{ "data": { "a": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Scalekit AgentKit's 72.2 (BB), and leads in 5 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics.", "b": { "slug": "scalekit-agentkit", "name": "Scalekit AgentKit", "vendor": "Scalekit", "vendorUrl": "https://www.scalekit.com", "kind": "http-api", "category": "agent-auth", "summary": "Authentication and integration platform for agents, with per-user account connections, scoped MCP servers and managed tool calls.", "url": "https://www.anchorterminal.com/tools/scalekit-agentkit", "markdownUrl": "https://www.anchorterminal.com/tools/scalekit-agentkit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/scalekit-agentkit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/scalekit-agentkit.json", "dns": "scalekit-agentkit.grade.anchorterminal.com", "repo": "https://github.com/scalekit-inc/scalekit-sdk-node", "license": "MIT (SDKs), platform closed, self-hosted on Enterprise", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://{env}.scalekit.com", "packages": [ { "registry": "npm", "name": "@scalekit-sdk/node" }, { "registry": "pypi", "name": "scalekit-sdk-python" }, { "registry": "npm", "name": "@scalekit-inc/cli" } ], "auth": "mixed", "authNotes": "Your backend gets a bearer token from `POST $SCALEKIT_ENVIRONMENT_URL/oauth/token` with `grant_type=client_credentials` and the client ID and secret from the dashboard, then calls the REST API under /api/v1 on the same environment URL (dev environments end in .scalekit.dev, production in .scalekit.com). End users authorise a connection through a time-limited magic link that Scalekit hosts. Virtual MCP servers take a short-lived session token minted per user, about one hour by default. The management MCP server at mcp.scalekit.com needs no extra credentials.", "pricing": "freemium", "pricingNotes": "AgentKit Free is $0 with 10,000 tool calls and 10,000 trigger events a month and no card, and Free limits don't extend with overages. Growth is $99 a month with 100,000 tool calls and 50,000 trigger events, then $0.50 per 1,000 tool calls and $3 per 1,000 trigger events, custom connectors, an API proxy and private Slack support, with an EU data residency add-on at $99 a month. Enterprise is custom, with negotiated volume, a 99.99 per cent uptime SLA, VPC or on-prem deployment, a HIPAA BAA, SIEM log streaming and a forward-deployed engineer (https://www.scalekit.com/pricing). A trigger event is billed only when delivered to your webhook. The page doesn't say whether a plain token fetch counts as a tool call.", "priceSummary": "$99 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 6, "npmWeekly": 10642, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.scalekit.com/agentkit/overview", "llmsTxt": "https://docs.scalekit.com/llms.txt", "openapi": "https://docs.scalekit.com/api/agentkit.scalar.json", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "agent.tools" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "oauth", "mcp", "llms-txt", "openapi", "typescript", "python", "enterprise", "self-hosted" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 72.2, "grade": "BB", "agentReady": true, "rank": 136, "ranked": true, "rankOf": 1486, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 88, "maintenance": 80, "payments": 40, "reliability": 72, "schema": 87, "security": 66, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "600+ connectors, including remote MCP servers over OAuth 2.1 with DCR, and a free tier of 10,000 tool calls a month without a card. Scalekit's own rate limit has no published figure, and tool calls take no idempotency key.", "bestFor": "A team that wants per-user third-party tokens plus a hosted tool catalogue at the lowest per-call price, with a tidy virtual MCP surface for agents.", "strengths": [ "600+ connectors, including remote MCP servers over OAuth 2.1 with DCR", "OpenAPI files, llms.txt and a Markdown twin for every docs page", "Tool search, scoped tool lists and virtual MCP servers keep an agent's context small", "Atlassian status page with an Agent Kit Tool Execution component and readable incident history", "Free tier of 10,000 tool calls a month with no card, then $0.50 per 1,000 on Growth" ], "weaknesses": [ "No published rate-limit figure and no idempotency keys for Scalekit's own API", "Any holder of the API credential can read a user's full OAuth tokens", "No approval step for destructive tools and no prompt-injection guidance", "The privacy policy says the United States and India, the trust centre says Frankfurt and Los Angeles", "No security.txt, no bug bounty and no deprecation notices" ], "agentNotes": [ "Use the exact dashboard Connection Name, not the connector slug, in every call", "Call `POST /api/v1/tools:search` with top_k instead of listing every tool", "When a connected account isn't ACTIVE, send the user the magic link and stop until they finish", "On a 429, read error_code (RATE_LIMITED is Scalekit, TOOL_ERROR is the app), back off 1, 2 then 4 seconds, and log the executionId", "Mint a fresh virtual MCP session token per user per run and let it expire", "Retry a failed tool call only when the tool is safe to repeat, since a retry can run it twice" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72.2 } ], "editorialScores": { "ergonomics": 88, "maintenance": 80, "payments": 40, "reliability": 72, "schema": 87, "security": 66, "transparency": 45 }, "provenanceScore": 86, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @scalekit-sdk/node", "http": "TOKEN=$(curl -s -X POST \"$SCALEKIT_ENVIRONMENT_URL/oauth/token\" \\\n -d client_id=\"$SCALEKIT_CLIENT_ID\" -d client_secret=\"$SCALEKIT_CLIENT_SECRET\" \\\n -d grant_type=client_credentials | jq -r .access_token)\ncurl -X POST \"$SCALEKIT_ENVIRONMENT_URL/api/v1/connected_accounts/magic_link\" \\\n -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" \\\n -d '{\"connection_name\":\"gmail\",\"identifier\":\"user-123\"}'", "claudeCode": "claude mcp add --transport http --scope user scalekit https://mcp.scalekit.com", "config": { "mcpServers": { "scalekit": { "url": "https://mcp.scalekit.com" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/scalekit-agentkit" }, "area": "agent-runtime", "unitPrices": [ { "item": "Growth plan", "unit": "month", "usd": 99, "note": "100,000 tool calls and 50,000 trigger events included" }, { "item": "Tool call above 100,000 on Growth", "unit": "call", "usd": 0.0005, "note": "$0.50 per 1,000" }, { "item": "EU data residency add-on", "unit": "month", "usd": 99, "note": "Growth plan" } ], "provenance": { "legalEntity": "ScaleKit, Inc.", "domain": "scalekit.com", "domainRegistered": "2003-04-24", "endpointOnVendorDomain": true, "terms": "https://www.scalekit.com/legal/terms-of-service", "privacy": "https://www.scalekit.com/legal/privacy-policy", "statusPage": "https://scalekit.statuspage.io/", "changelog": "https://www.scalekit.com/product-updates", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The terms and privacy policy (both effective 1 January 2026) name ScaleKit, Inc., with addresses in Redmond, WA and Lewes, DE, under Delaware law.", "RDAP shows scalekit.com registered on 2003-04-24, long before the company, so the domain was bought later.", "/.well-known/security.txt returned 404 on 2026-11-01. The status page is scalekit.statuspage.io, linked from the site footer. status.scalekit.com serves the dashboard app.", "The trust page at https://www.scalekit.com/trust-center states SOC 2 Type 2 and ISO 27001 certification and gives security@scalekit.com for reports." ], "score": 86 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/scalekit-agentkit.json", "live": { "slug": "scalekit-agentkit", "probe": { "target": "https://{env}.scalekit.com", "method": "get", "lastAt": "2026-11-07T18:20:52.364740264Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "invalid character \"{\" in host name", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 0 }, { "date": "2026-10-08", "probes": 268, "ok": 0 }, { "date": "2026-10-09", "probes": 250, "ok": 0 }, { "date": "2026-10-10", "probes": 247, "ok": 0 }, { "date": "2026-10-11", "probes": 247, "ok": 0 }, { "date": "2026-10-12", "probes": 247, "ok": 0 }, { "date": "2026-10-13", "probes": 248, "ok": 0 }, { "date": "2026-10-14", "probes": 249, "ok": 0 }, { "date": "2026-10-15", "probes": 253, "ok": 0 }, { "date": "2026-10-16", "probes": 252, "ok": 0 }, { "date": "2026-10-17", "probes": 253, "ok": 0 }, { "date": "2026-10-18", "probes": 256, "ok": 0 }, { "date": "2026-10-19", "probes": 255, "ok": 0 }, { "date": "2026-10-20", "probes": 252, "ok": 0 }, { "date": "2026-10-21", "probes": 253, "ok": 0 }, { "date": "2026-10-22", "probes": 253, "ok": 0 }, { "date": "2026-10-23", "probes": 248, "ok": 0 }, { "date": "2026-10-24", "probes": 251, "ok": 0 }, { "date": "2026-10-25", "probes": 250, "ok": 0 }, { "date": "2026-10-26", "probes": 252, "ok": 0 }, { "date": "2026-10-27", "probes": 249, "ok": 0 }, { "date": "2026-10-28", "probes": 250, "ok": 0 }, { "date": "2026-10-29", "probes": 249, "ok": 0 }, { "date": "2026-10-30", "probes": 249, "ok": 0 }, { "date": "2026-10-31", "probes": 251, "ok": 0 }, { "date": "2026-11-01", "probes": 249, "ok": 0 }, { "date": "2026-11-02", "probes": 250, "ok": 0 }, { "date": "2026-11-03", "probes": 248, "ok": 0 }, { "date": "2026-11-04", "probes": 246, "ok": 0 }, { "date": "2026-11-05", "probes": 185, "ok": 0 }, { "date": "2026-11-06", "probes": 241, "ok": 0 }, { "date": "2026-11-07", "probes": 187, "ok": 0 } ] }, "vendorStatus": { "page": "https://scalekit.statuspage.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:22:00.000781669Z" }, "versions": [ { "registry": "github", "name": "scalekit-inc/scalekit-sdk-node", "version": "v2.21.0", "released": "2026-10-28", "seenAt": "2026-11-07T00:03:10.923220257Z" }, { "registry": "npm", "name": "@scalekit-inc/cli", "version": "0.3.24", "seenAt": "2026-11-07T00:03:09.694846144Z" }, { "registry": "npm", "name": "@scalekit-sdk/node", "version": "2.21.0", "seenAt": "2026-11-07T00:03:08.715982Z" }, { "registry": "pypi", "name": "scalekit-sdk-python", "version": "2.24.0", "released": "2026-11-06", "seenAt": "2026-11-07T00:03:09.578679995Z" } ], "githubStars": 9, "npmWeekly": 12745, "pypiWeekly": 8536, "securityTxt": { "url": "https://scalekit.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:08.010819477Z" }, "llmsTxt": { "url": "https://docs.scalekit.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:52.609723125Z" }, "domain": { "domain": "scalekit.com", "registered": "2003-04-24", "source": "https://rdap.verisign.com/com/v1/domain/scalekit.com", "checkedAt": "2026-11-01T14:23:27.37578957Z" }, "pages": [ { "url": "https://www.scalekit.com/product-updates", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:34:08.751363933Z", "changedAt": "2026-11-03T08:10:42.888641767Z", "fingerprint": "d638246f456c" }, { "url": "https://www.scalekit.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:34:06.731362213Z", "changedAt": "2026-11-03T08:10:41.385996458Z", "fingerprint": "53fa6d1d0325" }, { "url": "https://www.scalekit.com/legal/privacy-policy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:34:02.691637297Z", "changedAt": "2026-11-03T08:10:36.755176468Z", "fingerprint": "9dd68ba52e69" }, { "url": "https://www.scalekit.com/legal/terms-of-service", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:34:04.767942803Z", "changedAt": "2026-11-03T08:10:40.102280831Z", "fingerprint": "a2ab2e381ebf" } ], "mcpTools": { "url": "https://mcp.scalekit.com", "checkedAt": "2026-11-07T01:47:30.600493605Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:47:30.600493605Z" }, "github": { "repo": "scalekit-inc/scalekit-sdk-node", "checkedAt": "2026-11-02T09:23:49.869680098Z", "stars": 8, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T15:28:38Z", "openIssues": 2, "openPRs": 32, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 24, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-10-28T14:08:04Z" }, "replies": { "sampled": 4, "unanswered": 2, "medianDays": 167 } }, "updatedAt": "2026-11-07T18:22:00.000781669Z" } }, "edges": [ { "by": 20, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "b": "Closed platform under terms that name ScaleKit, Inc. and Delaware law (effective 1 January 2026), with MIT SDKs (15). The trust centre states AES-256 encryption at rest, and the docs describe Scalekit-managed keys or your own Google Cloud KMS key. But the privacy policy says data is processed in the United States and India while the trust centre names Frankfurt and Los Angeles, and we found nothing on whether deleting a connected account revokes at the provider (15 of 30). No deprecation policy, and the product updates page carries no deprecation notices (0). Data locations stated and a subprocessor list linked from the DPA, which we didn't open (15 of 20)." }, "scores": { "a": 86, "b": 66 } }, { "by": 14, "category": "ergonomics", "leads": "scalekit-agentkit", "name": "Agent ergonomics", "reasons": { "a": "Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.", "b": "Scoped tool lists, tool search with top_k and virtual MCP servers that expose only the tools you choose keep context small (25). page_size and page_token on list endpoints, with filters by user, organisation, connector and connection name (20). Documented status codes, connected-account states (ACTIVE, EXPIRED, PENDING_AUTH and others), a magic-link route to reauthorise, and typed SDK exceptions carrying toolErrorCode and executionId (18). No idempotency keys. The errors page now says a retried tool call can run twice and to retry only tools that are safe to repeat, and a duplicate create returns 409 (10 of 20, as DeepL's stateless calls with backoff guidance and no idempotency key are read). Official Node and Python SDKs and few required fields (15)." }, "scores": { "a": 74, "b": 88 } }, { "by": 14, "category": "security", "leads": "cloudflare-workers-oauth-provider", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.", "b": "Your backend trades a client ID and secret for a short-lived bearer token, and virtual MCP session tokens are per user with a one-hour default, but `GET /api/v1/connected_accounts/auth` returns a user's full OAuth tokens to any holder of the API credential (26). Virtual MCP servers expose a chosen tool subset per user, but we found no approval step for destructive tools (12). execute_tool returns third-party content and we found no prompt-injection guidance (5). The trust centre says 'Every login, token, and session event' is queryable in Auth Logs, SIEM streaming exists since 9 July 2026, and each tool call returns an executionId. We found no AgentKit-specific audit log (8 of 15). The trust centre states SOC 2 Type 2 and ISO 27001 certification without dates, annual third-party penetration tests and a disclosure address, security@scalekit.com. /.well-known/security.txt returns 404 and we found no bug bounty (15 of 20)." }, "scores": { "a": 80, "b": 66 } }, { "by": 10, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "b": "No x402, MPP or L402 (0). Per-call price published, $0.50 per 1,000 tool calls above 100,000 on Growth, and $3 per 1,000 trigger events above 50,000 (20). Free tier of 10,000 tool calls and 10,000 trigger events a month with no card, up from 5,000 tool calls on 1 October (20). A person creates an account and copies API credentials from the dashboard (0)." }, "scores": { "a": 50, "b": 40 } }, { "by": 7, "category": "maintenance", "leads": "cloudflare-workers-oauth-provider", "name": "Maintenance \u0026 community", "reasons": { "a": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.", "b": "scalekit-sdk-node 2.21.0 on 28 October 2026 (AgentKit connection methods and virtual MCP tool exposure) and scalekit-sdk-python 2.23.0 on 30 October (AgentKit triggers) (30). 11 Node and 8 Python SDK releases in the 90 days from 3 August (20). Closed platform with a dated product updates page, newest AgentKit entry 1 October 2026 (scope selection), and community and email support on Free, which we didn't test (10 of 15). Official Node and Python SDKs are current (15). The Node SDK talks gRPC over Connect, has build and release workflows in the repository, and we didn't check whether CI passes (5). 30+20+10+15+5 = 80." }, "scores": { "a": 87, "b": 80 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "Scalekit", "name": "Vendor" }, { "a": "no (local only)", "b": "https://{env}.scalekit.com", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "MIT (SDKs), platform closed, self-hosted on Enterprise", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-22", "b": "2026-10-30", "name": "Last release" }, { "a": "2025-09-12", "b": "2026-01-01", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-01-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.9k stars, 1.1M npm/wk", "b": "6 stars, 11k npm/wk", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Scalekit AgentKit's 72.2 (BB), and leads in 5 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics.", "question": "Which is better for AI agents, Cloudflare Workers OAuth Provider or Scalekit AgentKit?" }, { "answer": "No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Scalekit AgentKit has a hosted endpoint at https://{env}.scalekit.com.", "question": "Can an agent call Cloudflare Workers OAuth Provider and Scalekit AgentKit without installing anything?" }, { "answer": "Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Scalekit AgentKit.", "question": "Are Cloudflare Workers OAuth Provider and Scalekit AgentKit open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 80 against 66", "Payments \u0026 pricing, 50 against 40", "Maintenance \u0026 community, 87 against 80", "Transparency \u0026 trust, 86 against 66" ], "also": [ "Open source" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" }, { "aheadOn": [ "Agent ergonomics, 88 against 74" ], "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card" ], "goodFor": "A team that wants per-user third-party tokens plus a hosted tool catalogue at the lowest per-call price, with a tidy virtual MCP surface for agents.", "slug": "scalekit-agentkit", "watchFor": "No published rate-limit figure and no idempotency keys for Scalekit's own API" } ], "history": { "cloudflare-workers-oauth-provider": null, "scalekit-agentkit": [ { "causes": [ "reliability", "product" ], "date": "2026-11-01", "delta": 0.2, "from": 72, "fromGrade": "BB", "to": 72.2, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 71.9, "fromGrade": "BB", "to": 72, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.2, "from": 72.1, "fromGrade": "BB", "to": 71.9, "toGrade": "BB" } ] }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.json", "title": "Aembit vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.json", "title": "Amazon Bedrock AgentCore Identity vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.json", "title": "Arcade.dev vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.json", "title": "Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit.json", "title": "Descope Agentic Identity Hub vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.json", "title": "Keycard vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.json", "title": "Microsoft Entra Agent ID vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit.json", "title": "Nango vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.json", "title": "Scalekit AgentKit vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.json", "title": "Scalekit AgentKit vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-workos-pipes.json", "title": "Scalekit AgentKit vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-workos-pipes" } ], "panel": null, "scores": [ { "by": 2, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "reliability", "name": "Reliability", "scalekit-agentkit": 72, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 1, "cloudflare-workers-oauth-provider": 86, "edge": "scalekit-agentkit", "key": "schema", "name": "Schema \u0026 documentation", "scalekit-agentkit": 87, "weight": 13 }, { "by": 14, "cloudflare-workers-oauth-provider": 74, "edge": "scalekit-agentkit", "key": "ergonomics", "name": "Agent ergonomics", "scalekit-agentkit": 88, "weight": 13 }, { "by": 14, "cloudflare-workers-oauth-provider": 80, "edge": "cloudflare-workers-oauth-provider", "key": "security", "name": "Security \u0026 auth", "scalekit-agentkit": 66, "weight": 14 }, { "by": 10, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "scalekit-agentkit": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 7, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "name": "Maintenance \u0026 community", "scalekit-agentkit": 80, "weight": 7 }, { "by": 20, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "scalekit-agentkit": 66, "weight": 7 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Scalekit AgentKit's 72.2 (BB), and leads in 5 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "scalekit-agentkit": "600+ connectors, including remote MCP servers over OAuth 2.1 with DCR, and a free tier of 10,000 tool calls a month without a card. Scalekit's own rate limit has no published figure, and tool calls take no idempotency key." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit", "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Scalekit AgentKit's 72.2 (BB), and leads in 5 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics. Both do oauth for agents.\n\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Scalekit AgentKit: grade BB, 72.2/100, rank #136 of 1486. Markdown https://www.anchorterminal.com/tools/scalekit-agentkit.md · JSON https://www.anchorterminal.com/api/v1/tools/scalekit-agentkit.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Security \u0026 auth, 80 against 66\n- Payments \u0026 pricing, 50 against 40\n- Maintenance \u0026 community, 87 against 80\n- Transparency \u0026 trust, 86 against 66\n\nAlso in its favour:\n- Open source\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n### Scalekit AgentKit (BB)\n\nGood for: A team that wants per-user third-party tokens plus a hosted tool catalogue at the lowest per-call price, with a tidy virtual MCP surface for agents.\n\nAhead on:\n- Agent ergonomics, 88 against 74\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n\nWatch for: No published rate-limit figure and no idempotency keys for Scalekit's own API\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +20\n\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n- Scalekit AgentKit (66): Closed platform under terms that name ScaleKit, Inc. and Delaware law (effective 1 January 2026), with MIT SDKs (15). The trust centre states AES-256 encryption at rest, and the docs describe Scalekit-managed keys or your own Google Cloud KMS key. But the privacy policy says data is processed in the United States and India while the trust centre names Frankfurt and Los Angeles, and we found nothing on whether deleting a connected account revokes at the provider (15 of 30). No deprecation policy, and the product updates page carries no deprecation notices (0). Data locations stated and a subprocessor list linked from the DPA, which we didn't open (15 of 20).\n\n### Agent ergonomics: Scalekit AgentKit +14\n\n- Cloudflare Workers OAuth Provider (74): Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.\n- Scalekit AgentKit (88): Scoped tool lists, tool search with top_k and virtual MCP servers that expose only the tools you choose keep context small (25). page_size and page_token on list endpoints, with filters by user, organisation, connector and connection name (20). Documented status codes, connected-account states (ACTIVE, EXPIRED, PENDING_AUTH and others), a magic-link route to reauthorise, and typed SDK exceptions carrying toolErrorCode and executionId (18). No idempotency keys. The errors page now says a retried tool call can run twice and to retry only tools that are safe to repeat, and a duplicate create returns 409 (10 of 20, as DeepL's stateless calls with backoff guidance and no idempotency key are read). Official Node and Python SDKs and few required fields (15).\n\n### Security \u0026 auth: Cloudflare Workers OAuth Provider +14\n\n- Cloudflare Workers OAuth Provider (80): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.\n- Scalekit AgentKit (66): Your backend trades a client ID and secret for a short-lived bearer token, and virtual MCP session tokens are per user with a one-hour default, but `GET /api/v1/connected_accounts/auth` returns a user's full OAuth tokens to any holder of the API credential (26). Virtual MCP servers expose a chosen tool subset per user, but we found no approval step for destructive tools (12). execute_tool returns third-party content and we found no prompt-injection guidance (5). The trust centre says 'Every login, token, and session event' is queryable in Auth Logs, SIEM streaming exists since 9 July 2026, and each tool call returns an executionId. We found no AgentKit-specific audit log (8 of 15). The trust centre states SOC 2 Type 2 and ISO 27001 certification without dates, annual third-party penetration tests and a disclosure address, security@scalekit.com. /.well-known/security.txt returns 404 and we found no bug bounty (15 of 20).\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +10\n\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- Scalekit AgentKit (40): No x402, MPP or L402 (0). Per-call price published, $0.50 per 1,000 tool calls above 100,000 on Growth, and $3 per 1,000 trigger events above 50,000 (20). Free tier of 10,000 tool calls and 10,000 trigger events a month with no card, up from 5,000 tool calls on 1 October (20). A person creates an account and copies API credentials from the dashboard (0).\n\n### Maintenance \u0026 community: Cloudflare Workers OAuth Provider +7\n\n- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n- Scalekit AgentKit (80): scalekit-sdk-node 2.21.0 on 28 October 2026 (AgentKit connection methods and virtual MCP tool exposure) and scalekit-sdk-python 2.23.0 on 30 October (AgentKit triggers) (30). 11 Node and 8 Python SDK releases in the 90 days from 3 August (20). Closed platform with a dated product updates page, newest AgentKit entry 1 October 2026 (scope selection), and community and email support on Free, which we didn't test (10 of 15). Official Node and Python SDKs are current (15). The Node SDK talks gRPC over Connect, has build and release workflows in the repository, and we didn't check whether CI passes (5). 30+20+10+15+5 = 80.\n\n## Score by category\n\n| Category | Weight | Cloudflare Workers OAuth Provider | Scalekit AgentKit | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 74 | 72 | Cloudflare Workers OAuth Provider +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 87 | Scalekit AgentKit +1 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 88 | Scalekit AgentKit +14 |\n| Security \u0026 auth | 14% (17.5 this run) | 80 | 66 | Cloudflare Workers OAuth Provider +14 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 40 | Cloudflare Workers OAuth Provider +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 80 | Cloudflare Workers OAuth Provider +7 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 86 | 66 | Cloudflare Workers OAuth Provider +20 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **76.2 · BB** | **72.2 · BB** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Workers OAuth Provider | Scalekit AgentKit |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | Scalekit |\n| Hosted endpoint | no (local only) | `https://{env}.scalekit.com` |\n| Transports | | HTTP, Streamable HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | MIT (SDKs), platform closed, self-hosted on Enterprise |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-22 | 2026-10-30 |\n| Terms last updated | 2025-09-12 | 2026-01-01 |\n| Privacy policy last updated | no date given | 2026-01-01 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 1.9k stars, 1.1M npm/wk | 6 stars, 11k npm/wk |\n| Agent reviews | none | 2.5/5 (2) |\n\n## How the scores have moved\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n### Scalekit AgentKit\n\n- +0.2 on 1 November 2026: reliability, product\n- +0.1 on 27 October 2026: checklist\n- -0.2 on 8 October 2026: checklist\n\n## Verdicts\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n**Scalekit AgentKit.** 600+ connectors, including remote MCP servers over OAuth 2.1 with DCR, and a free tier of 10,000 tool calls a month without a card. Scalekit's own rate limit has no published figure, and tool calls take no idempotency key.\n\n## Before you call either\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n### Scalekit AgentKit\n\n1. Use the exact dashboard Connection Name, not the connector slug, in every call\n2. Call `POST /api/v1/tools:search` with top_k instead of listing every tool\n3. When a connected account isn't ACTIVE, send the user the magic link and stop until they finish\n4. On a 429, read error_code (RATE_LIMITED is Scalekit, TOOL_ERROR is the app), back off 1, 2 then 4 seconds, and log the executionId\n5. Mint a fresh virtual MCP session token per user per run and let it expire\n6. Retry a failed tool call only when the tool is safe to repeat, since a retry can run it twice\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Workers OAuth Provider or Scalekit AgentKit?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Scalekit AgentKit's 72.2 (BB), and leads in 5 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics.\n\n### Can an agent call Cloudflare Workers OAuth Provider and Scalekit AgentKit without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Workers OAuth Provider. Scalekit AgentKit has a hosted endpoint at https://{env}.scalekit.com.\n\n### Are Cloudflare Workers OAuth Provider and Scalekit AgentKit open source?\n\nCloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Scalekit AgentKit.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-workers-oauth-provider\", \"b\": \"scalekit-agentkit\"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider scalekit-agentkit`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/scalekit-agentkit.json\n\n## Other comparisons with Cloudflare Workers OAuth Provider or Scalekit AgentKit\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Aembit vs Scalekit AgentKit](https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Scalekit AgentKit](https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Scalekit AgentKit](https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n- [Descope Agentic Identity Hub vs Scalekit AgentKit](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit.md)\n- [Keycard vs Scalekit AgentKit](https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.md)\n- [Microsoft Entra Agent ID vs Scalekit AgentKit](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.md)\n- [Nango vs Scalekit AgentKit](https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit.md)\n- [Scalekit AgentKit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.md)\n- [Scalekit AgentKit vs Vercel Connect](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.md)\n- [Scalekit AgentKit vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to Scalekit AgentKit's 72.2 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare Workers OAuth Provider BB 76.2", "Scalekit AgentKit BB 72.2", "scores" ], "h1": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, "tokens": { "markdown": 4250, "slim": 2180 }, "version": 1 }