{ "data": { "a": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Nango's 65.5 (B), and leads in 4 of 7 scored categories.", "b": { "slug": "nango", "name": "Nango", "vendor": "Nango", "vendorUrl": "https://www.nango.dev", "kind": "http-api", "category": "agent-auth", "summary": "Source-available integration platform that handles OAuth, API keys and token refresh for 1,000+ APIs on behalf of your users.", "url": "https://www.anchorterminal.com/tools/nango", "markdownUrl": "https://www.anchorterminal.com/tools/nango.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nango.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nango.json", "dns": "nango.grade.anchorterminal.com", "repo": "https://github.com/NangoHQ/nango", "license": "Elastic License 2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.nango.dev", "packages": [ { "registry": "npm", "name": "@nangohq/node" }, { "registry": "npm", "name": "@nangohq/frontend" } ], "auth": "mixed", "authNotes": "Backend calls take an environment secret key as `Authorization: Bearer $NANGO_SECRET_KEY`, and API keys can be scoped (agent sessions need `environment:agent_sessions:write`). End users connect through a short-lived connect session token in the Connect UI. An agent session returns its own MCP URL and `session_token`, sent as a Bearer token. The Management MCP at mcp.nango.dev signs in with OAuth.", "pricing": "freemium", "pricingNotes": "Three plans since 2 September 2026. Free is $0 with 10 connections, 10 compute hours and 10 GB of data transfer a month and no card. Pay-as-you-go is $50 a month returned as $50 of usage credits, then $0.29 per connection a month, $0.72 per compute hour and $0.50 per GB. The Growth add-on is $450 a month and adds faster integration delivery (5 days instead of 20) and a private Slack channel, and the changelog of 2 September also puts RBAC, OpenTelemetry export, Connect UI branding, SAML SSO for your team and a HIPAA BAA under it. Enterprise is custom, with connections from $0.01 at volume, 2-day integration delivery, BYOC and self-hosting, dedicated SLAs, and the pricing page lists HIPAA, SAML SSO, SCIM and the audit trail there (https://www.nango.dev/pricing, https://nango.dev/docs/updates/changelog). Free self-hosting covers auth and proxy only, with no MCP server, syncs or webhooks (https://nango.dev/docs/guides/platform/free-self-hosting).", "priceSummary": "$50 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 469086, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://nango.dev/docs", "llmsTxt": "https://nango.dev/docs/llms.txt", "openapi": "https://raw.githubusercontent.com/NangoHQ/nango/master/docs/spec.yaml", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.audit", "agent.tools", "automation.embedded" ], "tags": [ "hosted", "self-hosted", "freemium", "free-tier", "mcp", "llms-txt", "openapi", "oauth", "typescript", "webhooks", "source-available", "enterprise" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 65.5, "grade": "B", "agentReady": false, "rank": 418, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 90, "payments": 40, "reliability": 78, "schema": 85, "security": 71, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -8, "negativeNotes": [ "2026-09-04, CVE-2026-9317 (CVSS 9.2 per the 1 October check). The runner's tRPC server in Nango before 0.71.6 didn't enforce RUNNER_SECRET_KEY, so anyone who could reach the runner port could run arbitrary JavaScript. Fixed in 0.71.6. Recent and critical, though it needs network access to the runner (https://api.osv.dev/v1/vulns/CVE-2026-9317)", "2026-09-16, CVE-2026-92804 (high). Nango through 0.70.4 was open to server-side request forgery through caller-supplied connection configuration. Fixed in later releases. Together with the runner flaw we deduct 5, less than the maximum because both are fixed and disclosed (https://api.osv.dev/v1/vulns/CVE-2026-92804)", "2026-09-14 and 2026-10-01. Nango began rejecting incoming webhooks it had forwarded before, announced the day each change took effect. Gmail pushes without an OIDC token and GitHub App webhooks without a signature from 14 September, and Affinity, Fillout, ShipStation and Salesforce webhooks without a per-connection secret from 1 October. A published behaviour changed for existing clients with notice only on the day takes -3, as one term for both (https://nango.dev/docs/updates/changelog)" ], "verdict": "Nango handles OAuth, API keys and token refresh for 1,000+ APIs and serves per-tenant agent sessions as MCP servers, with scoped API keys and public per-unit prices. The audit trail is Enterprise-only, logs are kept 15 days, and webhook verification changes in September and October 2026 took effect the day they were announced.", "bestFor": "A product that connects many users to many SaaS APIs and wants tokens, refresh, syncs and a per-tenant MCP surface in one place, with source you can read.", "strengths": [ "1,000+ APIs with OAuth, API key and client-credentials auth handled", "Per-tenant agent sessions served as an MCP server, with tool allow and deny lists and credentials never shown to the agent", "Environment API keys take custom scopes, with rotation set out in the docs", "Per-unit prices in public ($0.29 a connection a month) and a free plan with no card", "Source on GitHub under ELv2, with 12 releases between 3 August and 29 October 2026" ], "weaknesses": [ "Audit trail only on Enterprise, and logs kept 15 days on every plan", "Two CVEs fixed in September 2026, one critical, neither on Nango's own advisory page", "Webhook verification changes on 14 September and 1 October 2026 rejected webhooks the day they were announced", "Status page tracks a single component", "No prompt-injection guidance for content agent sessions pass through" ], "agentNotes": [ "Create one agent session per tenant from your backend and pass only the mcp_url and session_token to the agent", "Leave `nango_proxy` off when a session relies on deny lists, because the proxy reaches any endpoint of a connected integration", "Listen for the refresh-failure webhook and send the user a reconnect link instead of retrying", "Read the rate-limit headers on a 429 and wait for the reset before resuming", "Set webhook secrets on Gmail, GitHub App, Affinity, Fillout, ShipStation and Salesforce integrations, or their webhooks are rejected" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 65.5 } ], "editorialScores": { "ergonomics": 74, "maintenance": 90, "payments": 40, "reliability": 78, "schema": 85, "security": 71, "transparency": 63 }, "provenanceScore": 90, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @nangohq/node", "http": "curl -X POST https://api.nango.dev/connect/sessions -H \"Authorization: Bearer $NANGO_SECRET_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"tags\":{\"end_user_id\":\"user-123\"}}'", "claudeCode": "claude mcp add --transport http nango-management --scope user https://mcp.nango.dev/mcp", "config": { "mcpServers": { "nango-management": { "url": "https://mcp.nango.dev/mcp" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/nango" }, "area": "agent-runtime", "unitPrices": [ { "item": "Pay-as-you-go subscription", "unit": "month", "usd": 50, "note": "Returned as $50 of usage credits each month" }, { "item": "Connection on Pay-as-you-go", "unit": "account-month", "usd": 0.29, "note": "Per connected end-user account per month" }, { "item": "Data transfer on Pay-as-you-go", "unit": "gb", "usd": 0.5, "note": "10 GB a month free. Compute is $0.72 an hour" }, { "item": "Growth add-on", "unit": "month", "usd": 450, "note": "Faster integration delivery, private Slack, RBAC, branding, SAML SSO, HIPAA BAA" } ], "provenance": { "legalEntity": "Nango Inc", "domain": "nango.dev", "domainRegistered": "2022-05-31", "endpointOnVendorDomain": true, "terms": "https://www.nango.dev/terms", "privacy": "https://www.nango.dev/privacy-policy", "statusPage": "https://status.nango.dev", "changelog": "https://nango.dev/docs/updates/changelog", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "The legal entity is named in the Terms of Service (effective 7 December 2023), Nango Inc of Claymont, Delaware, governed by Delaware law, read on 1 November 2026.", "security.txt lists security@nango.dev and private GitHub advisories and expires on 31 December 2027. SECURITY.md, rewritten on 21 October 2026, accepts reports only through private GitHub advisories. The Trust Center at trust.nango.dev holds the SOC 2 report.", "status.nango.dev is a Better Stack page with one component, Nango Cloud Health." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nango.json", "live": { "slug": "nango", "probe": { "target": "https://api.nango.dev", "method": "get", "lastAt": "2026-11-07T18:20:41.012234496Z", "lastOk": true, "lastStatus": 200, "lastMs": 539, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 454, "p95ms24h": 650, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.nango.dev", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:13.990839378Z" }, "versions": [ { "registry": "github", "name": "NangoHQ/nango", "version": "v0.72.3", "released": "2026-11-06", "seenAt": "2026-11-06T23:48:11.995462043Z" }, { "registry": "npm", "name": "@nangohq/frontend", "version": "0.72.3", "seenAt": "2026-11-06T23:48:10.568928283Z" }, { "registry": "npm", "name": "@nangohq/node", "version": "0.72.3", "seenAt": "2026-11-06T23:48:09.469969396Z" } ], "githubStars": 13138, "npmWeekly": 713382, "securityTxt": { "url": "https://nango.dev/.well-known/security.txt", "state": "valid", "expires": "2027-12-31T23:59:59.000Z", "checkedAt": "2026-11-07T16:01:37.016410101Z" }, "llmsTxt": { "url": "https://nango.dev/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:18.155989427Z" }, "domain": { "domain": "nango.dev", "registered": "2022-05-31", "source": "https://pubapi.registry.google/rdap/domain/nango.dev", "checkedAt": "2026-11-01T14:10:40.561725088Z" }, "pages": [ { "url": "https://nango.dev/docs/updates/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:14:50.273096827Z", "changedAt": "2026-11-05T12:37:49.43437951Z", "fingerprint": "03422d2b91e4" }, { "url": "https://www.nango.dev/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:31:54.357946618Z", "changedAt": "2026-11-07T14:31:54.357946618Z", "fingerprint": "630518db0ba1" }, { "url": "https://www.nango.dev/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:31:57.163117654Z", "changedAt": "2026-11-07T14:31:57.163117654Z", "fingerprint": "0ea6573b3b40" }, { "url": "https://www.nango.dev/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:31:59.496404131Z", "changedAt": "2026-11-07T14:31:59.496404131Z", "fingerprint": "c2d40e7e6dab" } ], "mcpTools": { "url": "https://mcp.nango.dev/mcp", "checkedAt": "2026-11-07T01:46:17.266321475Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:46:17.266321475Z" }, "github": { "repo": "nangohq/nango", "checkedAt": "2026-11-02T09:09:39.617937324Z", "stars": 13078, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:12:50Z", "openIssues": 21, "openPRs": 108, "issuesOpened90d": 51, "issuesClosed90d": 59, "prsMerged90d": 790, "ci": { "branch": "master", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-02T06:55:17Z" }, "advisories": [ { "ghsa": "GHSA-gqqr-9p2x-78h6", "severity": "high", "published": "2026-09-23T18:47:17Z" }, { "ghsa": "GHSA-5rjq-rf6r-396x", "severity": "high", "published": "2026-09-23T17:57:08Z" }, { "ghsa": "GHSA-gmhx-8hfq-8f4x", "severity": "high", "published": "2026-09-23T17:56:32Z" }, { "ghsa": "GHSA-42f5-jg2r-v8j7", "severity": "medium", "published": "2026-09-07T16:48:11Z" }, { "ghsa": "GHSA-fqr5-mf8g-p5m2", "severity": "high", "published": "2026-08-26T12:05:03Z" }, { "ghsa": "GHSA-hgjm-c252-ccxx", "severity": "critical", "published": "2026-08-26T12:04:19Z" }, { "ghsa": "GHSA-2j37-g5f6-h55p", "cve": "CVE-2026-9316", "severity": "high", "published": "2026-08-26T11:56:40Z" }, { "ghsa": "GHSA-c6jh-v7p9-556w", "severity": "high", "published": "2026-08-26T11:55:35Z" }, { "ghsa": "GHSA-8m28-9wcj-v8ww", "severity": "high", "published": "2026-08-26T11:54:25Z" }, { "ghsa": "GHSA-vc5r-hj76-f35p", "cve": "CVE-2026-102596", "severity": "medium", "published": "2026-08-26T11:48:18Z" } ], "replies": { "sampled": 25, "unanswered": 12, "medianDays": 2.9 } }, "updatedAt": "2026-11-07T18:20:41.012234496Z" } }, "edges": [ { "by": 10, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "b": "No x402, MPP or L402 (0). Per-unit prices published without a login, $0.29 per connection a month, $0.72 per compute hour and $0.50 per GB on Pay-as-you-go, re-read on 1 November 2026 (20). Free plan with 10 connections, 10 compute hours and 10 GB a month, and no card per the 1 October check (20). A person signs up in a browser (0)." }, "scores": { "a": 50, "b": 40 } }, { "by": 9, "category": "security", "leads": "cloudflare-workers-oauth-provider", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.", "b": "Environment API keys take Full access or custom scopes (agent sessions need `environment:agent_sessions:write`), the changelog of 22 April 2026 sets out rotation by issuing a replacement key, checking its last use and deleting the old one, and since 19 October the account-level API can create keys with scopes and change them. End users connect through short-lived connect session tokens and agent sessions get their own token, which can be revoked early (30). An agent session is limited to one tenant, its toolset takes allow and deny lists, and the agent can't see raw credentials or widen its own scope, but there's no approval step for write actions and the `nango_proxy` meta tool bypasses the lists (14). Agent sessions pass third-party API content straight to the agent and we found no prompt-injection guidance (5). Logs for 15 days on every plan, and an audit trail (added 3 September 2026) only on Enterprise (10). security.txt valid to 31 December 2027, SECURITY.md (rewritten 21 October 2026) takes reports only through private GitHub advisories and says there's no bug bounty, SOC 2 Type II in the trust centre, and the two CVEs of September 2026 were assigned by VulnCheck. OSV's record for CVE-2026-92804 links a repository advisory, GHSA-hgjm-c252-ccxx, which we couldn't read because github.com refuses our reader (12). 30 + 14 + 5 + 10 + 12 = 71." }, "scores": { "a": 80, "b": 71 } }, { "by": 9, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "b": "Source on GitHub under the Elastic License 2.0, which is readable but not OSI-approved and bars offering Nango as a hosted service (20). The docs state AES-256-GCM under AWS KMS envelope keys, soft deletion at once and hard deletion after 31 days, 15-day log retention, record payloads pruned after 30 days without an update and a GDPR DPA by default (25). Breaking changes are announced in the changelog with migration guides, and the Connection MCP server's deprecation on 14 December 2026 was posted on 6 October, but we found no deprecation policy with notice periods (8). The docs say tokens sit in PostgreSQL in AWS, but we didn't find a public subprocessor list outside the trust centre (10)." }, "scores": { "a": 86, "b": 77 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "Nango", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.nango.dev", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Elastic License 2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-22", "b": "2026-10-29", "name": "Last release" }, { "a": "2025-09-12", "b": "no date given", "name": "Terms last updated" }, { "a": "no date given", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.9k stars, 1.1M npm/wk", "b": "469k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Nango's 65.5 (B), and leads in 4 of 7 scored categories.", "question": "Which is better for AI agents, Cloudflare Workers OAuth Provider or Nango?" }, { "answer": "No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Nango has a hosted endpoint at https://api.nango.dev.", "question": "Can an agent call Cloudflare Workers OAuth Provider and Nango without installing anything?" }, { "answer": "Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Nango.", "question": "Are Cloudflare Workers OAuth Provider and Nango open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 80 against 71", "Payments \u0026 pricing, 50 against 40", "Transparency \u0026 trust, 86 against 77" ], "also": [ "Agent-ready, a grade of BB or better", "Open source", "No incidents deducted, where Nango loses 8 points for them" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" }, { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "A product that connects many users to many SaaS APIs and wants tokens, refresh, syncs and a per-tenant MCP surface in one place, with source you can read.", "slug": "nango", "watchFor": "Audit trail only on Enterprise, and logs kept 15 days on every plan" } ], "history": { "cloudflare-workers-oauth-provider": null, "nango": [ { "causes": [ "correction", "event" ], "date": "2026-11-01", "delta": -2.3, "from": 67.8, "fromGrade": "B", "to": 65.5, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 67.7, "fromGrade": "B", "to": 67.8, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.2, "from": 67.9, "fromGrade": "B", "to": 67.7, "toGrade": "B" } ] }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-nango.json", "title": "Aembit vs Nango", "url": "https://www.anchorterminal.com/compare/aembit-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.json", "title": "Amazon Bedrock AgentCore Identity vs Nango", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-nango.json", "title": "Arcade.dev vs Nango", "url": "https://www.anchorterminal.com/compare/arcade-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.json", "title": "Auth0 for AI Agents (Token Vault) vs Nango", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango.json", "title": "Descope Agentic Identity Hub vs Nango", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-nango.json", "title": "Keycard vs Nango", "url": "https://www.anchorterminal.com/compare/keycard-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango.json", "title": "Microsoft Entra Agent ID vs Nango", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit.json", "title": "Nango vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.json", "title": "Nango vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-vercel-connect.json", "title": "Nango vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/nango-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-workos-pipes.json", "title": "Nango vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/nango-vs-workos-pipes" } ], "panel": null, "scores": [ { "by": 4, "cloudflare-workers-oauth-provider": 74, "edge": "nango", "key": "reliability", "name": "Reliability", "nango": 78, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 1, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "schema", "name": "Schema \u0026 documentation", "nango": 85, "weight": 13 }, { "by": 0, "cloudflare-workers-oauth-provider": 74, "edge": "", "key": "ergonomics", "name": "Agent ergonomics", "nango": 74, "weight": 13 }, { "by": 9, "cloudflare-workers-oauth-provider": 80, "edge": "cloudflare-workers-oauth-provider", "key": "security", "name": "Security \u0026 auth", "nango": 71, "weight": 14 }, { "by": 10, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "nango": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 3, "cloudflare-workers-oauth-provider": 87, "edge": "nango", "key": "maintenance", "name": "Maintenance \u0026 community", "nango": 90, "weight": 7 }, { "by": 9, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "nango": 77, "weight": 7 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Nango's 65.5 (B), and leads in 4 of 7 scored categories. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "nango": "Nango handles OAuth, API keys and token refresh for 1,000+ APIs and serves per-tenant agent sessions as MCP servers, with scoped API keys and public per-unit prices. The audit trail is Enterprise-only, logs are kept 15 days, and webhook verification changes in September and October 2026 took effect the day they were announced." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango", "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Nango's 65.5 (B), and leads in 4 of 7 scored categories. Both do oauth for agents.\n\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Nango: grade B, 65.5/100, rank #418 of 1486. Markdown https://www.anchorterminal.com/tools/nango.md · JSON https://www.anchorterminal.com/api/v1/tools/nango.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Security \u0026 auth, 80 against 71\n- Payments \u0026 pricing, 50 against 40\n- Transparency \u0026 trust, 86 against 77\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n- No incidents deducted, where Nango loses 8 points for them\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n### Nango (B)\n\nGood for: A product that connects many users to many SaaS APIs and wants tokens, refresh, syncs and a per-tenant MCP surface in one place, with source you can read.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Audit trail only on Enterprise, and logs kept 15 days on every plan\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +10\n\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- Nango (40): No x402, MPP or L402 (0). Per-unit prices published without a login, $0.29 per connection a month, $0.72 per compute hour and $0.50 per GB on Pay-as-you-go, re-read on 1 November 2026 (20). Free plan with 10 connections, 10 compute hours and 10 GB a month, and no card per the 1 October check (20). A person signs up in a browser (0).\n\n### Security \u0026 auth: Cloudflare Workers OAuth Provider +9\n\n- Cloudflare Workers OAuth Provider (80): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.\n- Nango (71): Environment API keys take Full access or custom scopes (agent sessions need `environment:agent_sessions:write`), the changelog of 22 April 2026 sets out rotation by issuing a replacement key, checking its last use and deleting the old one, and since 19 October the account-level API can create keys with scopes and change them. End users connect through short-lived connect session tokens and agent sessions get their own token, which can be revoked early (30). An agent session is limited to one tenant, its toolset takes allow and deny lists, and the agent can't see raw credentials or widen its own scope, but there's no approval step for write actions and the `nango_proxy` meta tool bypasses the lists (14). Agent sessions pass third-party API content straight to the agent and we found no prompt-injection guidance (5). Logs for 15 days on every plan, and an audit trail (added 3 September 2026) only on Enterprise (10). security.txt valid to 31 December 2027, SECURITY.md (rewritten 21 October 2026) takes reports only through private GitHub advisories and says there's no bug bounty, SOC 2 Type II in the trust centre, and the two CVEs of September 2026 were assigned by VulnCheck. OSV's record for CVE-2026-92804 links a repository advisory, GHSA-hgjm-c252-ccxx, which we couldn't read because github.com refuses our reader (12). 30 + 14 + 5 + 10 + 12 = 71.\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +9\n\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n- Nango (77): Source on GitHub under the Elastic License 2.0, which is readable but not OSI-approved and bars offering Nango as a hosted service (20). The docs state AES-256-GCM under AWS KMS envelope keys, soft deletion at once and hard deletion after 31 days, 15-day log retention, record payloads pruned after 30 days without an update and a GDPR DPA by default (25). Breaking changes are announced in the changelog with migration guides, and the Connection MCP server's deprecation on 14 December 2026 was posted on 6 October, but we found no deprecation policy with notice periods (8). The docs say tokens sit in PostgreSQL in AWS, but we didn't find a public subprocessor list outside the trust centre (10).\n\n## Score by category\n\n| Category | Weight | Cloudflare Workers OAuth Provider | Nango | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 74 | 78 | Nango +4 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 85 | Cloudflare Workers OAuth Provider +1 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 74 | even |\n| Security \u0026 auth | 14% (17.5 this run) | 80 | 71 | Cloudflare Workers OAuth Provider +9 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 40 | Cloudflare Workers OAuth Provider +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 90 | Nango +3 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 86 | 77 | Cloudflare Workers OAuth Provider +9 |\n| Negative events | ≤15 | 0 | -8 | |\n| **Total** | | **76.2 · BB** | **65.5 · B** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Workers OAuth Provider | Nango |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | Nango |\n| Hosted endpoint | no (local only) | `https://api.nango.dev` |\n| Transports | | HTTP, Streamable HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | Elastic License 2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-22 | 2026-10-29 |\n| Terms last updated | 2025-09-12 | no date given |\n| Privacy policy last updated | no date given | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 1.9k stars, 1.1M npm/wk | 469k npm/wk |\n| Agent reviews | none | 3.5/5 (2) |\n\n## How the scores have moved\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n### Nango\n\n- -2.3 on 1 November 2026: correction, negative event\n- +0.1 on 27 October 2026: checklist\n- -0.2 on 8 October 2026: checklist\n\n## Verdicts\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n**Nango.** Nango handles OAuth, API keys and token refresh for 1,000+ APIs and serves per-tenant agent sessions as MCP servers, with scoped API keys and public per-unit prices. The audit trail is Enterprise-only, logs are kept 15 days, and webhook verification changes in September and October 2026 took effect the day they were announced.\n\n## Before you call either\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n### Nango\n\n1. Create one agent session per tenant from your backend and pass only the mcp_url and session_token to the agent\n2. Leave `nango_proxy` off when a session relies on deny lists, because the proxy reaches any endpoint of a connected integration\n3. Listen for the refresh-failure webhook and send the user a reconnect link instead of retrying\n4. Read the rate-limit headers on a 429 and wait for the reset before resuming\n5. Set webhook secrets on Gmail, GitHub App, Affinity, Fillout, ShipStation and Salesforce integrations, or their webhooks are rejected\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Workers OAuth Provider or Nango?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Nango's 65.5 (B), and leads in 4 of 7 scored categories.\n\n### Can an agent call Cloudflare Workers OAuth Provider and Nango without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Workers OAuth Provider. Nango has a hosted endpoint at https://api.nango.dev.\n\n### Are Cloudflare Workers OAuth Provider and Nango open source?\n\nCloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Nango.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-workers-oauth-provider\", \"b\": \"nango\"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider nango`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/nango.json\n\n## Other comparisons with Cloudflare Workers OAuth Provider or Nango\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Aembit vs Nango](https://www.anchorterminal.com/compare/aembit-vs-nango.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Nango](https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Nango](https://www.anchorterminal.com/compare/arcade-vs-nango.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Nango](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n- [Descope Agentic Identity Hub vs Nango](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango.md)\n- [Keycard vs Nango](https://www.anchorterminal.com/compare/keycard-vs-nango.md)\n- [Microsoft Entra Agent ID vs Nango](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango.md)\n- [Nango vs Scalekit AgentKit](https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit.md)\n- [Nango vs Stytch Connected Apps](https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.md)\n- [Nango vs Vercel Connect](https://www.anchorterminal.com/compare/nango-vs-vercel-connect.md)\n- [Nango vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/nango-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Workers OAuth Provider vs Nango", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to Nango's 65.5 (B) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare Workers OAuth Provider BB 76.2", "Nango B 65.5", "scores" ], "h1": "Cloudflare Workers OAuth Provider vs Nango", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-workers-oauth-provider-vs-nango", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider vs Nango for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, "tokens": { "markdown": 3600, "slim": 1580 }, "version": 1 }