{ "data": { "a": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Vercel Connect's 70.8 (BB), and leads in 5 of 7 scored categories.", "b": { "slug": "vercel-connect", "name": "Vercel Connect", "vendor": "Vercel Inc.", "vendorUrl": "https://vercel.com", "kind": "http-api", "category": "agent-auth", "summary": "Vercel Connect is a credential broker for apps and agents. Code asks it for a short-lived, scoped token for Slack, GitHub, Microsoft, Linear, Snowflake or any OAuth, API-key or MCP service, as the app or for a user.", "url": "https://www.anchorterminal.com/tools/vercel-connect", "markdownUrl": "https://www.anchorterminal.com/tools/vercel-connect.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/vercel-connect.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/vercel-connect.json", "dns": "vercel-connect.grade.anchorterminal.com", "repo": "https://github.com/vercel/vercel", "license": "Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://api.vercel.com", "packages": [ { "registry": "npm", "name": "@vercel/connect" } ], "auth": "mixed", "authNotes": "Access is self-serve with a Vercel account, on every plan. A deployment calls Connect with its project OIDC token (`VERCEL_OIDC_TOKEN`), which Connect checks against the connector's project links and their environments. Locally, `vercel env pull` writes a development OIDC token that lasts about 12 hours. Outside Vercel, a Vercel access token goes in `vercelToken`, and it can request only the app subject or its own user. Connect then holds the provider side. Vercel registers the OAuth client for managed connectors (Slack, GitHub, Linear, Microsoft, Snowflake, Salesforce), and the customer supplies a client or an API key for the others. End users consent in a browser at a URL from `startAuthorization`.", "pricing": "freemium", "pricingNotes": "Billed per token request and per trigger. Hobby includes 500 token requests and 1,000 triggers a month at no extra charge, and Vercel's fair use guidelines limit Hobby to non-commercial, personal use. Pro is $3.00 per 1,000 token requests and $0.95 per 1,000 triggers on top of the plan. Enterprise is negotiated. A trigger is counted once per destination, and once per event when no destination is set. MCP Events deliveries (public beta) are billed as triggers, one per delivery forwarded. The SDK's in-process cache means many provider calls in one invocation cost one token request (https://vercel.com/docs/connect/pricing, checked 2026-10-17).", "priceSummary": "$3 / 1k req", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Connect docs, the pricing page or the Connect operations of the OpenAPI document (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16354, "npmWeekly": 738165, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://vercel.com/docs/connect", "llmsTxt": "https://vercel.com/llms.txt", "openapi": "https://openapi.vercel.sh/", "capabilities": [ "auth.tokens", "auth.oauth", "auth.consent", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "oidc", "openapi", "llms-txt", "typescript", "cli", "webhooks", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-10-31", "graded": true, "anchor": { "graded": true, "score": 70.8, "grade": "BB", "agentReady": true, "rank": 185, "ranked": true, "rankOf": 1486, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 81, "payments": 40, "reliability": 73, "schema": 84, "security": 83, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "April 2026. Vercel's security bulletin says an attacker took over an employee's account through a compromised third-party AI tool (Context.ai), reached internal systems and decrypted non-sensitive environment variables of a limited subset of customers, and a later review found a small number of further affected accounts. Vercel closed the incident on 16 October 2026 with all remediation complete. It predates Connect's general availability on 25 August 2026, but it reached customer secrets on the platform where Connect now keeps provider refresh tokens. A fixed and documented incident about six months old, so 3 of a possible 15 is taken. vercel-sandbox takes the same 3 for the same bulletin from 17 October (https://vercel.com/kb/bulletin/vercel-april-2026-security-incident)." ], "verdict": "Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, Connect had elevated errors for some customers on 10 and 18 September 2026, and the only SDK is TypeScript.", "bestFor": "Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets, and providers behind IP allowlists through Secure Compute.", "strengths": [ "Refresh tokens stay on Vercel's infrastructure. Code receives only short-lived access tokens, as the app or for a named user", "A deployment authenticates with its project OIDC token, checked against per-environment project links, so no provider secret sits in environment variables", "Public OpenAPI 3.0.3 document covers 14 Connect paths, including `/v1/connect/token/{connector}` and `/v1/connect/authorize/{connector}`", "Token requests, completed authorisations and revocations are logged with `tokenId` and `authorizationId`, and can be sent to a drain on Pro and Enterprise", "Rate limits are published with numbers, 200 reads and 50 writes a minute per team" ], "weaknesses": [ "Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment", "Elevated Connect errors for some customers for 94 minutes on 10 September 2026, marked major, and again on 18 September, per the status page", "Event history is kept 12 hours on Hobby and 3 days on Pro. Connector audit logs and 30 days need Enterprise", "Revocation depends on the provider. Without a revocation endpoint the provider credential can work until it expires", "The SDK is TypeScript only, and the public repository's copy (2.5.6, synced 27 October 2026) lags npm's 2.7.0" ], "agentNotes": [ "Call `getToken` at request time and don't store the result. The SDK caches up to 100 tokens in process and refreshes them 30 seconds before expiry", "Pass `scopes` on every request. Since SDK 1.0.0 an omitted `scopes` defaults to `['*']`, the connector's default scopes", "Catch `UserAuthorizationRequiredError`, call `startAuthorization` and send the user to the returned URL. Consent needs a person in a browser", "Outside Vercel, pass a Vercel access token as `vercelToken`. It can request only the app subject or its own user, not another user", "On a 429 wait one minute for the window to reset. Limits are 200 token requests a minute per team" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.8 } ], "editorialScores": { "ergonomics": 75, "maintenance": 81, "payments": 40, "reliability": 73, "schema": 84, "security": 83, "transparency": 55 }, "provenanceScore": 99, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pnpm add @vercel/connect", "http": "curl -X POST https://api.vercel.com/v1/connect/token/slack%2Facme-slack \\\n -H \"Authorization: Bearer $VERCEL_OIDC_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"subject\":{\"type\":\"app\"},\"scopes\":[\"chat:write\"]}'" }, "letme": { "capability": "https://letme.dev/auth.tokens", "tool": "https://letme.dev/vercel-connect" }, "sameCompany": [ "vercel-ai-gateway", "vercel-sandbox" ], "area": "agent-runtime", "unitPrices": [ { "item": "Token request (Pro)", "unit": "1k-requests", "usd": 3, "note": "Hobby includes 500 a month. Enterprise negotiated" }, { "item": "Trigger, a forwarded provider webhook (Pro)", "unit": "1k-requests", "usd": 0.95, "note": "Counted per destination. Hobby includes 1,000 a month" } ], "provenance": { "legalEntity": "Vercel Inc.", "domain": "vercel.com", "domainRegistered": "1999-10-04", "endpointOnVendorDomain": true, "terms": "https://vercel.com/legal/terms", "privacy": "https://vercel.com/legal/privacy-policy", "statusPage": "https://www.vercel-status.com", "changelog": "https://vercel.com/changelog", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "The Terms of Service (last updated 19 October 2026, read on 1 November 2026) name Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, and California law. The DPA calls Vercel Inc. a Delaware corporation.", "Connect's product terms moved into Vercel's Service Terms (last updated 15 October 2026); https://vercel.com/docs/connect/legal now redirects to https://vercel.com/legal/service-terms#connect.", "The privacy URL redirects to https://vercel.com/legal/privacy-notice, last updated 1 June 2026, which says it does not apply to personal information Vercel processes as a processor for customers, which the DPA covers. The DPA (effective 31 March 2026) applies to Pro and Enterprise plans.", "https://vercel.com/.well-known/security.txt points to HackerOne and responsible.disclosure@vercel.com and expires 2027-09-28, re-read on 1 November 2026.", "RDAP gives vercel.com a registration date of 1999-10-04, long before Vercel, so the domain was bought later.", "The API answers at api.vercel.com and the OpenAPI document at openapi.vercel.sh." ], "score": 99 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/vercel-connect.json", "live": { "slug": "vercel-connect", "probe": { "target": "https://api.vercel.com", "method": "get", "lastAt": "2026-11-07T18:21:03.446816659Z", "lastOk": true, "lastStatus": 200, "lastMs": 460, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 176, "p95ms24h": 668, "samples24h": 239, "samples30d": 7289, "days": [ { "date": "2026-10-09", "probes": 169, "ok": 169 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://www.vercel-status.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:22:07.367032331Z" }, "versions": [ { "registry": "github", "name": "vercel/vercel", "version": "@vercel/static-build@2.11.13", "released": "2026-07-30", "seenAt": "2026-11-07T00:15:09.468441919Z" }, { "registry": "npm", "name": "@vercel/connect", "version": "2.9.0", "seenAt": "2026-11-07T00:15:08.567893263Z" } ], "githubStars": 16540, "npmWeekly": 1381727, "securityTxt": { "url": "https://vercel.com/.well-known/security.txt", "state": "valid", "expires": "2027-09-28T12:00:00.000Z", "checkedAt": "2026-11-07T16:01:04.63743298Z" }, "llmsTxt": { "url": "https://vercel.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:17.894797078Z" }, "domain": { "domain": "vercel.com", "registered": "1999-10-04", "source": "https://rdap.verisign.com/com/v1/domain/vercel.com", "checkedAt": "2026-11-01T14:26:56.031194695Z" }, "pages": [ { "url": "https://vercel.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-16T22:33:02.411577324Z", "changedAt": "2026-10-16T22:33:02.411577324Z", "fingerprint": "1bf6c6d68534" }, { "url": "https://vercel.com/docs/connect/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:23:27.145426823Z", "changedAt": "2026-11-06T13:44:47.643226098Z", "fingerprint": "4add42753265" }, { "url": "https://vercel.com/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-16T22:33:09.129654005Z", "changedAt": "2026-10-06T16:13:29.92763016Z", "fingerprint": "7ab1f9d3393a" }, { "url": "https://vercel.com/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-16T22:33:10.564262216Z", "changedAt": "2026-10-06T16:13:31.349375221Z", "fingerprint": "35995712008a" } ], "github": { "repo": "vercel/vercel", "checkedAt": "2026-11-02T09:35:48.288168481Z", "stars": 16498, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T04:14:38Z", "openIssues": 363, "openPRs": 492, "issuesOpened90d": 97, "issuesClosed90d": 56, "prsMerged90d": 3, "ci": { "branch": "main", "runs": 50, "success": 16, "failure": 34, "other": 0, "latest": "failure", "latestAt": "2026-08-19T23:02:37Z" }, "advisories": [ { "ghsa": "GHSA-7wjf-49rm-77gx", "severity": "high", "published": "2026-08-28T20:11:19Z" }, { "ghsa": "GHSA-pgf8-2hgj-grqg", "cve": "CVE-2026-44479", "severity": "medium", "published": "2026-04-30T13:43:32Z" } ], "replies": { "sampled": 25, "unanswered": 25 } }, "updatedAt": "2026-11-07T18:22:07.367032331Z" } }, "edges": [ { "by": 10, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "b": "No x402, MPP or L402 (0). Unit prices are public without a login, re-read on 1 November 2026, $3.00 per 1,000 token requests and $0.95 per 1,000 triggers on Pro, and MCP Events deliveries are billed as triggers (20). Hobby includes 500 token requests and 1,000 triggers a month at no charge, for non-commercial use. The Hobby plan page, read on 17 October, calls the plan free with no billing cycles and asks for card details only when upgrading to Pro (20). A person signs up in a browser, and connectors and user consent also pass through a browser (0)." }, "scores": { "a": 50, "b": 40 } }, { "by": 9, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "b": "Closed service under the Terms of Service last updated 19 October 2026, with the Connect product terms now in Vercel's Service Terms (last updated 15 October 2026), and an Apache-2.0 SDK and CLI (20). A privacy notice (last updated 1 June 2026) and a DPA exist. The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise only and has customer data deleted within a commercially reasonable time after termination. The docs say refresh tokens are stored on Vercel's infrastructure and give event retention by plan. We found no retention period or encryption statement for stored provider credentials (18). No deprecation policy found. The Service Terms still let Vercel \"add or remove Third Party Platforms to Vercel Connect without notice\", though the beta price change was announced with a date of 25 September 2026 (5). The DPA points to a subprocessor list on security.vercel.com and says primary processing is in the United States. We saw the list's page but could not read its entries (12)." }, "scores": { "a": 86, "b": 77 } }, { "by": 6, "category": "maintenance", "leads": "cloudflare-workers-oauth-provider", "name": "Maintenance \u0026 community", "reasons": { "a": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.", "b": "`@vercel/connect` 2.7.0 was published on 31 October 2026, per npm's search API (30). The Vercel changelog has Connect entries on 11 and 25 August, 11, 21, 24 and 29 September, three on 15 October, and on 23, 26 and 29 October 2026 (managed Stripe API keys, service discovery in the CLI, webhook triggers for five more providers) (20). Closed service with a dated public changelog. The public copy of the SDK in vercel/vercel was synced from Vercel's internal repository on 27 October at 2.5.6, behind npm, and we didn't read issue replies (10). One current official SDK (15). One runtime dependency (`@vercel/oidc` 4.0.5 at 2.7.0) and a test folder in the package. We didn't confirm CI status on the default branch (6)." }, "scores": { "a": 87, "b": 81 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "Vercel Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.vercel.com", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-22", "b": "2026-10-31", "name": "Last release" }, { "a": "2025-09-12", "b": "2026-06-01", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-06-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.9k stars, 1.1M npm/wk", "b": "16k stars, 738k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Vercel Connect's 70.8 (BB), and leads in 5 of 7 scored categories.", "question": "Which is better for AI agents, Cloudflare Workers OAuth Provider or Vercel Connect?" }, { "answer": "No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Vercel Connect has a hosted endpoint at https://api.vercel.com.", "question": "Can an agent call Cloudflare Workers OAuth Provider and Vercel Connect without installing anything?" }, { "answer": "Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Vercel Connect.", "question": "Are Cloudflare Workers OAuth Provider and Vercel Connect open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 50 against 40", "Maintenance \u0026 community, 87 against 81", "Transparency \u0026 trust, 86 against 77" ], "also": [ "Open source", "No incidents deducted, where Vercel Connect loses 3 points for them" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" }, { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets, and providers behind IP allowlists through Secure Compute.", "slug": "vercel-connect", "watchFor": "Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment" } ], "history": { "cloudflare-workers-oauth-provider": null, "vercel-connect": [ { "causes": [ "correction" ], "date": "2026-11-01", "delta": 2, "from": 68.8, "fromGrade": "B", "to": 70.8, "toGrade": "BB" } ] }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.json", "title": "Aembit vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.json", "title": "Amazon Bedrock AgentCore Identity vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.json", "title": "Arcade.dev vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.json", "title": "Auth0 for AI Agents (Token Vault) vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.json", "title": "Descope Agentic Identity Hub vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.json", "title": "Keycard vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.json", "title": "Microsoft Entra Agent ID vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-vercel-connect.json", "title": "Nango vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/nango-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.json", "title": "Scalekit AgentKit vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.json", "title": "Stytch Connected Apps vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.json", "title": "Vercel Connect vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes" } ], "panel": null, "scores": [ { "by": 1, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "reliability", "name": "Reliability", "vercel-connect": 73, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 2, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "schema", "name": "Schema \u0026 documentation", "vercel-connect": 84, "weight": 13 }, { "by": 1, "cloudflare-workers-oauth-provider": 74, "edge": "vercel-connect", "key": "ergonomics", "name": "Agent ergonomics", "vercel-connect": 75, "weight": 13 }, { "by": 3, "cloudflare-workers-oauth-provider": 80, "edge": "vercel-connect", "key": "security", "name": "Security \u0026 auth", "vercel-connect": 83, "weight": 14 }, { "by": 10, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "vercel-connect": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "name": "Maintenance \u0026 community", "vercel-connect": 81, "weight": 7 }, { "by": 9, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "vercel-connect": 77, "weight": 7 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Vercel Connect's 70.8 (BB), and leads in 5 of 7 scored categories. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "vercel-connect": "Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, Connect had elevated errors for some customers on 10 and 18 September 2026, and the only SDK is TypeScript." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect", "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Vercel Connect's 70.8 (BB), and leads in 5 of 7 scored categories. Both do oauth for agents.\n\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Vercel Connect: grade BB, 70.8/100, rank #185 of 1486. Markdown https://www.anchorterminal.com/tools/vercel-connect.md · JSON https://www.anchorterminal.com/api/v1/tools/vercel-connect.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Payments \u0026 pricing, 50 against 40\n- Maintenance \u0026 community, 87 against 81\n- Transparency \u0026 trust, 86 against 77\n\nAlso in its favour:\n- Open source\n- No incidents deducted, where Vercel Connect loses 3 points for them\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n### Vercel Connect (BB)\n\nGood for: Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets, and providers behind IP allowlists through Secure Compute.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +10\n\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- Vercel Connect (40): No x402, MPP or L402 (0). Unit prices are public without a login, re-read on 1 November 2026, $3.00 per 1,000 token requests and $0.95 per 1,000 triggers on Pro, and MCP Events deliveries are billed as triggers (20). Hobby includes 500 token requests and 1,000 triggers a month at no charge, for non-commercial use. The Hobby plan page, read on 17 October, calls the plan free with no billing cycles and asks for card details only when upgrading to Pro (20). A person signs up in a browser, and connectors and user consent also pass through a browser (0).\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +9\n\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n- Vercel Connect (77): Closed service under the Terms of Service last updated 19 October 2026, with the Connect product terms now in Vercel's Service Terms (last updated 15 October 2026), and an Apache-2.0 SDK and CLI (20). A privacy notice (last updated 1 June 2026) and a DPA exist. The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise only and has customer data deleted within a commercially reasonable time after termination. The docs say refresh tokens are stored on Vercel's infrastructure and give event retention by plan. We found no retention period or encryption statement for stored provider credentials (18). No deprecation policy found. The Service Terms still let Vercel \"add or remove Third Party Platforms to Vercel Connect without notice\", though the beta price change was announced with a date of 25 September 2026 (5). The DPA points to a subprocessor list on security.vercel.com and says primary processing is in the United States. We saw the list's page but could not read its entries (12).\n\n### Maintenance \u0026 community: Cloudflare Workers OAuth Provider +6\n\n- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n- Vercel Connect (81): `@vercel/connect` 2.7.0 was published on 31 October 2026, per npm's search API (30). The Vercel changelog has Connect entries on 11 and 25 August, 11, 21, 24 and 29 September, three on 15 October, and on 23, 26 and 29 October 2026 (managed Stripe API keys, service discovery in the CLI, webhook triggers for five more providers) (20). Closed service with a dated public changelog. The public copy of the SDK in vercel/vercel was synced from Vercel's internal repository on 27 October at 2.5.6, behind npm, and we didn't read issue replies (10). One current official SDK (15). One runtime dependency (`@vercel/oidc` 4.0.5 at 2.7.0) and a test folder in the package. We didn't confirm CI status on the default branch (6).\n\n## Score by category\n\n| Category | Weight | Cloudflare Workers OAuth Provider | Vercel Connect | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 74 | 73 | Cloudflare Workers OAuth Provider +1 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 84 | Cloudflare Workers OAuth Provider +2 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 75 | Vercel Connect +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 80 | 83 | Vercel Connect +3 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 40 | Cloudflare Workers OAuth Provider +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 81 | Cloudflare Workers OAuth Provider +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 86 | 77 | Cloudflare Workers OAuth Provider +9 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **76.2 · BB** | **70.8 · BB** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Workers OAuth Provider | Vercel Connect |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | Vercel Inc. |\n| Hosted endpoint | no (local only) | `https://api.vercel.com` |\n| Transports | | HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-22 | 2026-10-31 |\n| Terms last updated | 2025-09-12 | 2026-06-01 |\n| Privacy policy last updated | no date given | 2026-06-01 |\n| Customer content may train models | not found in the text | yes, with an opt-out |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 1.9k stars, 1.1M npm/wk | 16k stars, 738k npm/wk |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n### Vercel Connect\n\n- +2.0 on 1 November 2026 (B to BB): correction\n\n## Verdicts\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n**Vercel Connect.** Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, Connect had elevated errors for some customers on 10 and 18 September 2026, and the only SDK is TypeScript.\n\n## Before you call either\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n### Vercel Connect\n\n1. Call `getToken` at request time and don't store the result. The SDK caches up to 100 tokens in process and refreshes them 30 seconds before expiry\n2. Pass `scopes` on every request. Since SDK 1.0.0 an omitted `scopes` defaults to `['*']`, the connector's default scopes\n3. Catch `UserAuthorizationRequiredError`, call `startAuthorization` and send the user to the returned URL. Consent needs a person in a browser\n4. Outside Vercel, pass a Vercel access token as `vercelToken`. It can request only the app subject or its own user, not another user\n5. On a 429 wait one minute for the window to reset. Limits are 200 token requests a minute per team\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Workers OAuth Provider or Vercel Connect?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Vercel Connect's 70.8 (BB), and leads in 5 of 7 scored categories.\n\n### Can an agent call Cloudflare Workers OAuth Provider and Vercel Connect without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Workers OAuth Provider. Vercel Connect has a hosted endpoint at https://api.vercel.com.\n\n### Are Cloudflare Workers OAuth Provider and Vercel Connect open source?\n\nCloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Vercel Connect.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-workers-oauth-provider\", \"b\": \"vercel-connect\"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider vercel-connect`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/vercel-connect.json\n\n## Other comparisons with Cloudflare Workers OAuth Provider or Vercel Connect\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Aembit vs Vercel Connect](https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Vercel Connect](https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Vercel Connect](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n- [Descope Agentic Identity Hub vs Vercel Connect](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.md)\n- [Keycard vs Vercel Connect](https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.md)\n- [Microsoft Entra Agent ID vs Vercel Connect](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.md)\n- [Nango vs Vercel Connect](https://www.anchorterminal.com/compare/nango-vs-vercel-connect.md)\n- [Scalekit AgentKit vs Vercel Connect](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.md)\n- [Stytch Connected Apps vs Vercel Connect](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.md)\n- [Vercel Connect vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to Vercel Connect's 70.8 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare Workers OAuth Provider BB 76.2", "Vercel Connect BB 70.8", "scores" ], "h1": "Cloudflare Workers OAuth Provider vs Vercel Connect", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-workers-oauth-provider-vs-vercel-connect", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, "tokens": { "markdown": 3700, "slim": 1630 }, "version": 1 }