MCP authentication 2026: Composio vs Arcade, Pipedream, Nango and DIY

Summary. For per-user OAuth behind MCP tools, Composio is the cheapest managed option on published October 2026 prices, and Arcade.dev is the stronger pick when governance and self-hosting decide the deal. Composio moved new sign-ups to a new price card on 15 August 2026: Hobby is free with 100,000 tool calls a month, and Pro is $29 a month with tool calls at $0.0003 after the free 100,000, across 1,500+ toolkits. It also disclosed in May 2026 that an attacker had reached internal systems and compromised customer credentials, so read its custody model closely. Arcade's Team plan is $25 a month plus $0.01 per tool call and $0.10 per auth event; Arcade raised a $60 million Series A in June 2026, bought Smithery in August and offers VPC and air-gapped deployment on Enterprise. In our 5,000-user model (15,000 connected accounts, 200,000 calls a month), list prices come to about $30 a month on Composio, $2,175 on Arcade, $4,392 on Nango and $12,179 on Pipedream Connect, which Workday now owns. The 2026-07-28 MCP specification deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, adds RFC 9207 issuer checks and still forbids token passthrough. Smithery's connection service shuts on 31 October 2026. Pick Composio for breadth and price, Arcade for audited enterprise rollouts, Nango (ELv2) to self-host on a budget, and an identity vendor such as Auth0 or Okta when your users already sign in through it.

About this article. Specification text, prices, licences and vendor claims were checked against the MCP specification, vendor pages, documentation and filings on 22 October 2026. Vendors change pricing often, so re-check before you commit. No vendor paid for inclusion or placement. Researched with AI assistance and reviewed by our editorial team.

What changed in 2026: the spec, the price cards and the vendor list

The protocol: 2026-07-28 tightened registration and issuer checks

Authorization is optional in MCP. When an HTTP server supports it, the current 2026-07-28 specification treats the MCP server as an OAuth 2.1 resource server and the client as an OAuth 2.1 client.

• 2025-06-18 classified MCP servers as OAuth resource servers that publish Protected Resource Metadata (RFC 9728) and required clients to send Resource Indicators (RFC 8707), binding each token to one server.

• 2025-11-25 added OpenID Connect Discovery, incremental scope consent via WWW-Authenticate and Client ID Metadata Documents (CIMD) as a recommended registration method.

• 2026-07-28 deprecates Dynamic Client Registration in favour of CIMD, requires clients to check any returned iss against the expected issuer (RFC 9207, SEP-2468), requires stored credentials to be keyed by issuer (SEP-2352), and removes protocol-level sessions.

One rule has not moved. The security considerations say the token used at an upstream API is a separate token issued by that API's authorization server, and that the MCP server "MUST NOT pass through the token it received from the MCP client".

The Enterprise-Managed Authorization extension is now stable: an MCP client exchanges an enterprise SSO assertion for an Identity Assertion JWT Authorization Grant (ID-JAG) and gets a server token without user interaction. Claude's implementation launched in beta in June and became generally available on 24 August 2026, with Okta supported at launch.

The market: a repricing, two acquisitions, a breach and a shutdown

• Composio applies a new price card to sign-ups from 15 August 2026; earlier customers keep their plan until 31 December 2026. In May 2026 it disclosed an incident in which an attacker accessed internal systems and compromised customer credentials.

• Arcade.dev announced a $60 million Series A on 12 June 2026, led by SYN Ventures with strategic investment from Morgan Stanley and Wipro, bringing total funding to $72 million,[^arA] and acquired Smithery on 5 August.

• Smithery shuts its connection management services on 31 October 2026. Its server URLs, API, Connect, Toolbox, accounts, API keys, CLI and SDKs stop working; the public registry stays, powered by Arcade.

• Pipedream belongs to Workday; Workday's fiscal fourth-quarter 2026 results confirm the deal closed.

• Stytch completed its sale to Twilio on 14 November 2025, per its changelog.

• Klavis AI now sells training environments and agent data to AI labs, and documents its MCP integration API as legacy, so we drop it here.

The two auth layers in an MCP stack

Inbound auth is the MCP client proving to your server who the user is: a 401 pointing to Protected Resource Metadata, PKCE with S256, the resource parameter and audience validation. Identity providers and Cloudflare's library cover this layer.

            {
  "resource": "https://mcp.example.com/mcp",
  "authorization_servers": ["https://auth.example.com"],
  "scopes_supported": ["crm:read"],
  "bearer_methods_supported": ["header"]
}
          

Outbound auth is your server calling Gmail, Salesforce or Jira as that user. The spec only says this needs its own token. Someone still runs consent, stores and refreshes the refresh token, scopes it, revokes it and logs each call. That is what Composio, Arcade, Pipedream, Nango and Merge sell, and what Auth0 Token Vault, WorkOS Pipes and Descope sell from the identity side.

Three risks shape the design. Confused deputy: a proxy that combines a static upstream client ID, dynamic registration downstream and an upstream consent cookie can be tricked into handing a user's code to an attacker, so the Security Best Practices say MCP proxy servers must implement per-client consent. Token passthrough breaks audit trails and turns your server into an exfiltration proxy. Tool poisoning: tool descriptions are model input, so a hostile or silently changed description can steer the agent. Pin versions and review description diffs; see our prompt injection guardrails guide.

Composio

What it is. A hosted tool and auth platform: SDKs (MIT on GitHub), Sessions, 1,500+ toolkits, triggers, an MCP gateway and room for your own tools and MCP servers. OAuth consent, token storage, refresh and scopes are included on every plan.

Pricing (October 2026).

• Hobby, $0: 100,000 tool calls and 50,000 trigger events a month, 3 team members, hard-capped.

• Pro, $29 a month: includes a $29 monthly usage credit that does not roll over; past the free amounts, tool calls cost $0.0003 and trigger events $0.003. Connected accounts are unlimited and free with your own OAuth app. A DPA is self-serve.

• Composio-managed OAuth apps: only 20,000 of the free calls, then $0.0005 per call, and $0.10 once per connection beyond the first 1,000.

• Execution outside Sessions: direct calls past 10,000 a month add $0.0001 each.

• Pro add-ons: zero data retention (ZDR) +$0.0001 per call, IP allowlist +$0.0001, HIPAA BAA +$0.0003.

• Enterprise: custom, with SSO/SCIM, customer-managed keys and MSA/DPA/BAA.

Custody. In the default cloud, Composio holds the credentials, encrypted with AES-256-GCM and redacted from API responses; bringing your own OAuth app does not move the store. Private VPC, Helm-based self-hosting and customer-managed keys (AWS KMS, Google Cloud KMS, HashiCorp Vault Transit) are Enterprise arrangements. Execution logs, including request and response payloads, are kept for up to a year unless you enable ZDR, which covers tool calls but not triggers or sandbox runs. Composio Cloud runs in the United States; EU residency means self-hosting.

The May 2026 incident. Composio says an attacker reached internal systems through internal tooling and malicious tool definitions. The connections it reported as leaked were about 0.3% of active connections, including 5,001 GitHub connections, and it separately flagged 5,241 API keys as potentially exposed, then deleted every API key created before 22 May. Its credential APIs no longer return connected-account tokens, it moved to envelope encryption with an independently rotated key, and external firms reviewed the response.

Company. Composio states SOC 2 Type II and an ISO 27001:2022 certification. Its last announced round is a $25 million Series A led by Lightspeed in July 2025; we found none in 2026.

Best for wide coverage at a very low per-call price. Watch default custody, payload retention and the incident follow-up in your security review.

Arcade.dev

What it is. An actions runtime for agents: auth, tools and governance in one MCP layer. The product page lists 8,000+ tools across 80+ toolkits, an MCP gateway that federates Arcade-hosted, custom and third-party servers, and pre- and post-call policy hooks. The MIT-licensed arcade-mcp framework, whose README counts 7,500+ tools across 81 MCP servers, lets a tool declare requires_auth=GitHub(scopes=["repo"]); Arcade runs the OAuth challenge, refreshes the token and injects it per call, so neither the client nor the model sees it.

Pricing:

• Free, $0: 2,000 auth events and 2,000 tool calls a month.

• Team, $25 a month plus usage: auth events $0.10 each and tool calls $0.01 each, with no included allowance. Arcade does not publish a definition of an auth event, so ask whether token refreshes count.

• Enterprise, custom: annual bundles, discounted rates, deployment in Arcade Cloud, your VPC or fully air-gapped, SSO, RBAC and audit logs.

Governance. Each call records the agent, the user, the scope and the policy decision, streamed to a SIEM over OpenTelemetry. Arcade announced SOC 2 Type 2 in August 2025. It says it authored the MCP authorization specification, a vendor statement. Its October 2026 Tool Recommendation feature claims up to 91% fewer tool-definition tokens in a modelled session; in Arcade's measured runs, total input tokens fell 17% to 36%.

Best for enterprises that need per-action authorisation, exportable audit and private deployment, and teams leaving Smithery. Watch a list per-call rate about 33 times Composio's.

Alternative approaches

Pipedream Connect (Workday)

Managed auth for 3,000+ APIs, 10,000+ tools and triggers, MCP servers and a proxy. Free is development-only. Startup is $99 a month billed annually ($150 monthly) with 100 external users, then $2 per user, and 10,000 credits, then $0.012 each; a credit covers up to 30 seconds of compute. Business adds SSO, SCIM, HIPAA and static egress IPs on an annual contract. SOC 2 Type 2 and GDPR apply to all plans. The component registry uses Pipedream's source-available licence, which excludes commercial use of that code. Per-user pricing hurts at consumer scale.

Nango

Auth for 1,000+ APIs, 10,000+ tools, triggers and syncs, and an MCP server, under the Elastic License 2.0: source-available, so you may self-host it but not offer it as a managed service. Free caps at 10 connections, 10 compute hours and 10 GB; Pay-as-you-go is $50 a month including $50 of credit, then $0.29 per connection, $0.72 per compute hour and $0.50 per GB. Enterprise adds full self-hosting and BYOC in any AWS, Google Cloud or Azure region. There is no EU cloud yet, and SOC 2 Type II is listed.

Merge Agent Handler

A remote MCP server over maintained connectors. Free gives 2,000 credits; Pro is $1,000 a month for 25,000 credits plus 2,000 bonus credits, with tiers to 100,000. One credit equals one tools/call, failed and blocked calls included; the overage rate is not published. Data sits in AWS US-East, logs are kept 90 days by default, and one API call erases a user; Enterprise adds single-tenant, EU or APAC residency, and on-prem. Its security gateway can redact or block sensitive data in tool inputs, while responses can only be blocked or logged.

Identity vendors

• Auth0 for AI Agents reached GA on 19 November 2025, with Token Vault storing and refreshing third-party tokens. Auth0's pricing page lists 2 Token Vault connections on Free (25,000 MAU) and 3 plus an add-on on Essentials (from $35 a month) and Professional (from $240); Auth for MCP is included on Free.

• Okta Cross App Access implements ID-JAG and underpins Enterprise-Managed Authorization; Okta's docs rule it out for autonomous agents that run without an active user session.

• WorkOS sells MCP Auth through AuthKit, free up to 1 million users; Pipes covers 300+ integrations over MCP with credentials in WorkOS Vault, and its price is not published.

• Descope bills outbound tokens as monthly active tokens (MATKs): Free includes 2,000 with no overage; Pro starts at $249 a month billed annually with 5,000, and extras cost $0.05. A HIPAA BAA starts on Growth.

• Stytch (Twilio) began advertising RFC 9207 issuer support in its Connected Apps authorization server metadata in September 2026.

Cloudflare workers-oauth-provider

An MIT library that implements the provider side of OAuth 2.1 on Workers, usable with Cloudflare Access, a third-party provider, your own OAuth provider such as Auth0, Stytch or WorkOS, or a self-contained flow. Your Worker issues its own MCP token bound to the upstream one. It covers inbound auth only; see our Cloudflare Agents SDK guide.

Build it yourself

You need an authorization server, a KMS-backed token vault, a refresh worker that serialises refreshes per account, one OAuth app per provider plus its review, a consent UI, revocation and erasure APIs, an audit log and the tool wrappers. It suits fewer than about ten providers and data that must stay in your VPC.

Head-to-head comparison

Commercial terms (published, October 2026)

Security and deployment

Decision table

Worked cost example: 5,000 users, 3 apps each

Assumptions (ours). 5,000 active users each connecting 3 apps (15,000 accounts). Base case 40 tool calls per user per month (200,000); heavy case 400 (2,000,000). Own OAuth apps, Composio Sessions, about 1 second of billed compute and 20 KB of egress per call, and 10% of accounts re-authorising monthly (1,500 Arcade auth events). List prices only.

Merge is excluded: 200,000 calls exceed its largest published tier and overage is unpublished. In the onboarding month Arcade sees 15,000 initial auth events instead of 1,500, adding $1,350. If Composio calls run outside Sessions, add $0.0001 per call past 10,000.

Build it yourself (eCorpIT planning assumptions, not a quote). About 4 engineer-months to build, then half an engineer plus roughly $300 a month of infrastructure. At an assumed loaded $6,000 per engineer-month (India-based team) that is $24,000 up front and $3,300 a month; at $16,000 (US-based) it is $64,000 and $8,300.

Twelve months, base case: Composio about $360; Descope about $8,988 plus your tool layer; Arcade about $27,450; Nango about $52,704; build in India about $63,600; Pipedream about $146,148; build in the US about $163,600.

Composio's new card makes metered cost close to irrelevant at B2B volumes, so custody, retention and security review decide. Arcade scales with calls, Nango with connections, Pipedream with both. At Arcade-level volume, negotiate Enterprise bundles first.

India, DPDP, EU and US notes

The DPDP Rules were notified on 13 November 2025 and announced by PIB the next day; most obligations, including Rules 3, 7, 13 and 14, apply from about May 2027. A stored refresh token is a key to a user's personal data, and tool results usually contain personal data. You are the Data Fiduciary and the vendor is your processor. The Rules require consent notices that stand on their own, plain-language breach notices to affected people, a published grievance-response period of no more than 90 days, and let the government bar Significant Data Fiduciaries from moving specified data out of India.

• Retention: Composio keeps payloads up to a year by default, so enable ZDR; Merge defaults to 90 days.

• Erasure: demand one API call that deletes a user's tokens and history. Merge documents one.

• Location: none of the vendor pages we checked advertises an India region. Data that must stay in India points to Arcade or Composio self-hosted on Enterprise terms, Nango BYOC in an Indian cloud region, or your own build.

• EU: Composio's DPA is self-serve on Pro but its cloud runs in the US; Merge sells EU residency; Nango offers BYOC.

• US healthcare: BAAs are an add-on on Composio Pro and offered by Pipedream (Business) and Descope (Growth); ask Nango and Arcade.

For agent identity more broadly, see our guides to AI agent identity governance, MCP vs A2A and Copilot MCP allowlists.

Implementation checklist

1. Serve Protected Resource Metadata, return precise scope challenges and validate the audience on every request.

1. Support CIMD; keep Dynamic Client Registration only for older authorization servers.

1. Validate iss and key client credentials by issuer.

1. Never forward inbound tokens upstream; add per-client consent to any OAuth proxy.

1. Register your own OAuth apps so consent screens show your brand and you can switch vendors.

1. Pin tool versions and review description changes before release.

1. Enable payload minimisation, build one-call erasure and drill revocation.

1. Move off Smithery-hosted URLs before 31 October 2026.

Agents that also drive browsers or frameworks need the same token discipline; see our comparisons of cloud browsers for AI agents and AI agent frameworks.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our MCP server development and integration service designs and builds MCP servers and the auth layers behind them: inbound OAuth 2.1 to the 2026-07-28 specification, outbound token brokering through Composio, Arcade, Nango or a self-hosted vault, and the audit and erasure paths a DPDP review asks for. Talk to us at /contact-us/.

Last updated: 22 October 2026.

References

1. Pricing — Composio

1. Composio May 2026 security incident — Composio

1. Pricing — Arcade.dev

1. Authorization (2026-07-28) — Model Context Protocol

1. Key changes, 2025-06-18 — Model Context Protocol

1. Key changes, 2025-11-25 — Model Context Protocol

1. Key changes, 2026-07-28 — Model Context Protocol

1. Authorization security considerations — Model Context Protocol

1. Enterprise-Managed Authorization extension — Model Context Protocol on GitHub

1. Centrally manage authorization for MCP connectors — Claude

1. Smithery joins Arcade — Arcade.dev

1. The future of Smithery — Smithery

1. Workday fiscal 2026 fourth quarter results, Exhibit 99.1 — US Securities and Exchange Commission

1. Changelog — Stytch

1. Klavis AI homepage — Klavis AI

1. Security best practices — Model Context Protocol

1. Token custody architecture — Composio documentation

1. Data retention and handling — Composio documentation

1. Two questions every security review asks us — Composio

1. Enterprise — Composio

1. Product — Arcade.dev

1. arcade-mcp repository — GitHub

1. SOC 2 Type 2 compliance — Arcade.dev

1. Tool Recommendation — Arcade.dev

1. Pricing — Pipedream

1. Pipedream LICENSE — GitHub

1. Nango repository (Elastic License 2.0) — GitHub

1. Pricing — Nango

1. Agent Handler pricing — Merge

1. Agent Handler FAQ — Merge documentation

1. Security Gateway — Merge documentation

1. Auth0 for AI Agents is now generally available — Auth0

1. Pricing — Auth0

1. Cross App Access — Okta Developer

1. Pipes — WorkOS

1. Pricing — Descope

1. MCP authorization — Cloudflare Agents documentation

1. DPDP Rules, 2025 notified — Press Information Bureau

1. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) — Gazette of India