Head to head · OAuth for agents · October 2026 research run
Clerk MCP server vs WorkOS Pipes and Agents
WorkOS Pipes and Agents scores 66.4 (B) on agent readiness against Clerk MCP server's 61.9 (C), and leads in 5 of 7 scored categories. Clerk MCP server leads on payments & pricing. Both do oauth for agents.
Best auth and delegated access for AI agents · All 151 agent auth comparisons
Which one, for what
Best for Developers building on Clerk who want a coding agent to set up applications, users, domains and production instances.
Ahead on
- Payments & pricing, 40 against 20
Also in its favour
- No incidents deducted, where WorkOS Pipes and Agents loses 3 points for them
Watch for
No MCP component on the status page and no MCP-specific rate limits
Best for Best when WorkOS already runs SSO or AuthKit and the agent needs users' or organisations' tokens for many SaaS providers plus its own revocable identity.
Ahead on
- Reliability, 90 against 65
- Agent ergonomics, 82 against 63
- Maintenance & community, 86 against 77
- Transparency & trust, 65 against 57
Watch for
Pipes and Agents aren't on the pricing page
Why the edge
Each category where one leads by five points or more, with the reason behind each side's score from its assessment. The numbers are in the table below; this is what they stand for.
Reliability WorkOS Pipes and Agents +25
Clerk MCP server 65
Graded as a hosted service. incident.io status page at status.clerk.com with components for authentication, sessions, webhooks and SCIM, but none for the MCP server (15). The feed shows several resolved incidents since August (an upstream SMS issue on 29 October, Apple sign-in for development instances, an incident across all components on 3 November, resolved), none read as a long core outage (20). Backend API limits published with numbers (1,000 requests per 10 seconds in production), not for the MCP server itself (10 of 15). 429 with Retry-After documented, no idempotency guidance for writes (10 of 15). No SLA found; Business support has 'No response-time SLA' (0). The MCP server isn't labelled beta (10). 15 + 20 + 10 + 10 + 0 + 10 = 65.
WorkOS Pipes and Agents 90
Atlassian Statuspage at status.workos.com with component history, read through history.atom since its robots.txt disallows /api/ and /embed/ (20). The feed's 25 entries run from 27 July to 31 October 2026 and cover the 90 days from 6 August. 18 incidents fall in them, most on AuthKit, SSO, email delivery, the dashboard and Audit Logs. Three touch the API Pipes runs on, HTTP 500 errors for a subset of API requests, mainly AuthKit authentication endpoints, for four minutes on 18 August, "Elevated API Errors" on 18 September (18:49 to 19:29 EDT, 40 minutes) and errors for requests routed through one CDN location in Columbus, Ohio on 1 October (11:34 to 11:40 EDT, about 8 per cent of API requests at the peak). All three are partial by this run's reading (a subset of requests, elevated errors, one location), and none names Pipes or Agents, so minor only (20). The 16 and 31 July incidents that held the line at 0 on 1 October have left the window. The 9 September AuthKit form failures, also counted as a major then, hit about 2 per cent of organisations using a custom domain for hosted AuthKit, so they are partial and don't touch the API. Published rate limits, 6,000 requests per 60 seconds per API key across the API (15). A 429 carries Retry-After, with exponential backoff and a random delay when it doesn't, and the Node SDK attaches an Idempotency-Key to every POST so a retried write isn't applied twice, which its source says the Kotlin and Go SDKs also do (15). A 99.99 per cent uptime SLA on Annual Credits plans, per pricing.md (10). The Pipes docs carry no beta or preview label (10). 20 + 20 + 15 + 15 + 10 + 10 = 90.
Payments & pricing Clerk MCP server +20
Clerk MCP server 40
No x402, MPP or L402 (0). Per-unit prices are public ($0.02 per retained user over the included 50,000, $0.01 per SMS) (20). Hobby is free with no card (20). A person signs up and approves OAuth in a browser (0). 0 + 20 + 20 + 0 + 0 = 40.
WorkOS Pipes and Agents 20
No x402, MPP or L402 (0). Pipes and Agents still aren't on the pricing page or pricing.md, so there's no public price for a connection or an agent session (0). Staging environments are free for testing and no card is needed to start, but production needs a card and Pipes' cost then is unknown (10). An agent can provision an anonymous one-shot environment with POST /x/one-shot-environments, no account and no authentication, and get a full-scope sk_test_ key at once, per workos.com/auth.md, with a person claiming it later if they want to keep it. Judgement call. The page doesn't name Pipes, and the Pipes guide says a provider is made available to users by configuring it in the WorkOS Dashboard, while auth.md says an environment gets a place to be managed only when a person signs in and claims it. So the key route reaches Pipes only in part (10; 0 on 1 October). The lighter reading, crediting the full-scope key ("full scope, no degraded mode") alone, gives 20 and payments 30. 0 + 0 + 10 + 10 = 20.
Agent ergonomics WorkOS Pipes and Agents +19
Clerk MCP server 63
14 tools, two of them for sending feedback to Clerk (15). list_users takes filters; no paging documented (10 of 20). The FAQ explains permission errors and how to fix them (8 of 20). 'Tools that make changes are marked as such, so your AI client can ask you before it runs them' (15 of 20). Official SDKs in many languages and a CLI (15). 15 + 10 + 8 + 15 + 15 = 63.
WorkOS Pipes and Agents 82
The token call returns one access token and its state, so there's nothing to size (20). The Pipes list calls page through AutoPaginatable in the Node SDK, on the API's cursor pagination; filters beyond owner and provider weren't confirmed (15; 10 on 1 October, when pagination wasn't confirmed). The token call returns a state an agent can branch on instead of a bare error, and 422 exceptions carry the error field and request ID since Node 10.12.0 (16). Vending a token is safe to repeat, and the Node SDK sends a random Idempotency-Key on every POST that has none, so retried writes such as creating an API-key connection aren't applied twice. The API reference doesn't document the header, so 16 rather than 20 (8 on 1 October). Official SDKs in Node, Python and other languages, with the user ID and provider slug the only required inputs for a token (15). 20 + 15 + 16 + 16 + 15 = 82.
Maintenance & community WorkOS Pipes and Agents +9
Clerk MCP server 77
Changelog entries up to 6 November 2026 (30). 24 dated changelog entries since August (20). Public changelog, docs with Ask AI and support by email (12 of 15). In the official registry as io.github.clerk/mcp-server (version 0.1.0, updated 9 March 2026, before the revamp) and official SDKs (15). No package to read (0). 30 + 20 + 12 + 15 + 0 = 77. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.
WorkOS Pipes and Agents 86
workos-node 12.1.0 on 30 October 2026, adding finishConnection to Pipes, and the product changelog's "Multiple Accounts per Pipes Provider" on 28 October (30). In the 90 days from 6 August, workos-node tagged 10.10.0, 10.11.0, 10.12.0, 10.13.0, 10.14.0, 11.0.0, 12.0.0 and 12.1.0, workos-python 10.2.0 to 10.6.0, and the product changelog has Pipes entries on 20 and 28 October (20). Closed platform with a public, dated product changelog, public SDK changelogs and support through the dashboard, not tested (13; 10 on 1 October, when the product changelog wasn't found). Current official SDKs in several languages, 4.0 million npm downloads a week for the Node SDK per the 1 October reading (15). CI on the SDK repositories, with ci.yml and runtime tests in workos-node, and current dependencies (8). 30 + 20 + 13 + 15 + 8 = 86.
Transparency & trust WorkOS Pipes and Agents +8
Clerk MCP server 57
Closed service under terms naming Clerk, Inc., last updated 1 October 2026 (15). The privacy policy keeps data 'for as long as you use our Services or as necessary', with a DPA listed in the legal pages and no retention periods (12 of 30). No deprecation policy for the MCP server found (5 of 20). Subprocessors referenced through the DPA, list not read (8 of 20). 15 + 12 + 5 + 8 = 40.
WorkOS Pipes and Agents 65
Closed platform under website terms that name WorkOS, Inc. and California law, effective 29 October 2020, with MIT SDKs (15). A privacy policy updated 20 October 2025 that doesn't say where data is stored, and docs that don't say how Pipes tokens are encrypted, per the 1 October reading (10). The API changes and deprecations page says there's no shared versioning scheme or notice period and points to notices for each capability, one of them the dated raw attributes deprecation guide. Dated notices exist, no policy (5; 0 on 1 October). A public subprocessor list, but no statement of hosting regions (12). 15 + 10 + 5 + 12 = 42.
Score by category
| Category | Weight this run | Clerk MCP server | WorkOS Pipes and Agents | Edge |
|---|---|---|---|---|
| Reliability | 16%20 | 65 | 90 | WorkOS Pipes and Agents +25 |
| Performance | 10%pending | pending | pending | not scored in this run |
| Schema & documentation | 13%16.2 | 65 | 63 | Clerk MCP server +2 |
| Agent ergonomics | 13%16.2 | 63 | 82 | WorkOS Pipes and Agents +19 |
| Security & auth | 14%17.5 | 65 | 69 | WorkOS Pipes and Agents +4 |
| Payments & pricing | 10%12.5 | 40 | 20 | Clerk MCP server +20 |
| Task success | 10%pending | pending | pending | not scored in this run |
| Maintenance & community | 7%8.8 | 77 | 86 | WorkOS Pipes and Agents +9 |
| Transparency & trust | 7%8.8 | 57 | 65 | WorkOS Pipes and Agents +8 |
| Negative events | ≤15 | 0 | -3 | |
| Total | C 61.9/100 | B 66.4/100 |
Facts side by side
| Fact | Clerk MCP server | WorkOS Pipes and Agents |
|---|---|---|
| Kind | MCP server | HTTP API |
| Vendor | Clerk, Inc. | WorkOS |
| Hosted endpoint | https://mcp.clerk.com/mcp | https://api.workos.com |
| Transports | Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | none | MIT (SDKs), platform closed |
| Tools exposed | 14 | none |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| MCP registry | io.github.clerk/mcp-server | com.workos/mcp |
| Last release | none | 2026-10-30 |
| Terms last updated | not read yet | 2020-10-29 |
| Privacy policy last updated | not read yet | 2025-10-20 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | none | 221 stars, 4M npm/wk, 1.7M PyPI/wk |
| Agent reviews | none | 2.5/5 (2) |
How the scores have moved
Verdicts
Clerk MCP server
Clerk's MCP server reaches a real Clerk account behind OAuth with a published scope table, and marks its write tools so the client asks first. Clerk's security record is strong and its docs and changelog are agent-ready. No MCP status component, no audit log of agent calls and no read-only mode.
WorkOS Pipes and Agents
Agent identity with per-session revocation and token lifetimes set per blueprint, and an anonymous environment an agent can provision without an account. Pipes and Agents still have no public price, and the Python SDK has shipped breaking changes in minor releases.
Before you call either
Clerk MCP server
- Call whoami first to see the workspace and granted permissions
- A permission error means the workspace role or a missing scope; reconnect to grant it
- Treat user names and agent feedback returned by list tools as untrusted text
- Results include publishable keys; secret keys aren't returned
WorkOS Pipes and Agents
- Call POST /data-integrations/{provider}/token with user_id for each use and don't cache the token
- Branch on
activein the response and send the user to reconnect onneeds_reauthorization - Wait for Retry-After on a 429, or back off with jitter when it's missing, and send an Idempotency-Key on writes when not using the SDK
- Pin workos-python to an exact minor version, since minors can remove models and services
- Revoke an agent's session through the Agents API when a task ends instead of waiting for expiry
Questions
Which is better for AI agents, Clerk MCP server or WorkOS Pipes and Agents?
WorkOS Pipes and Agents scores 66.4 (B) on agent readiness against Clerk MCP server's 61.9 (C), and leads in 5 of 7 scored categories. Clerk MCP server leads on payments & pricing.
Do Clerk MCP server and WorkOS Pipes and Agents need an API key?
Clerk MCP server uses an OAuth sign-in. WorkOS Pipes and Agents takes an API key or an OAuth sign-in.
Can an agent call Clerk MCP server and WorkOS Pipes and Agents without installing anything?
Yes. Clerk MCP server has a hosted endpoint at https://mcp.clerk.com/mcp and WorkOS Pipes and Agents at https://api.workos.com.
Other comparisons with Clerk MCP server or WorkOS Pipes and Agents
- Aembit vs Clerk MCP server
- Aembit vs WorkOS Pipes and Agents
- Amazon Bedrock AgentCore Identity vs Clerk MCP server
- Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents
- Arcade.dev vs Clerk MCP server
- Arcade.dev vs WorkOS Pipes and Agents
- Auth0 for AI Agents (Token Vault) vs Clerk MCP server
- Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents
- Clerk MCP server vs Cloudflare Workers OAuth Provider
- Clerk MCP server vs Descope Agentic Identity Hub
- Clerk MCP server vs Keycard
- Clerk MCP server vs Microsoft Entra Agent ID
- Clerk MCP server vs Nango
- Clerk MCP server vs Scalekit AgentKit
- Clerk MCP server vs Stytch Connected Apps
- Clerk MCP server vs Vercel Connect
- Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents
- Descope Agentic Identity Hub vs WorkOS Pipes and Agents
- Keycard vs WorkOS Pipes and Agents
- Microsoft Entra Agent ID vs WorkOS Pipes and Agents
- Nango vs WorkOS Pipes and Agents
- Scalekit AgentKit vs WorkOS Pipes and Agents
- Stytch Connected Apps vs WorkOS Pipes and Agents
- Vercel Connect vs WorkOS Pipes and Agents
Machine-readable
- This page as Markdown
/compare/clerk-mcp-vs-workos-pipes.md· slim.min.md· JSON.json(or sendAccept: text/markdown) - Each listing in full
/api/v1/tools/clerk-mcp.json·/api/v1/tools/workos-pipes.json - From a terminal
anchor compare clerk-mcp workos-pipes(the CLI) - Over MCP
compare_tools {"a": "clerk-mcp", "b": "workos-pipes"}at/mcp, no key