{ "data": { "a": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Microsoft Entra Agent ID's 74.5 (BB), and leads in 4 of 7 scored categories. Microsoft Entra Agent ID leads on reliability.", "b": { "slug": "microsoft-entra-agent-id", "name": "Microsoft Entra Agent ID", "vendor": "Microsoft", "vendorUrl": "https://learn.microsoft.com/en-us/entra/agent-id/", "kind": "http-api", "category": "agent-auth", "summary": "Microsoft Entra Agent ID is an identity type for AI agents in Microsoft Entra ID. Agents get their own directory identity, request OAuth 2.0 tokens autonomously or on behalf of a user, and are managed through Microsoft Graph.", "url": "https://www.anchorterminal.com/tools/microsoft-entra-agent-id", "markdownUrl": "https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/microsoft-entra-agent-id.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/microsoft-entra-agent-id.json", "dns": "microsoft-entra-agent-id.grade.anchorterminal.com", "repo": "https://github.com/AzureAD/microsoft-identity-web", "license": "Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT", "transports": [ "http" ], "remoteUrl": "https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity", "packages": [ { "registry": "nuget", "name": "Microsoft.Identity.Web.AgentIdentities" } ], "auth": "oauth", "authNotes": "Access starts with a Microsoft Entra tenant and a person holding the Agent ID Developer or Agent ID Administrator role, who creates an agent identity blueprint. The blueprint authenticates to login.microsoftonline.com with a managed identity, a certificate or a client secret (Microsoft advises against secrets in production) and exchanges for a token as one of its agent identities. Agent identities hold no credentials. Three flows exist, which are app-only, on behalf of a signed-in user, and as the agent's own user account. Interactive `/authorize` and public clients aren't supported. Management calls on Microsoft Graph need AgentIdentity.Create.All or AgentIdentity.ReadWrite.All.", "pricing": "freemium", "pricingNotes": "Microsoft's docs say Agent ID is available to all Microsoft Entra customers, and Entra ID Free comes with any Microsoft cloud subscription. No per-agent price is published. Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15.00 a user a month on yearly billing, or Microsoft 365 E7 at $99.00. Conditional Access for agents also needs Entra P1 or Microsoft 365 E3 alongside Agent 365. No sandbox was found in the Agent ID docs (https://www.microsoft.com/en-us/microsoft-agent-365, checked 2026-10-08).", "priceSummary": "$15 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Agent ID docs, the Graph reference or the pricing pages (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 787, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://learn.microsoft.com/en-us/entra/agent-id/", "openapi": "https://raw.githubusercontent.com/microsoftgraph/msgraph-metadata/master/openapi/v1.0/openapi.yaml", "capabilities": [ "auth.oauth", "auth.agent-identity", "auth.consent", "auth.audit" ], "tags": [ "hosted", "enterprise", "oauth", "openapi", "dotnet", "sidecar", "microsoft-graph", "mcp", "freemium", "sla" ], "lastRelease": "2026-10-13", "graded": true, "anchor": { "graded": true, "score": 74.5, "grade": "BB", "agentReady": true, "rank": 83, "ranked": true, "rankOf": 1486, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 80, "payments": 20, "reliability": 91, "schema": 87, "security": 83, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence.", "bestFor": "Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.", "strengths": [ "Agent identities can't hold credentials. The blueprint authenticates with a managed identity, certificate or secret and exchanges for the agent's token", "Global Administrator and similar roles, and Graph permissions such as Application.ReadWrite.All, are refused for agent identities", "Create, list, update, delete and restore are on Microsoft Graph v1.0, with agentIdentity in the public OpenAPI file", "Audit and sign-in logs carry an agentType and blueprintId for agent activity", "Microsoft.Identity.Web.AgentIdentities 4.16.1 reached NuGet on 13 October 2026, the third release in the 90 days to 1 November" ], "weaknesses": [ "Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing", "Microsoft's docs call hand-written token exchange complex and error-prone and steer developers to a .NET library or a sidecar container", "Creating a blueprint, a principal and an identity in quick succession can fail with 400 until the directory replicates", "Audit and sign-in logs are kept seven days on Entra ID Free and 30 days on P1 or P2", "microsoft.com's security.txt passed its Expires date on 23 September 2026 and was still expired on 1 November" ], "agentNotes": [ "Request tokens in two steps. The blueprint gets an exchange token with fmi_path set to the agent identity's client ID, then the agent identity trades it for a resource token", "Retry with exponential backoff when a create returns `400 Object with id not found` straight after creating its parent object", "Send displayName, agentIdentityBlueprintId and a sponsor reference when creating an agent identity. All three are required", "Don't use the interactive `/authorize` flow. Agent identities are confidential clients and can't sign in to a page", "Keep the sidecar off any public network. Its `/AuthorizationHeader` endpoint hands out tokens to whoever can reach it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.5 } ], "editorialScores": { "ergonomics": 71, "maintenance": 80, "payments": 20, "reliability": 91, "schema": 87, "security": 83, "transparency": 63 }, "provenanceScore": 87, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-10-27", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "dotnet add package Microsoft.Identity.Web.AgentIdentities", "http": "curl -X POST https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity \\\n -H \"Authorization: Bearer $BLUEPRINT_TOKEN\" -H \"Content-Type: application/json\" \\\n -d '{\"displayName\": \"My Agent Identity\", \"agentIdentityBlueprintId\": \"\u003cblueprint-app-id\u003e\", \"sponsors@odata.bind\": [\"https://graph.microsoft.com/v1.0/users/\u003cid\u003e\"]}'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/microsoft-entra-agent-id" }, "sameCompany": [ "azure-openai", "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "azure-key-vault", "bing-grounding", "azure-document-intelligence", "azure-devops-mcp", "microsoft-learn-mcp", "tokeneconomizer", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "azure-blob-storage", "onedrive-sharepoint", "microsoft-teams", "dynamics-365-sales", "copilot-studio-mcp", "power-automate", "foundry-local", "microsoft-decision-1", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph", "microsoft-graph-people", "mage-vl-cowork" ], "area": "agent-runtime", "unitPrices": [ { "item": "Microsoft Agent 365", "unit": "seat-month", "usd": 15, "note": "billed yearly, needed for Conditional Access, ID Protection and governance for agents" }, { "item": "Microsoft 365 E7 (includes Agent 365)", "unit": "seat-month", "usd": 99, "note": "billed yearly" } ], "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "endpointOnVendorDomain": true, "terms": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "privacy": "https://www.microsoft.com/en-us/privacy/privacystatement", "statusPage": "https://azure.status.microsoft/en-us/status/history/", "changelog": "https://learn.microsoft.com/en-us/graph/whats-new-overview", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "www.microsoft.com/.well-known/security.txt carries Expires 2026-09-23T16:00:00.000Z when read on 2026-10-08.", "The Microsoft APIs terms of use cover the Microsoft Graph API and other APIs that reach directory data, and were last updated in October 2025. Tenant use of Entra also falls under the customer's Microsoft licensing agreement and the Product Terms, which we didn't read.", "The Microsoft privacy statement was last updated in September 2026.", "Tokens come from login.microsoftonline.com and management calls go to graph.microsoft.com, both Microsoft domains.", "Entra's SLA page sends readers to the Azure status history for incidents that affect Entra ID.", "RDAP for microsoft.com gives a registration date of 1991-05-02." ], "score": 87 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "unknown", "freeTier": true, "minutes": 30, "credential": "cloud-iam", "hosting": [ "global", "EU" ], "euResidency": "yes", "trainsOnData": "no", "zeroRetention": "unknown", "certifications": [ "FedRAMP", "GDPR" ], "dpa": true, "selfHost": "no" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/microsoft-entra-agent-id.json", "live": { "slug": "microsoft-entra-agent-id", "probe": { "target": "https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity", "method": "get", "lastAt": "2026-11-07T18:20:39.534597935Z", "lastOk": true, "lastStatus": 401, "lastMs": 100, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 32, "p95ms24h": 142, "samples24h": 239, "samples30d": 7440, "days": [ { "date": "2026-10-08", "probes": 70, "ok": 70 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://azure.status.microsoft/en-us/status/history", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-06T20:50:19.422229835Z" }, "versions": [ { "registry": "github", "name": "AzureAD/microsoft-identity-web", "version": "4.17.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:45:00.29074344Z" } ], "githubStars": 791, "securityTxt": { "url": "https://microsoft.com/.well-known/security.txt", "state": "valid", "expires": "2027-10-27T16:00:00.000Z", "checkedAt": "2026-11-07T16:02:01.196666056Z" }, "domain": { "domain": "microsoft.com", "registered": "1991-05-02", "source": "https://rdap.verisign.com/com/v1/domain/microsoft.com", "checkedAt": "2026-11-01T14:14:19.336136409Z" }, "pages": [ { "url": "https://learn.microsoft.com/en-us/graph/whats-new-overview", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:13:15.738987099Z", "changedAt": "2026-11-07T14:13:15.738987099Z", "fingerprint": "7db19da2c803" }, { "url": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:13:17.647170612Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1a1ee1c20d9a" } ], "github": { "repo": "azuread/microsoft-identity-web", "checkedAt": "2026-11-02T08:34:04.319420374Z", "stars": 790, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T17:33:25Z", "openIssues": 316, "openPRs": 30, "issuesOpened90d": 15, "issuesClosed90d": 4, "prsMerged90d": 75, "ci": { "branch": "master", "runs": 50, "success": 21, "failure": 29, "other": 0, "latest": "failure", "latestAt": "2026-10-15T11:37:33Z" }, "advisories": [ { "ghsa": "GHSA-699m-v2jh-245p", "cve": "CVE-2026-80092", "severity": "medium", "published": "2026-10-21T13:45:58Z" }, { "ghsa": "GHSA-rpq8-q44m-2rpg", "cve": "CVE-2025-32016", "severity": "medium", "published": "2025-04-09T15:29:34Z" } ], "replies": { "sampled": 25, "unanswered": 8, "medianDays": 9.3 } }, "updatedAt": "2026-11-07T18:20:39.534597935Z" } }, "edges": [ { "by": 30, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "b": "No x402, MPP or L402 (0). Agent 365 is listed at $15 a user a month and Microsoft 365 E7 at $99, and the docs say Agent ID is available to all Entra customers, but no page gives a per-agent price or says plainly which parts are free (10). Entra ID Free comes with a Microsoft cloud subscription. We didn't establish whether a new tenant can be opened without a card, so this line gets half (10). A person creates the tenant, holds an Agent ID role and creates the blueprint before any agent can act (0)." }, "scores": { "a": 50, "b": 20 } }, { "by": 17, "category": "reliability", "leads": "microsoft-entra-agent-id", "name": "Reliability", "reasons": { "a": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.", "b": "Microsoft's SLA page for Entra ID points to the Azure status history for incidents, and that page was readable with dated entries and reviews (20). The 90 days to 1 November show two Azure incidents, on 29 September (Azure OpenAI and AI services) and 30 September 2026 (networking gateways, 20:30 UTC to 02:15 UTC on 1 October), and none after 30 September when the page was re-read on 1 November. The 23 July West US network fault, which listed Azure AD B2C, has left the window. Neither names Entra ID, and Microsoft's SLA performance page, updated 7 October and re-read on 1 November, reports 99.999 per cent authentication availability for July, August and September 2026. We scored between clean and minor because the page lists only wide incidents (25). Graph identity limits are published as numbers, such as 3,000 writes per 2 minutes 30 seconds per app and tenant, per the 8 October check (15). 429 carries Retry-After and the FAQ asks for exponential backoff, but there is no idempotency key and back-to-back creates can fail with 400 during replication (11). An SLA for Microsoft Entra ID is published and attainment is reported monthly. The SLA document itself didn't load for us (10). Agent ID has been generally available since April 2026 and the agentIdentity API is on Graph v1.0 (10). 20+25+15+11+10+10 = 91." }, "scores": { "a": 74, "b": 91 } }, { "by": 11, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "b": "Closed service under the Microsoft APIs terms of use, last updated October 2025, with MIT SDK source (15). The privacy statement was updated in September 2026, Entra publishes a data residency page and log retention periods, and we didn't read the DPA (20). Microsoft Graph gives at least 24 months' notice before retiring a GA API or version, while several Agent ID operations are still on /beta, which can change without notice (18). Entra documents where tenant data is stored by geography. We didn't read the sub-processor list (10)." }, "scores": { "a": 86, "b": 75 } }, { "by": 7, "category": "maintenance", "leads": "cloudflare-workers-oauth-provider", "name": "Maintenance \u0026 community", "reasons": { "a": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.", "b": "Microsoft.Identity.Web.AgentIdentities 4.16.1 was published to NuGet on 13 October 2026, 19 days before this check, a release the changelog describes as security fixes and reliability improvements (30). Three releases in the 90 days from 3 August, 4.15.0 (21 September), 4.16.0 (1 October) and 4.16.1 (13 October), and Graph changelog entries for agent identities in September and October (agentUser `managerApplications` promoted to v1.0). The repository's changelog has 4.17.0 notes from 30 October that weren't on NuGet on 1 November (20). A closed service with public release notes and a public SDK tracker that showed 340 open issues on 8 October, not re-read on 1 November. We didn't read reply times (10). The current in-process SDK is .NET only, with the sidecar container for other languages (12). Azure Pipelines and CodeQL are configured, a 14 October commit updates cryptography packages for security advisories, and a 28 October commit raises dependency minimums to address vulnerabilities (8). 30+20+10+12+8 = 80." }, "scores": { "a": 87, "b": 80 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "Microsoft", "name": "Vendor" }, { "a": "no (local only)", "b": "https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "2026-10-22", "b": "2026-10-13", "name": "Last release" }, { "a": "2025-09-12", "b": "2025-10-01", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-09-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "1.9k stars, 1.1M npm/wk", "b": "787 stars", "name": "Popularity" }, { "a": "none", "b": "2.8/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Microsoft Entra Agent ID's 74.5 (BB), and leads in 4 of 7 scored categories. Microsoft Entra Agent ID leads on reliability.", "question": "Which is better for AI agents, Cloudflare Workers OAuth Provider or Microsoft Entra Agent ID?" }, { "answer": "No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Microsoft Entra Agent ID has a hosted endpoint at https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity.", "question": "Can an agent call Cloudflare Workers OAuth Provider and Microsoft Entra Agent ID without installing anything?" }, { "answer": "Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Microsoft Entra Agent ID.", "question": "Are Cloudflare Workers OAuth Provider and Microsoft Entra Agent ID open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 50 against 20", "Maintenance \u0026 community, 87 against 80", "Transparency \u0026 trust, 86 against 75" ], "also": [ "Open source" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" }, { "aheadOn": [ "Reliability, 91 against 74" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.", "slug": "microsoft-entra-agent-id", "watchFor": "Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing" } ], "history": { "cloudflare-workers-oauth-provider": null, "microsoft-entra-agent-id": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 74.4, "fromGrade": "BB", "to": 74.5, "toGrade": "BB" } ] }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.json", "title": "Aembit vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.json", "title": "Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.json", "title": "Arcade.dev vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.json", "title": "Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.json", "title": "Descope Agentic Identity Hub vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.json", "title": "Keycard vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango.json", "title": "Microsoft Entra Agent ID vs Nango", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.json", "title": "Microsoft Entra Agent ID vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps.json", "title": "Microsoft Entra Agent ID vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.json", "title": "Microsoft Entra Agent ID vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes.json", "title": "Microsoft Entra Agent ID vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes" } ], "panel": null, "scores": [ { "by": 17, "cloudflare-workers-oauth-provider": 74, "edge": "microsoft-entra-agent-id", "key": "reliability", "microsoft-entra-agent-id": 91, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 1, "cloudflare-workers-oauth-provider": 86, "edge": "microsoft-entra-agent-id", "key": "schema", "microsoft-entra-agent-id": 87, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 3, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "ergonomics", "microsoft-entra-agent-id": 71, "name": "Agent ergonomics", "weight": 13 }, { "by": 3, "cloudflare-workers-oauth-provider": 80, "edge": "microsoft-entra-agent-id", "key": "security", "microsoft-entra-agent-id": 83, "name": "Security \u0026 auth", "weight": 14 }, { "by": 30, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "microsoft-entra-agent-id": 20, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 7, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "microsoft-entra-agent-id": 80, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 11, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "microsoft-entra-agent-id": 75, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Microsoft Entra Agent ID's 74.5 (BB), and leads in 4 of 7 scored categories. Microsoft Entra Agent ID leads on reliability. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "microsoft-entra-agent-id": "Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id", "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Microsoft Entra Agent ID's 74.5 (BB), and leads in 4 of 7 scored categories. Microsoft Entra Agent ID leads on reliability. Both do oauth for agents.\n\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Microsoft Entra Agent ID: grade BB, 74.5/100, rank #83 of 1486. Markdown https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md · JSON https://www.anchorterminal.com/api/v1/tools/microsoft-entra-agent-id.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Payments \u0026 pricing, 50 against 20\n- Maintenance \u0026 community, 87 against 80\n- Transparency \u0026 trust, 86 against 75\n\nAlso in its favour:\n- Open source\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n### Microsoft Entra Agent ID (BB)\n\nGood for: Organisations already on Microsoft Entra that want each agent to be a governed directory identity with tokens for Microsoft Graph, Azure and their own APIs.\n\nAhead on:\n- Reliability, 91 against 74\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Conditional Access, ID Protection and governance for agents need Microsoft Agent 365, listed at $15 a user a month on yearly billing\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +30\n\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- Microsoft Entra Agent ID (20): No x402, MPP or L402 (0). Agent 365 is listed at $15 a user a month and Microsoft 365 E7 at $99, and the docs say Agent ID is available to all Entra customers, but no page gives a per-agent price or says plainly which parts are free (10). Entra ID Free comes with a Microsoft cloud subscription. We didn't establish whether a new tenant can be opened without a card, so this line gets half (10). A person creates the tenant, holds an Agent ID role and creates the blueprint before any agent can act (0).\n\n### Reliability: Microsoft Entra Agent ID +17\n\n- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.\n- Microsoft Entra Agent ID (91): Microsoft's SLA page for Entra ID points to the Azure status history for incidents, and that page was readable with dated entries and reviews (20). The 90 days to 1 November show two Azure incidents, on 29 September (Azure OpenAI and AI services) and 30 September 2026 (networking gateways, 20:30 UTC to 02:15 UTC on 1 October), and none after 30 September when the page was re-read on 1 November. The 23 July West US network fault, which listed Azure AD B2C, has left the window. Neither names Entra ID, and Microsoft's SLA performance page, updated 7 October and re-read on 1 November, reports 99.999 per cent authentication availability for July, August and September 2026. We scored between clean and minor because the page lists only wide incidents (25). Graph identity limits are published as numbers, such as 3,000 writes per 2 minutes 30 seconds per app and tenant, per the 8 October check (15). 429 carries Retry-After and the FAQ asks for exponential backoff, but there is no idempotency key and back-to-back creates can fail with 400 during replication (11). An SLA for Microsoft Entra ID is published and attainment is reported monthly. The SLA document itself didn't load for us (10). Agent ID has been generally available since April 2026 and the agentIdentity API is on Graph v1.0 (10). 20+25+15+11+10+10 = 91.\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +11\n\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n- Microsoft Entra Agent ID (75): Closed service under the Microsoft APIs terms of use, last updated October 2025, with MIT SDK source (15). The privacy statement was updated in September 2026, Entra publishes a data residency page and log retention periods, and we didn't read the DPA (20). Microsoft Graph gives at least 24 months' notice before retiring a GA API or version, while several Agent ID operations are still on /beta, which can change without notice (18). Entra documents where tenant data is stored by geography. We didn't read the sub-processor list (10).\n\n### Maintenance \u0026 community: Cloudflare Workers OAuth Provider +7\n\n- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n- Microsoft Entra Agent ID (80): Microsoft.Identity.Web.AgentIdentities 4.16.1 was published to NuGet on 13 October 2026, 19 days before this check, a release the changelog describes as security fixes and reliability improvements (30). Three releases in the 90 days from 3 August, 4.15.0 (21 September), 4.16.0 (1 October) and 4.16.1 (13 October), and Graph changelog entries for agent identities in September and October (agentUser `managerApplications` promoted to v1.0). The repository's changelog has 4.17.0 notes from 30 October that weren't on NuGet on 1 November (20). A closed service with public release notes and a public SDK tracker that showed 340 open issues on 8 October, not re-read on 1 November. We didn't read reply times (10). The current in-process SDK is .NET only, with the sidecar container for other languages (12). Azure Pipelines and CodeQL are configured, a 14 October commit updates cryptography packages for security advisories, and a 28 October commit raises dependency minimums to address vulnerabilities (8). 30+20+10+12+8 = 80.\n\n## Score by category\n\n| Category | Weight | Cloudflare Workers OAuth Provider | Microsoft Entra Agent ID | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 74 | 91 | Microsoft Entra Agent ID +17 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 87 | Microsoft Entra Agent ID +1 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 71 | Cloudflare Workers OAuth Provider +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 80 | 83 | Microsoft Entra Agent ID +3 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 20 | Cloudflare Workers OAuth Provider +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 80 | Cloudflare Workers OAuth Provider +7 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 86 | 75 | Cloudflare Workers OAuth Provider +11 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **76.2 · BB** | **74.5 · BB** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Workers OAuth Provider | Microsoft Entra Agent ID |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | Microsoft |\n| Hosted endpoint | no (local only) | `https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity` |\n| Transports | | HTTP |\n| Auth | OAuth | OAuth |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | Proprietary service under Microsoft's terms. Microsoft.Identity.Web and the Auth SDK sidecar source are MIT |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| Last release | 2026-10-22 | 2026-10-13 |\n| Terms last updated | 2025-09-12 | 2025-10-01 |\n| Privacy policy last updated | no date given | 2026-09-01 |\n| Customer content may train models | not found in the text | yes |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 1.9k stars, 1.1M npm/wk | 787 stars |\n| Agent reviews | none | 2.8/5 (4) |\n\n## How the scores have moved\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n### Microsoft Entra Agent ID\n\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n**Microsoft Entra Agent ID.** Agent identities hold no credentials of their own, and Entra refuses high-privilege roles and Graph permissions for them. The token flow is a two-step exchange that Microsoft's own docs call complex and error-prone to implement by hand, and Conditional Access, risk detection and governance for agents need a paid Agent 365 licence.\n\n## Before you call either\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n### Microsoft Entra Agent ID\n\n1. Request tokens in two steps. The blueprint gets an exchange token with fmi_path set to the agent identity's client ID, then the agent identity trades it for a resource token\n2. Retry with exponential backoff when a create returns `400 Object with id not found` straight after creating its parent object\n3. Send displayName, agentIdentityBlueprintId and a sponsor reference when creating an agent identity. All three are required\n4. Don't use the interactive `/authorize` flow. Agent identities are confidential clients and can't sign in to a page\n5. Keep the sidecar off any public network. Its `/AuthorizationHeader` endpoint hands out tokens to whoever can reach it\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Workers OAuth Provider or Microsoft Entra Agent ID?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Microsoft Entra Agent ID's 74.5 (BB), and leads in 4 of 7 scored categories. Microsoft Entra Agent ID leads on reliability.\n\n### Can an agent call Cloudflare Workers OAuth Provider and Microsoft Entra Agent ID without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Workers OAuth Provider. Microsoft Entra Agent ID has a hosted endpoint at https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity.\n\n### Are Cloudflare Workers OAuth Provider and Microsoft Entra Agent ID open source?\n\nCloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Microsoft Entra Agent ID.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-workers-oauth-provider\", \"b\": \"microsoft-entra-agent-id\"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider microsoft-entra-agent-id`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/microsoft-entra-agent-id.json\n\n## Other comparisons with Cloudflare Workers OAuth Provider or Microsoft Entra Agent ID\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Aembit vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/arcade-vs-microsoft-entra-agent-id.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n- [Descope Agentic Identity Hub vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.md)\n- [Keycard vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.md)\n- [Microsoft Entra Agent ID vs Nango](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango.md)\n- [Microsoft Entra Agent ID vs Scalekit AgentKit](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.md)\n- [Microsoft Entra Agent ID vs Stytch Connected Apps](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps.md)\n- [Microsoft Entra Agent ID vs Vercel Connect](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.md)\n- [Microsoft Entra Agent ID vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to Microsoft Entra Agent ID's 74.5 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare Workers OAuth Provider BB 76.2", "Microsoft Entra Agent ID BB 74.5", "scores" ], "h1": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, "tokens": { "markdown": 4300, "slim": 2080 }, "version": 1 }