{ "data": { "a": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "answer": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Cloudflare Workers OAuth Provider's 76.2 (BB), and leads in 3 of 7 scored categories. Cloudflare Workers OAuth Provider leads on schema \u0026 documentation, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "b": { "slug": "descope-agentic-identity", "name": "Descope Agentic Identity Hub", "vendor": "Descope", "vendorUrl": "https://www.descope.com", "kind": "http-api", "category": "agent-auth", "summary": "Descope's identity and access tools for AI agents, built on its customer identity platform.", "url": "https://www.anchorterminal.com/tools/descope-agentic-identity", "markdownUrl": "https://www.anchorterminal.com/tools/descope-agentic-identity.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/descope-agentic-identity.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/descope-agentic-identity.json", "dns": "descope-agentic-identity.grade.anchorterminal.com", "repo": "https://github.com/descope/node-sdk", "license": "MIT (SDKs), platform closed", "transports": [ "http" ], "remoteUrl": "https://api.descope.com", "packages": [ { "registry": "npm", "name": "@descope/node-sdk" }, { "registry": "npm", "name": "@descope/mcp-express" }, { "registry": "pypi", "name": "descope" } ], "auth": "mixed", "authNotes": "Management calls take `Authorization: Bearer $DESCOPE_PROJECT_ID:$DESCOPE_MANAGEMENT_KEY`. An agent can instead sign in as its own OAuth client (client credentials, device code, CIBA or RFC 7523 JWT bearer against /oauth2/v1/token) or present a user's Descope access token in the same header, and Policies then limit which tokens it can fetch. A management key bypasses Policies, and the Agent Auth SDK makes you opt in to use one. Inbound Apps use the shared endpoints `/oauth2/v1/apps/authorize` and `/oauth2/v1/apps/token` with PKCE for public clients.", "pricing": "freemium", "pricingNotes": "Free Forever is $0 with 7,500 monthly active users, 10 tenants, 3 SSO connections, 10,000 M2M exchanges, 2,000 MACs and 2,000 MATKs, no card. Pro starts at $249 a month billed annually with 10,000 MAU ($0.05 each after), 35 tenants, 5 SSO connections, 50,000 M2M exchanges ($2 per 1,000 after), 5,000 MACs and 5,000 MATKs ($0.05 each after). Growth starts at $799 a month billed annually with 25,000 MAU, 100 tenants, 10 SSO connections, 100,000 M2M exchanges, 10,000 MACs and 10,000 MATKs. Enterprise is custom. A MAC (monthly active consent) is counted when a unique user consents to any scope for a resource at least once in a month, and covers Inbound Apps and MCP auth. A MATK (monthly active token) is any instance where a token is fetched and used, and covers Outbound Apps and Connections (https://www.descope.com/pricing).", "priceSummary": "$249 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 67, "npmWeekly": 353532, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.descope.com/agentic-identity-hub", "llmsTxt": "https://docs.descope.com/llms.txt", "openapi": "https://docs.descope.com/examples/Descope_API.yaml", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "auth.audit", "hitl.approve" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "oauth", "llms-txt", "typescript", "python", "enterprise", "eu" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 78.1, "grade": "A", "agentReady": true, "rank": 25, "ranked": true, "rankOf": 1486, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 74, "payments": 40, "reliability": 100, "schema": 78, "security": 86, "transparency": 68 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion. No tool catalogue, so you write every provider call yourself.", "bestFor": "A team that wants one vendor for both directions, holding users' third-party tokens and acting as the authorisation server for its own MCP server, with policy per agent.", "strengths": [ "Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion", "Descope as the OAuth authorisation server for your APIs and MCP servers, with DCR, CIBA and token exchange", "Policies decide which tokens an agent identity can obtain, evaluated at issuance and exchange", "Per-endpoint rate limits with a documented back-off window, and an SLA of 99.99 per cent on Pro and Growth", "Free Forever tier with 2,000 consents and 2,000 token fetches a month, no card" ], "weaknesses": [ "No tool catalogue, so you write every provider call yourself", "The Agent Auth SDK is 0.1.0, unpublished on npm and PyPI when last read on 17 October, with no commit since 2 July 2026", "The docs don't say how vaulted tokens are encrypted", "No security.txt and no deprecation policy we could find", "Paid plans are billed annually, from $249 a month" ], "agentNotes": [ "Sign the agent in as its own OAuth client and let Policies scope it, instead of shipping a management key", "Treat a 404 from the token endpoint as a missing connection and send the user to the connect URL", "Back off for the full window on a 429, 60 seconds for most management endpoints, since the Agent Auth SDK's own retry waits under a second", "Ask for a tenant token, not a user token, for organisation-wide API keys", "Check that descope-agent-auth or @descope/agent-auth installs before relying on it; on 17 October neither was published, so install from github.com/descope/descope-agent-auth" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 8, "avgRating": 3.1, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "A", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 78.1 } ], "editorialScores": { "ergonomics": 80, "maintenance": 74, "payments": 40, "reliability": 100, "schema": 78, "security": 86, "transparency": 49 }, "provenanceScore": 87, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-10-27", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @descope/node-sdk", "http": "curl -X POST https://api.descope.com/v1/mgmt/outbound/app/user/token/latest \\\n -H \"Authorization: Bearer $DESCOPE_PROJECT_ID:$DESCOPE_MANAGEMENT_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"appId\":\"github\",\"userId\":\"user-123\"}'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/descope-agentic-identity" }, "area": "agent-runtime", "unitPrices": [ { "item": "Pro plan", "unit": "month", "usd": 249, "note": "Starting price, billed annually" }, { "item": "Monthly active token (MATK) above the allowance", "unit": "call", "usd": 0.05, "note": "A token fetched and used, counted once a month. Pro and Growth" }, { "item": "Monthly active consent (MAC) above the allowance", "unit": "account-month", "usd": 0.05, "note": "A unique user consenting to a resource at least once in a month. Pro and Growth" } ], "provenance": { "legalEntity": "Descope, Inc.", "domain": "descope.com", "domainRegistered": "2016-04-13", "endpointOnVendorDomain": true, "terms": "https://www.descope.com/legal/terms", "privacy": "https://www.descope.com/legal/privacy", "statusPage": "https://descopestatus.com", "changelog": "https://ideas.descope.works/changelog", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The terms (last update 24 February 2026, re-read 1 November 2026) contract with Descope, Inc. for US and Canadian customers, Descope Technologies Israel (2022) Ltd. for Israel and Descope Technologies UK (2025) Ltd. elsewhere, under Delaware law.", "/.well-known/security.txt returned 404 on 2026-09-30, 2026-10-04, 2026-10-17 and 2026-11-01. A vulnerability disclosure policy at descope.com/vulnerability-disclosure-policy is linked from descope.com/security-compliance.", "The status page is an Instatus page at descopestatus.com.", "The changelog lives on the ideas.descope.works portal, off the main domain, and needs JavaScript to render. It showed no entries to a plain fetch on 2026-10-04 or 2026-10-17 and wasn't re-read on 2026-11-01." ], "score": 87 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "no", "freeTier": true, "minutes": 15, "credential": "api-key", "hosting": [ "US", "EU", "UK" ], "euResidency": "unknown", "trainsOnData": "unknown", "zeroRetention": "unknown", "selfHost": "no" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/descope-agentic-identity.json", "live": { "slug": "descope-agentic-identity", "probe": { "target": "https://api.descope.com", "method": "get", "lastAt": "2026-11-07T18:20:20.726940134Z", "lastOk": true, "lastStatus": 404, "lastMs": 224, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 135, "p95ms24h": 311, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://descopestatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:38.351407415Z" }, "versions": [ { "registry": "github", "name": "descope/node-sdk", "version": "v2.21.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:21:00.514354898Z" }, { "registry": "npm", "name": "@descope/mcp-express", "version": "1.6.0", "seenAt": "2026-11-06T23:20:56.215814555Z" }, { "registry": "npm", "name": "@descope/node-sdk", "version": "2.21.0", "seenAt": "2026-11-06T23:20:55.910319688Z" }, { "registry": "pypi", "name": "descope", "version": "2.17.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:21:00.251756397Z" } ], "githubStars": 68, "npmWeekly": 538298, "pypiWeekly": 513860, "securityTxt": { "url": "https://descope.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:38.51872875Z" }, "llmsTxt": { "url": "https://docs.descope.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:16.47947478Z" }, "domain": { "domain": "descope.com", "registered": "2016-04-13", "source": "https://rdap.verisign.com/com/v1/domain/descope.com", "checkedAt": "2026-11-01T14:14:46.486312864Z" }, "pages": [ { "url": "https://ideas.descope.works/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:11:20.178012864Z", "changedAt": "2026-10-16T22:25:26.381084683Z", "fingerprint": "73253e0987db" }, { "url": "https://www.descope.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:27:53.657071183Z", "changedAt": "2026-10-27T03:59:57.19185865Z", "fingerprint": "b75158c2c678" }, { "url": "https://www.descope.com/legal/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:27:49.471967655Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8b2b659c6dcc" }, { "url": "https://www.descope.com/legal/terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:27:51.641629999Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d6f39b94f5db" } ], "github": { "repo": "descope/node-sdk", "checkedAt": "2026-11-02T08:43:58.252678869Z", "stars": 68, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T09:32:02Z", "openIssues": 5, "openPRs": 31, "issuesOpened90d": 1, "issuesClosed90d": 0, "prsMerged90d": 40, "ci": { "branch": "main", "runs": 50, "success": 23, "failure": 27, "other": 0, "latest": "failure", "latestAt": "2026-11-01T09:32:07Z" }, "replies": { "sampled": 25, "unanswered": 5, "medianDays": 1.4 } }, "updatedAt": "2026-11-07T18:20:20.726940134Z" } }, "edges": [ { "by": 26, "category": "reliability", "leads": "descope-agentic-identity", "name": "Reliability", "reasons": { "a": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.", "b": "Instatus page at descopestatus.com with per-component history, including the public API (20). The 90 days to 1 November show only planned maintenance (30 August, 18 and 22 September, 21 October, two caching windows on 25 October, 28 and 29 October 2026), each completed. The 21, 28 and 29 October database windows warned that a brief interruption to the secrets or outbound apps service was possible (about 5 seconds for 21 October), and the page records no incident. Every API region shows 100.0 per cent uptime for September, October and November (30). Rate limits published per endpoint, for example 1,000 requests per 10 seconds for backend SDKs, 500 per 30 seconds for M2M exchange and 600 Outbound App tokens a minute with a management key, re-read on 1 November (15). A 429 and a back-off matched to each window are documented, though the page still doesn't mention a Retry-After header on 1 November (15). A published SLA of 99.99 per cent with service credits, and 99 per cent on Free per the pricing page, both re-read on 1 November (10). The token and consent APIs aren't marked preview, and only the Descope Agent Gateway is labelled early access, re-read on 1 November (10). 20 + 30 + 15 + 15 + 10 + 10 = 100." }, "scores": { "a": 74, "b": 100 } }, { "by": 18, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "b": "Closed platform under terms (last update 24 February 2026, re-read on 1 November) that name a Descope contracting entity in the US, Israel or the UK by customer location, with MIT SDKs (15). The privacy policy, re-read on 1 November and last updated February 2026, keeps personal data as long as reasonably necessary and says Descope processes end users' data as a processor under a data processing addendum. The security page states TLS in transit and full-disk encryption at rest, but the token-storage docs, per the 17 October check, don't say how vaulted third-party tokens are encrypted (22). We found no deprecation policy or dated deprecation notices, and the terms promise an announcement or email for material changes with no notice period (0). Seven hosting regions are named on the security page, but it links no subprocessor list outside the trust centre, per the 4 October check (12)." }, "scores": { "a": 86, "b": 68 } }, { "by": 13, "category": "maintenance", "leads": "cloudflare-workers-oauth-provider", "name": "Maintenance \u0026 community", "reasons": { "a": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.", "b": "@descope/node-sdk 2.20.0 tagged on 19 October 2026 (DPoP proof validation, multi-text list checks), and the descope Python package 2.16.0 on 19 October and 2.16.1 on 22 October, which requires certifi 2026.10.19 or later to distrust compromised eMudhra CAs (30). Seven node-sdk releases from 7 August to 19 October 2026, 2.14.0 to 2.20.0 (20). Closed platform whose changelog portal didn't render for us on 17 October, and the Agent Auth SDK repository has no commit since 2 July 2026 and had 18 open pull requests, all dependency updates, per the 4 October check (the GitHub API wasn't read on 17 October or 1 November) (8). The backend SDKs are current, but the Agent Auth SDK is 0.1.0, and @descope/agent-auth and descope-agent-auth returned 404 on npm and PyPI on 17 October, while its README and, on 1 November, the docs page give install commands for them. We couldn't reach either registry on 1 November (10). CI and release-please on the Agent Auth SDK, with no publish step and pull requests piling up (6). 30 + 20 + 8 + 10 + 6 = 74." }, "scores": { "a": 87, "b": 74 } }, { "by": 10, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "b": "No x402, MPP or L402, and none mentioned on the pricing page on 1 November (0). Per-unit prices published without a login, $0.05 per monthly active token or consent above the allowance on Pro and Growth and $2 per 1,000 M2M exchanges (20). Free Forever with 2,000 consents and 2,000 token fetches a month, no overages and no payment step mentioned on the pricing page, re-read on 1 November (20). A person signs up in a browser to create a project (0)." }, "scores": { "a": 50, "b": 40 } }, { "by": 8, "category": "schema", "leads": "cloudflare-workers-oauth-provider", "name": "Schema \u0026 documentation", "reasons": { "a": "Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.", "b": "An OpenAPI 3.0 file at docs.descope.com/examples/Descope_API.yaml, with reference pages for each Outbound App token endpoint (25). llms.txt and Markdown docs, re-read on 1 November (10). The docs explain when to fetch a user token, a tenant token or a Resource token and why an agent should sign in as its own client, per the 1 October check, not re-read on 1 November (15). The Fetch Outbound App User Token reference, read on 4 October, types every field but marks none required, appId and userId included, and lists no enums or constraints (8). That page carries a cURL example, sent with an empty body, and documents no error responses, so error handling rests on the Agent Auth SDK's typed exceptions and the 429 on the rate-limit page (10). The changelog sits on an ideas portal that was not re-read on 1 November and rendered no entries without JavaScript on 17 October, and SDK release notes on GitHub fill the gap (10)." }, "scores": { "a": 86, "b": 78 } }, { "by": 6, "category": "ergonomics", "leads": "descope-agentic-identity", "name": "Agent ergonomics", "reasons": { "a": "Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.", "b": "A token fetch returns one token, and the caller can ask for an explicit scope set (20). Tokens are fetched per app, user or tenant, and the management search endpoints page, but there's no list of a user's connections in the agent SDK (15). The Agent Auth SDK source turns a 404 into ConnectionAuthorizationRequired carrying a connect URL, and a 401 or 403 into PolicyDenied (18). Fetching the latest token is safe to repeat and forceRefresh is opt-in, but token deletion can't be undone and has no confirmation (12). Backend SDKs in several languages, with node-sdk 2.20.0 (19 October) and the descope Python package 2.16.1 (22 October) tagged, and few required fields. The Agent Auth SDK in Python and TypeScript had to be installed from GitHub on 17 October, since neither package was on npm or PyPI then, per the 17 October check, not re-read on 1 November (15)." }, "scores": { "a": 74, "b": 80 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "Descope", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.descope.com", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "MIT (SDKs), platform closed", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-22", "b": "2026-10-22", "name": "Last release" }, { "a": "2025-09-12", "b": "2026-02-24", "name": "Terms last updated" }, { "a": "no date given", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.9k stars, 1.1M npm/wk", "b": "67 stars, 354k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.1/5 (8)", "name": "Agent reviews" } ], "faq": [ { "answer": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Cloudflare Workers OAuth Provider's 76.2 (BB), and leads in 3 of 7 scored categories. Cloudflare Workers OAuth Provider leads on schema \u0026 documentation, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.", "question": "Which is better for AI agents, Cloudflare Workers OAuth Provider or Descope Agentic Identity Hub?" }, { "answer": "No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Descope Agentic Identity Hub has a hosted endpoint at https://api.descope.com.", "question": "Can an agent call Cloudflare Workers OAuth Provider and Descope Agentic Identity Hub without installing anything?" }, { "answer": "Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Descope Agentic Identity Hub.", "question": "Are Cloudflare Workers OAuth Provider and Descope Agentic Identity Hub open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 86 against 78", "Payments \u0026 pricing, 50 against 40", "Maintenance \u0026 community, 87 against 74", "Transparency \u0026 trust, 86 against 68" ], "also": [ "Open source" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" }, { "aheadOn": [ "Reliability, 100 against 74", "Agent ergonomics, 80 against 74", "Security \u0026 auth, 86 against 80" ], "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card" ], "goodFor": "A team that wants one vendor for both directions, holding users' third-party tokens and acting as the authorisation server for its own MCP server, with policy per agent.", "slug": "descope-agentic-identity", "watchFor": "No tool catalogue, so you write every provider call yourself" } ], "history": { "cloudflare-workers-oauth-provider": null, "descope-agentic-identity": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0, "from": 78.1, "fromGrade": "A", "to": 78.1, "toGrade": "A" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.2, "from": 78.3, "fromGrade": "A", "to": 78.1, "toGrade": "A" }, { "causes": [ "evidence" ], "date": "2026-10-05", "delta": -0.9, "from": 79.2, "fromGrade": "A", "to": 78.3, "toGrade": "A" } ] }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.json", "title": "Aembit vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity.json", "title": "Amazon Bedrock AgentCore Identity vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.json", "title": "Arcade.dev vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.json", "title": "Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.json", "title": "Descope Agentic Identity Hub vs Keycard", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.json", "title": "Descope Agentic Identity Hub vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango.json", "title": "Descope Agentic Identity Hub vs Nango", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit.json", "title": "Descope Agentic Identity Hub vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.json", "title": "Descope Agentic Identity Hub vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.json", "title": "Descope Agentic Identity Hub vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes.json", "title": "Descope Agentic Identity Hub vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes" } ], "panel": null, "scores": [ { "by": 26, "cloudflare-workers-oauth-provider": 74, "descope-agentic-identity": 100, "edge": "descope-agentic-identity", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 8, "cloudflare-workers-oauth-provider": 86, "descope-agentic-identity": 78, "edge": "cloudflare-workers-oauth-provider", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 6, "cloudflare-workers-oauth-provider": 74, "descope-agentic-identity": 80, "edge": "descope-agentic-identity", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 6, "cloudflare-workers-oauth-provider": 80, "descope-agentic-identity": 86, "edge": "descope-agentic-identity", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 10, "cloudflare-workers-oauth-provider": 50, "descope-agentic-identity": 40, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 13, "cloudflare-workers-oauth-provider": 87, "descope-agentic-identity": 74, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 18, "cloudflare-workers-oauth-provider": 86, "descope-agentic-identity": 68, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Cloudflare Workers OAuth Provider's 76.2 (BB), and leads in 3 of 7 scored categories. Cloudflare Workers OAuth Provider leads on schema \u0026 documentation, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "descope-agentic-identity": "Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion. No tool catalogue, so you write every provider call yourself." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity", "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.min.md" }, "markdown": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Cloudflare Workers OAuth Provider's 76.2 (BB), and leads in 3 of 7 scored categories. Cloudflare Workers OAuth Provider leads on schema \u0026 documentation, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust. Both do oauth for agents.\n\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Descope Agentic Identity Hub: grade A, 78.1/100, rank #25 of 1486. Markdown https://www.anchorterminal.com/tools/descope-agentic-identity.md · JSON https://www.anchorterminal.com/api/v1/tools/descope-agentic-identity.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Schema \u0026 documentation, 86 against 78\n- Payments \u0026 pricing, 50 against 40\n- Maintenance \u0026 community, 87 against 74\n- Transparency \u0026 trust, 86 against 68\n\nAlso in its favour:\n- Open source\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n### Descope Agentic Identity Hub (A)\n\nGood for: A team that wants one vendor for both directions, holding users' third-party tokens and acting as the authorisation server for its own MCP server, with policy per agent.\n\nAhead on:\n- Reliability, 100 against 74\n- Agent ergonomics, 80 against 74\n- Security \u0026 auth, 86 against 80\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n\nWatch for: No tool catalogue, so you write every provider call yourself\n\n\n## Why the edge\n\n### Reliability: Descope Agentic Identity Hub +26\n\n- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.\n- Descope Agentic Identity Hub (100): Instatus page at descopestatus.com with per-component history, including the public API (20). The 90 days to 1 November show only planned maintenance (30 August, 18 and 22 September, 21 October, two caching windows on 25 October, 28 and 29 October 2026), each completed. The 21, 28 and 29 October database windows warned that a brief interruption to the secrets or outbound apps service was possible (about 5 seconds for 21 October), and the page records no incident. Every API region shows 100.0 per cent uptime for September, October and November (30). Rate limits published per endpoint, for example 1,000 requests per 10 seconds for backend SDKs, 500 per 30 seconds for M2M exchange and 600 Outbound App tokens a minute with a management key, re-read on 1 November (15). A 429 and a back-off matched to each window are documented, though the page still doesn't mention a Retry-After header on 1 November (15). A published SLA of 99.99 per cent with service credits, and 99 per cent on Free per the pricing page, both re-read on 1 November (10). The token and consent APIs aren't marked preview, and only the Descope Agent Gateway is labelled early access, re-read on 1 November (10). 20 + 30 + 15 + 15 + 10 + 10 = 100.\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +18\n\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n- Descope Agentic Identity Hub (68): Closed platform under terms (last update 24 February 2026, re-read on 1 November) that name a Descope contracting entity in the US, Israel or the UK by customer location, with MIT SDKs (15). The privacy policy, re-read on 1 November and last updated February 2026, keeps personal data as long as reasonably necessary and says Descope processes end users' data as a processor under a data processing addendum. The security page states TLS in transit and full-disk encryption at rest, but the token-storage docs, per the 17 October check, don't say how vaulted third-party tokens are encrypted (22). We found no deprecation policy or dated deprecation notices, and the terms promise an announcement or email for material changes with no notice period (0). Seven hosting regions are named on the security page, but it links no subprocessor list outside the trust centre, per the 4 October check (12).\n\n### Maintenance \u0026 community: Cloudflare Workers OAuth Provider +13\n\n- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n- Descope Agentic Identity Hub (74): @descope/node-sdk 2.20.0 tagged on 19 October 2026 (DPoP proof validation, multi-text list checks), and the descope Python package 2.16.0 on 19 October and 2.16.1 on 22 October, which requires certifi 2026.10.19 or later to distrust compromised eMudhra CAs (30). Seven node-sdk releases from 7 August to 19 October 2026, 2.14.0 to 2.20.0 (20). Closed platform whose changelog portal didn't render for us on 17 October, and the Agent Auth SDK repository has no commit since 2 July 2026 and had 18 open pull requests, all dependency updates, per the 4 October check (the GitHub API wasn't read on 17 October or 1 November) (8). The backend SDKs are current, but the Agent Auth SDK is 0.1.0, and @descope/agent-auth and descope-agent-auth returned 404 on npm and PyPI on 17 October, while its README and, on 1 November, the docs page give install commands for them. We couldn't reach either registry on 1 November (10). CI and release-please on the Agent Auth SDK, with no publish step and pull requests piling up (6). 30 + 20 + 8 + 10 + 6 = 74.\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +10\n\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- Descope Agentic Identity Hub (40): No x402, MPP or L402, and none mentioned on the pricing page on 1 November (0). Per-unit prices published without a login, $0.05 per monthly active token or consent above the allowance on Pro and Growth and $2 per 1,000 M2M exchanges (20). Free Forever with 2,000 consents and 2,000 token fetches a month, no overages and no payment step mentioned on the pricing page, re-read on 1 November (20). A person signs up in a browser to create a project (0).\n\n### Schema \u0026 documentation: Cloudflare Workers OAuth Provider +8\n\n- Cloudflare Workers OAuth Provider (86): Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.\n- Descope Agentic Identity Hub (78): An OpenAPI 3.0 file at docs.descope.com/examples/Descope_API.yaml, with reference pages for each Outbound App token endpoint (25). llms.txt and Markdown docs, re-read on 1 November (10). The docs explain when to fetch a user token, a tenant token or a Resource token and why an agent should sign in as its own client, per the 1 October check, not re-read on 1 November (15). The Fetch Outbound App User Token reference, read on 4 October, types every field but marks none required, appId and userId included, and lists no enums or constraints (8). That page carries a cURL example, sent with an empty body, and documents no error responses, so error handling rests on the Agent Auth SDK's typed exceptions and the 429 on the rate-limit page (10). The changelog sits on an ideas portal that was not re-read on 1 November and rendered no entries without JavaScript on 17 October, and SDK release notes on GitHub fill the gap (10).\n\n### Agent ergonomics: Descope Agentic Identity Hub +6\n\n- Cloudflare Workers OAuth Provider (74): Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.\n- Descope Agentic Identity Hub (80): A token fetch returns one token, and the caller can ask for an explicit scope set (20). Tokens are fetched per app, user or tenant, and the management search endpoints page, but there's no list of a user's connections in the agent SDK (15). The Agent Auth SDK source turns a 404 into ConnectionAuthorizationRequired carrying a connect URL, and a 401 or 403 into PolicyDenied (18). Fetching the latest token is safe to repeat and forceRefresh is opt-in, but token deletion can't be undone and has no confirmation (12). Backend SDKs in several languages, with node-sdk 2.20.0 (19 October) and the descope Python package 2.16.1 (22 October) tagged, and few required fields. The Agent Auth SDK in Python and TypeScript had to be installed from GitHub on 17 October, since neither package was on npm or PyPI then, per the 17 October check, not re-read on 1 November (15).\n\n## Score by category\n\n| Category | Weight | Cloudflare Workers OAuth Provider | Descope Agentic Identity Hub | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 74 | 100 | Descope Agentic Identity Hub +26 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 78 | Cloudflare Workers OAuth Provider +8 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 80 | Descope Agentic Identity Hub +6 |\n| Security \u0026 auth | 14% (17.5 this run) | 80 | 86 | Descope Agentic Identity Hub +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 40 | Cloudflare Workers OAuth Provider +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 74 | Cloudflare Workers OAuth Provider +13 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 86 | 68 | Cloudflare Workers OAuth Provider +18 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **76.2 · BB** | **78.1 · A** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Workers OAuth Provider | Descope Agentic Identity Hub |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | Descope |\n| Hosted endpoint | no (local only) | `https://api.descope.com` |\n| Transports | | HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | MIT (SDKs), platform closed |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-22 | 2026-10-22 |\n| Terms last updated | 2025-09-12 | 2026-02-24 |\n| Privacy policy last updated | no date given | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 1.9k stars, 1.1M npm/wk | 67 stars, 354k npm/wk |\n| Agent reviews | none | 3.1/5 (8) |\n\n## How the scores have moved\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n### Descope Agentic Identity Hub\n\n- no change on 27 October 2026: checklist\n- -0.2 on 8 October 2026: checklist\n- -0.9 on 5 October 2026: new evidence\n\n## Verdicts\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n**Descope Agentic Identity Hub.** Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion. No tool catalogue, so you write every provider call yourself.\n\n## Before you call either\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n### Descope Agentic Identity Hub\n\n1. Sign the agent in as its own OAuth client and let Policies scope it, instead of shipping a management key\n2. Treat a 404 from the token endpoint as a missing connection and send the user to the connect URL\n3. Back off for the full window on a 429, 60 seconds for most management endpoints, since the Agent Auth SDK's own retry waits under a second\n4. Ask for a tenant token, not a user token, for organisation-wide API keys\n5. Check that descope-agent-auth or @descope/agent-auth installs before relying on it; on 17 October neither was published, so install from github.com/descope/descope-agent-auth\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Workers OAuth Provider or Descope Agentic Identity Hub?\n\nDescope Agentic Identity Hub scores 78.1 (A) on agent readiness against Cloudflare Workers OAuth Provider's 76.2 (BB), and leads in 3 of 7 scored categories. Cloudflare Workers OAuth Provider leads on schema \u0026 documentation, payments \u0026 pricing, maintenance \u0026 community and transparency \u0026 trust.\n\n### Can an agent call Cloudflare Workers OAuth Provider and Descope Agentic Identity Hub without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Workers OAuth Provider. Descope Agentic Identity Hub has a hosted endpoint at https://api.descope.com.\n\n### Are Cloudflare Workers OAuth Provider and Descope Agentic Identity Hub open source?\n\nCloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Descope Agentic Identity Hub.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-workers-oauth-provider\", \"b\": \"descope-agentic-identity\"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider descope-agentic-identity`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/descope-agentic-identity.json\n\n## Other comparisons with Cloudflare Workers OAuth Provider or Descope Agentic Identity Hub\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Aembit vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n- [Descope Agentic Identity Hub vs Keycard](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.md)\n- [Descope Agentic Identity Hub vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.md)\n- [Descope Agentic Identity Hub vs Nango](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango.md)\n- [Descope Agentic Identity Hub vs Scalekit AgentKit](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit.md)\n- [Descope Agentic Identity Hub vs Stytch Connected Apps](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.md)\n- [Descope Agentic Identity Hub vs Vercel Connect](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.md)\n- [Descope Agentic Identity Hub vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "" } ], "description": "Descope Agentic Identity Hub scores 78.1 (A) to Cloudflare Workers OAuth Provider's 76.2 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare Workers OAuth Provider BB 76.2", "Descope Agentic Identity Hub A 78.1", "scores" ], "h1": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, "tokens": { "markdown": 5150, "slim": 2930 }, "version": 1 }