Composio Alternatives for AI App Integrations

TL;DR

Composio wins on catalog size, and that's exactly why some teams end up looking past it. On 2026-10-29 its homepage advertised "1,500+ apps", its toolkit directory paginated "1–30 of 1540", and its site described "20,000+ tools via MCP or direct APIs" — which solves the problem of reaching a long tail of applications fast. It doesn't, by itself, answer a narrower question a security review always ends up asking: this agent, acting for this specific person, doing this specific action, allowed or not?

That second question is what sends teams shopping for alternatives, and it's the axis this list ranks on. Nine platforms plus Composio itself, judged on authentication, agent identity, per-user authority, action-level permission, and what record survives a denied attempt.

We're not arguing catalog size doesn't matter. A platform that can't reach the application you need is out of the running regardless of how well it governs the ones it does reach. We're arguing it's a different axis from control, and most platforms, including Composio, are stronger on one than the other.

We rank ourselves first, and we're upfront about that. We give no product a score, and nothing on this page is independent. Every competitor figure below is dated and linked, so check it before it becomes part of a decision. And there is a third answer this page takes seriously: for a narrow integration against one or two stable APIs, calling the provider directly is often the right call, and we say where below.

Overview

Composio has built a substantial platform for connecting AI agents to external tools. On 2026-10-29 its homepage advertised "1,500+ apps", its directory paginated "1–30 of 1540" and the site described "20,000+ tools via MCP or direct APIs", with just-in-time tool loading, managed OAuth, SOC 2 Type II and the claim that "Every action is recorded." For a team whose main constraint is reaching a long tail of applications quickly, it's a strong default. Its own docs are clear about the thing a pricing page won't tell you: managed authentication is for "Development/Testing", and production needs "your own OAuth credentials from the toolkit's developer portal."

The teams that do look past it usually aren't unhappy with the catalog. Giving an agent Gmail is one decision. Deciding whether that agent may read a message, draft a reply, send an external email or delete data is a separate one, and it's the decision a security review actually asks about. So the platforms worth comparing against Composio aren't competing on connector count anymore. They compete on authentication, authorization, MCP infrastructure, credential handling, execution control and audit.

This is a ranked look at ten alternatives and what each is genuinely best at. A broader ranking of the whole category, Composio included, is in 10 Best AI Agent Integration Platforms.

Best Composio Alternatives at a Glance

Every figure in this table and in the entries below was re-checked against the vendor's own page on 2026-10-29 and is linked in Sources. Catalog numbers in this market change monthly, and six of the ten moved between our August and October readings — StackOne, Zapier, Workato, Truto, Composio and Nango all publish different numbers now. Confirm them before they become part of a decision.

Why Teams Look for a Composio Alternative

Evaluation usually starts with one question: does it have the integration I need? That is the easy one. Production deployments raise a harder set:

• Can every agent have its own identity, separate from the humans it serves?
• Can the platform identify the person the agent is acting for on a given call?
• Can effective access differ per user for the same shared agent?
• Can permissions be set per action rather than per application?
• Can credentials stay out of the agent's runtime and context window?
• Can unauthorized tools be hidden entirely, not just refused when called?
• Can every attempt, including refused ones, be traced afterward?
• Can internal APIs, databases and private systems sit behind the same controls?
• Can governance span MCP and non-MCP integrations equally?

Connector breadth answers the first question; these answer the harder set. Both are real requirements, and most platforms are noticeably stronger at one than the other.

out of the running -> yes -> agent identity / per-user authority / action-level permission / credentials / audit? -> weak --> watch it closely in production -> strong --> candidate for sensitive systems -->

Figure 1 — Connector breadth is the first filter and the easy one. The harder filter is what happens once the agent can actually use what it's connected to.

The Alternatives

1. Agentic Fabriq: governed agent integrations

Best for: enterprise, internal and coding agents, security-sensitive deployments, and teams needing integration, identity, permissions and audit in one architecture.

Fabriq is a control layer for AI agents. Rather than every agent connecting to every system and carrying its own authentication logic, agents route governed tool calls through Fabriq, where several things get decided together.

Agent identity is part of the model. Each registered agent has its own identity and declared scopes, so agents can be governed, disabled and audited independently instead of sharing a service account.

The acting user travels with the request. This is the differentiator we'd defend hardest. The same agent may act for many people with very different authority, so Fabriq evaluates permissions on the agent and the user together and the effective set is the intersection. A sales agent working for an account executive doesn't silently gain an administrator's reach the moment an administrator uses it.

tool list built --> re-checked at call time user authority-/ | allowed --> call executes, event logged denied --> call refused, event logged -->

Figure 2 — Effective permission is always the agent's declared scope intersected with the acting user's authority, applied when the tool list is built and again at the moment of the call.

Permissions are enforced at the tool-call boundary. The intersection above is applied when the tool list is built and again when a call is made, so nothing survives on a stale catalog. Agents in action mode are gated on explicit per-user action grants, same smaller-set-wins behavior. A Gmail agent looks like this:

That's a stronger boundary than "Gmail access: yes," and stronger than a prompt asking the model to behave. The decision is binary and enforced in code. Fabriq doesn't queue an action for a human to sign off on. If a queued human step is a requirement, don't take any vendor's word for it, ours included; ask to see the hold happen in a live demo.

Agents don't hold raw secrets. Tokens live in a vault and are injected at call time in the default proxy mode, so the secret never reaches the agent's runtime or its context window. That matters most for agents exposed to unpredictable input: retrieved documents, tool output, third-party content, where anything in context is potentially exfiltratable. A token-broker mode exists as an explicit exception, not the default.

Every governed action is auditable. One record spans agents, users and tools: agent, acting user, tool and action, authorization mode, gate decision, outcome. Denials are included, and they're the events most worth having and most often missing elsewhere.

The catalog isn't the whole strategy. It holds 511 providers and 62,678 catalogued actions as of 2026-10-29, counted from a generated file in our own codebase rather than a marketing page: Gmail, Google Drive, Calendar, Meet, Slack, Notion, Microsoft Teams chat, OneDrive and Microsoft 365, plus the same controls over OpenAPI services, existing MCP servers, Postgres with SELECT-only guardrails, and private-network systems via an outbound-only connector.

To check these claims rather than read them: Fabriq Developer for the product and plan boundaries, the Developer Quickstart for the ten-line version, how agent and user permissions intersect for the scope arithmetic above, what the audit trail records on every call, and how unregistered agents get discovered.

Two limits, stated here rather than in a footnote. Our shared provider apps are a paid-plan feature: on the Free plan your users connect through an OAuth app you register, and Gmail and full Google Drive use your own Google app on every plan, because Google treats those scopes as restricted. And there is no approval workflow anywhere in the developer product: nothing holds an action until a human signs off.

2. Pipedream Connect: massive API and tool coverage

If sheer breadth is the requirement, Pipedream is formidable. Its pricing page advertised "3,000+ connectors" and "10,000+ prebuilt tools and triggers" on 2026-10-29, with managed OAuth and credential storage, and its end-user connect flow reaches the whole catalogue. Two things to read before committing, both from its own pages: the free plan's production environment and usage credits are marked "Development only", and credits are metered as "1 credit per 30 seconds of compute" on each tool call, action, proxy request or trigger event, a workflow runner's meter attached to an agent's loop.

Choose Pipedream when integration breadth dominates. Choose Agentic Fabriq when the integration layer also has to be an identity, authorization, and audit control point. On what compute-time credits cost an agent loop: Fabriq Developer vs Pipedream.

3. Arcade.dev: agent authorization and MCP runtime

Arcade is the closest platform on this list to Fabriq's thesis, and it's worth being straightforward about that. Its homepage on 2026-10-29 says agents "act on behalf of the authenticated user, never through broad service accounts" and that "every action runs at the intersection of what the user can do and what the agent is scoped to do", the same shape we build around. It adds "pre- and post-tool-call hooks" for custom policies, inspecting "every request before it runs and every response before it returns", and enforcement "through your existing OAuth and identity provider flows". It now advertises "8,000+ permission-aware tools" and 33 built-in auth providers plus a generic OAuth 2.0 provider; in August 2026 it published no count.

Two places Arcade is genuinely ahead of us: Enterprise deployment "on Arcade Cloud, in your VPC, or fully air-gapped", which we match only on a custom plan and never air-gapped, and handing your server the raw provider token on request, which our external-user flow will not. One cost in its own docs: Arcade's default OAuth apps "can only be used with the Arcade user verifier, which requires each end user to sign in to an Arcade account that is a member of your project", so multi-user production needs its own OAuth app paired with a custom user verifier.

Choose Arcade when the MCP runtime is the center of your architecture and you want authorization enforced there. Choose Agentic Fabriq when you need the same model applied beyond MCP, to OpenAPI services, read-only database access, and private-network systems, under one identity and audit model. The two theses are close enough to compare line by line: Fabriq Developer vs Arcade.

4. Merge Agent Handler: enterprise tool-call governance

Agent Handler sits between AI tools and enterprise systems and applies governance at the tool-call layer. On 2026-10-29 its page advertised "thousands of pre-built tools" across "hundreds of enterprise systems"; Tool Packs "scoped by agent type, customer tier, or environment"; per-user authentication through "a guided flow"; DLP where "Every tool call input and output is scanned for sensitive data before it reaches a model or external system"; "Full audit logs are available on all plans" recording "identity, arguments, downstream API calls, and outcome"; and provisioning through "Okta, Azure AD, or any SCIM-compatible identity provider". Merge's real edge over us is that DLP layer: we make no claim to scanning tool-call payloads at all.

Choose Merge when enterprise integration maturity plus content-level DLP is the priority. Choose Agentic Fabriq when you want a platform conceived around agent identity and governed authority rather than an established integration platform extended toward agents.

5. Nango: developer-controlled API integrations

Nango suits engineering teams that want to own their integration code. Its pricing page on 2026-10-29 said "Auth for 1,000+ APIs" and "10,000+ tools, one server" (it read "7k pre-built tools, triggers & syncs" earlier in October), with managed authentication, and it exposes integrations as AI-ready tools through MCP, an API or its SDK, handling credentials, retries, rate limits and execution infrastructure underneath.

Two advantages worth naming. Self-hosting: BYOC puts the instance "inside your own AWS account, GCP project or Azure subscription", Self-Managed runs on your own infrastructure via a Helm chart, and a Free Self-Hosted build exists, though syncs, tool calls, webhooks, triggers, the MCP server, RBAC, MFA, SAML SSO and the audit trail are all excluded from the free one. And portability: "only with your own app can you export access and refresh tokens and move off Nango without users re-authorizing", a real exit our external-user flow does not offer.

Choose Nango when developers want to own and customize significant parts of the integration layer. Choose Agentic Fabriq when governance, identity, and permissions are the primary architectural requirements. On self-hosting and token portability: Fabriq Developer vs Nango.

6. StackOne: large managed MCP catalog

StackOne has moved furthest of anyone here since our August reading, and the move is onto our own axis. On 2026-10-29 its Tool Gateway page advertised "590+ connectors and 36,000+ actions" (we read 477 managed MCP servers and 28,753 tools in August), a Connector Builder for systems outside the catalogue, and the part that matters here: "Every call goes through per-user OAuth 2.1" with "Access ... granted per account and per action, so an agent can be given strictly less than the employee behind it", plus an audit view where "Every call records the assistant it came from and the verified user who ran it, not a shared service account".

That is the same claim we make, and we will not pretend otherwise because it is inconvenient for a ranking. If you are evaluating on per-user authority and per-action scope, StackOne belongs on your shortlist next to Arcade and us; the honest differentiator is no longer the model but catalogue shape, the non-MCP paths and what you can self-host. It publishes one shared MCP URL for every customer and we found no self-hosted option on the page we read; ask them rather than reading that as a no.

Choose StackOne when you want per-user OAuth and per-action scope across a large enterprise SaaS catalogue delivered as managed MCP. Choose Agentic Fabriq when you also need OpenAPI services, read-only Postgres and private-network systems inside the same identity, permission and audit model, or when your agents act for your own product's end customers rather than your employees.

7. Paragon ActionKit: embedded integrations in AI products

Paragon comes from embedded integration infrastructure. On 2026-10-29 its pages advertised "1000+ integration actions", "130+ integrations", "Multi-tenant authentication for every integration", an "Embedded and white-labeled" in-chat authentication component using OAuth 2.0 or API keys, SOC 2 Type II and "Cloud & Self-Hosting". It fits SaaS companies whose AI agent acts inside their customers' applications, and the white-labelled connect portal is a genuine advantage over us, because our consent screen is ours, not yours. We found no detail on audit-log retention or export, so we are not characterising it.

Choose Paragon when embedded B2B SaaS integrations are the core problem. Choose Agentic Fabriq when controlling agent authority across integrations is the bigger one.

8. Workato Enterprise MCP: large-enterprise orchestration

Workato brings deep enterprise automation heritage. On 2026-10-29 its Enterprise MCP page advertised "14,000+ apps" (up from 12,000+ in August) and described Verified User Access, where "Agent actions inherit the authenticated user's identity, enforcing role-based access control and maintaining audit trails automatically"; "Access policies route agent requests based on authenticated user context"; governing "every MCP server from a single console"; and "searchable logs that support compliance requirements". For an organization already on Workato, that estate and the zero-code path from Recipe Functions to MCP servers is a real advantage we cannot match.

Choose Workato when orchestration across a large existing automation footprint is the goal. Choose Agentic Fabriq when you want a focused control layer built around the agents themselves rather than a broad automation suite.

9. Zapier MCP: app breadth and ease of use

Zapier's advantage is scale, and it got bigger: "66,000+ triggers and actions" across "9,000+ apps" on 2026-10-29, up from the 30,000+ actions we read in August, working with Claude, ChatGPT and Cursor among others. Its page is more specific on controls than it used to be: credentials "stay in Zapier's managed connection layer instead of being passed into the model"; "Choose which apps and actions your agent can use. Review every MCP action in History"; "Zapier MCP respects all account-level restrictions: action restrictions, managed connections, app access controls, and workspace scoping"; SOC 2 Type II; and IT can "enable or disable MCP per workspace". For a team that wants an assistant acting across familiar SaaS applications quickly, it's hard to ignore.

Choose Zapier when enormous app coverage and simplicity matter more than agent-specific infrastructure. Choose Agentic Fabriq when governing autonomous authority is the reason you're buying at all.

10. Truto: unified B2B SaaS APIs and MCP

Truto approaches agent integrations from a unified API architecture. On 2026-10-29 it advertised "950+ Integrations across every SaaS category" (up from 650+ in August) and the ability to "Turn any integration into an MCP server with one API call", with tool access "scoped by method, tag, and time-to-live". It publishes SOC 2 Type II, ISO 27001, GDPR, HIPAA and CCPA, and offers "cloud and on-premises" deployment, an on-prem option we match only on a custom plan.

Choose Truto when unified B2B SaaS access is central to your product architecture. Choose Agentic Fabriq when the stronger requirement is a common security and governance layer around what agents may actually do.

Agentic Fabriq vs Composio

The two platforms overlap, but they start from different priorities.

Composio starts with reach. It advertises "1,500+ apps" and "20,000+ tools", loads tools just in time through meta tools so agents aren't drowned in a catalog, handles OAuth for development without setup, and maintains the integrations as upstream APIs change. If your bottleneck is that an agent can't get to the fortieth application on a list, that's the problem Composio is built to remove.

Fabriq starts with authority. For each governed request: which agent is acting, which user it's acting for, which resource and action, whether that combination is permitted, which credential applies, and what gets recorded. The effective permission is always the intersection of the agent's declared scopes and the acting user's authority, applied at the tool list and again at the call.

Eight dimensions, every Composio cell quoted from a page read 2026-10-29. No scores, and where Composio publishes nothing we say so rather than filling the cell.

Neither answers the other's question. Composio makes a very large universe of tools available to agents; Fabriq is built around controlling the authority an agent receives when it uses them. We think the control model is the more durable foundation for an enterprise putting agents in contact with sensitive applications. For a team still finding product-market fit against a long tail of SaaS, breadth may genuinely matter more today. Both can be true at once.

Choose Fabriq Developer when the integration layer also has to be the enforcement point: a shared agent operating under different limits for an intern and an administrator, a per-call record naming both the agent and the person, a credential that must never reach a process a model can influence, and systems in scope that include OpenAPI services, read-only Postgres or private networks as well as public SaaS. Start with the Developer Quickstart and Fabriq Developer for the plan boundaries.

Consider Composio when your provider list runs into the long tail. Roughly three times our catalogue is not a gap we can argue away, and the gap is widest exactly where early products go: niche vertical SaaS, a regional payment processor, the analytics tool three people use. Its free tier is also five times ours on included tool calls and includes trigger events we charge for, and its meta-tool pattern — where the agent discovers, authenticates and executes at runtime and hands the user a Connect Link mid-conversation, is a better fit for a single chat box than our model, which expects the connect step to sit in your onboarding flow.

Both free tiers, both catalogue counts and the setup before a first authenticated tool call: Fabriq Developer vs Composio.

Three Real Options, Not Two

Most comparison pages present a false binary: this platform or that one. There is a third answer, it is often the right one, and a vendor page that hides it is not worth reading.

Call the provider APIs directly when…

• Your integration list is one or two stable APIs and is not going to grow. One Slack app and one GitHub app is a week of work with no recurring dependency. A platform earns its place at the fourth or fifth provider, not the first.
• Your agent acts under its own authority rather than for named individuals. With no acting user whose permissions have to bound the agent's, there is nothing to intersect and nothing for a layer like ours to decide. A workload identity and the provider's own scopes cover it.
• The provider's own logs already record what your auditor asks for. Then the record you would pay a platform to produce already exists.
• The scope you need is restricted anyway. For Gmail or full Google Drive you register your own Google app and enter Google's verification queue whether you use a platform or not. Nobody here removes that step; we say so on our own pricing page.
• Latency or cost per call is the binding constraint. Every platform here is a hop, and meters it.

What you take on instead: token refresh, rotation, revocation, per-provider error semantics, rate limits and your own record of who asked for what. Finite for two providers. Not finite by the fifth.

Choose Fabriq Developer when…

• A shared agent serves people with different authority, so the effective permission has to be the agent's scopes intersected with the acting user's grant, computed at the tool list and again at the call. See how agent and user permissions intersect.
• You need a per-call record naming both principals, denials included, emitted by the layer that made the decision rather than by the agent's account of itself. See what the audit trail records on every call.
• The credential must never enter a process a model can influence. Tokens stay in the vault and attach server-side at call time; on the developer path there is no retrieval API at all.
• Your product's users are your customers, not your employees, and never create an Agentic Fabriq account. The Developer Quickstart is the ten-line version; Fabriq Developer has the plan boundaries.
• Agents are appearing that nobody registered, and finding them precedes governing them: how unregistered agents get discovered.

Choose another platform when…

• Breadth is the binding constraint. Composio ("1,500+ apps"), Pipedream ("3,000+ connectors"), Zapier ("9,000+ apps") and Workato ("14,000+ apps") are all several times our 511 providers, and a platform that can't reach your fourth provider loses on that alone.
• You need the content of a tool call inspected. Merge scans "Every tool call input and output ... for sensitive data before it reaches a model or external system". We do not scan payloads at all.
• You need it air-gapped or free to self-host. Arcade publishes VPC and fully air-gapped deployment; Nango publishes BYOC, Self-Managed and a limited Free Self-Hosted build; Truto publishes cloud and on-premises. We offer a Helm install on a custom plan and nothing below that.
• You need token portability. Nango's own guide notes you can export access and refresh tokens with your own OAuth app "and move off Nango without users re-authorizing". Our external-user flow has no equivalent.
• You need the consent screen to be yours. Paragon's connect portal is "Embedded and white-labeled"; Nango supports a custom callback URL on your domain. Our shared apps show our name.
• You need a human approval gate rather than a record. No product in our developer tier holds an action until a person signs off. If that gate is a hard requirement, ask every vendor on this list, us included, to demonstrate it running rather than describe it.

How to Choose

No single winner. Choose on the problem you actually have.

• Maximum API breadth: Pipedream
• MCP-focused authorization runtime: Arcade
• Mature integrations plus DLP and governance: Merge
• Developer-owned integration code: Nango
• Large managed MCP coverage: StackOne
• Embedded SaaS integrations: Paragon
• An existing enterprise automation estate: Workato
• A huge, easy-to-use SaaS ecosystem: Zapier
• Unified B2B SaaS APIs: Truto
• Per-user OAuth and per-action scope across enterprise SaaS, as managed MCP: StackOne
• Identity, user-scoped permissions, credentials, and audit in one control plane: Agentic Fabriq
• One or two stable APIs, an agent acting under its own authority, and provider logs your auditor accepts: no platform. Write the integration.

Frequently Asked Questions

What is the best Composio alternative? We publish this page, so treat our answer as an argument rather than a verdict. Agentic Fabriq is our top choice where secure, governed agent integrations matter, combining integrations with agent identity, acting-user identity, action-level permissions, credential handling and auditability; see the Developer Quickstart if you would rather check than take our word. For sheer connector breadth, evaluate Pipedream, Zapier, Workato and StackOne. For per-user OAuth across a large enterprise SaaS catalogue, look hard at StackOne and Arcade. With one or two stable APIs, consider integrating directly instead.

What is the best Composio alternative for enterprise AI agents? For agents operating against sensitive systems, Fabriq is designed around the identity and authorization problem: it distinguishes the agent from the user it represents and controls what that combination can do. Arcade and StackOne are the closest alternatives on that dimension.

What are the main Composio competitors? Agentic Fabriq, Pipedream Connect, Arcade.dev, Merge Agent Handler, Nango, StackOne, Paragon ActionKit, Workato Enterprise MCP, Zapier MCP and Truto.

Is Agentic Fabriq a Composio competitor? Yes. Both connect AI agents to external tools. Fabriq differentiates on agent identity, acting-user permissions, credential handling, enforcement at the tool-call boundary and centralized audit.

What should I look for in an AI agent integration platform? More than integration count: application coverage, MCP support, authentication, credential handling, agent identity, user identity, action-level authorization, whether sensitive actions can be held for human review, audit trails, internal-system connectivity, and how access is cut off across many agents at once.

Is Composio still a strong platform? Yes. It remains one of the strongest catalogs in the category: on 2026-10-29 its homepage advertised "1,500+ apps" and the site "20,000+ tools", with SOC 2 Type II and the claim that every action is recorded. The right alternative depends on whether your priority is breadth, developer flexibility, enterprise orchestration, or agent-specific governance — and for one or two stable APIs, the right answer may be no platform at all.

Why does agent identity matter for integrations? Once agents perform real actions, an organization needs to know which autonomous system acted and whose authority it used. Distinct agent identity lets permissions, disablement and audit attach to the agent rather than treating every action as a human's.

What is governed AI agent access? Access subject to identity, authorization and audit controls. Instead of asking only whether the agent can reach Gmail, GitHub or an internal API, governance asks whether this agent, acting for this user, may perform this specific action now, and records the answer either way.

Conclusion

The first challenge in agentic AI was intelligence, the second was giving agents tools, and the one teams run into now is authority.

An agent that answers questions creates limited operational risk. An agent that can send email, edit code, modify customer data, reach financial systems or run internal workflows is a different proposition, and connectivity alone stops being a sufficient answer. Someone needs to know who's acting, for whom, with what authority, against which resource, and with what evidence afterward. Those decisions land between the agent and the systems it uses, which makes the integration layer where they get enforced.

Sources

Every competitor URL below was re-read on 2026-10-29. Where a vendor's published figure moved since our August 2026 reading, both figures are given. Agentic Fabriq figures are ours and are labelled as ours.

• Composio, pricing and toolkits — "1,500+ apps", "1500+ toolkits", "1–30 of 1540", "20,000+ tools via MCP or direct APIs", SOC 2 Type II, "Every action is recorded, so you can see exactly what your AI did", Hobby at $0 with 100,000 tool calls and 50,000 triggers, Pro at $29, per-execution-mode surcharges, no self-hosting published (checked 2026-10-29; the directory read 1,214 and the homepage "1,000+ integrations" in August 2026)
• Authenticating tools, Composio — managed auth for "Development/Testing" versus "Production: Generate your own OAuth credentials from the toolkit's developer portal" (checked 2026-10-29)
• Pipedream pricing and Connect MCP for developers — "3,000+ connectors", "10,000+ prebuilt tools and triggers", the free tier's production environment and credits marked "Development only", and "1 credit per 30 seconds of compute" (checked 2026-10-29)
• Arcade.dev and Arcade pricing — "8,000+ permission-aware tools", agents that "act on behalf of the authenticated user, never through broad service accounts", "every action runs at the intersection of what the user can do and what the agent is scoped to do", pre- and post-tool-call hooks, enforcement "through your existing OAuth and identity provider flows", and Enterprise deployment "on Arcade Cloud, in your VPC, or fully air-gapped" with "SSO, RBAC, audit logs" (checked 2026-10-29; no tool count was published in August 2026)
• Secure auth in production, Arcade and auth providers — default OAuth apps usable "only ... with the Arcade user verifier, which requires each end user to sign in to an Arcade account that is a member of your project", and 33 built-in providers plus a generic OAuth 2.0 provider (checked 2026-10-29)
• Merge Agent Handler — "thousands of pre-built tools" across "hundreds of enterprise systems", Tool Packs "scoped by agent type, customer tier, or environment", DLP where "Every tool call input and output is scanned for sensitive data", "Full audit logs are available on all plans" recording "identity, arguments, downstream API calls, and outcome", and "Okta, Azure AD, or any SCIM-compatible identity provider" (checked 2026-10-29)
• Nango pricing, auth guide and self-hosting — "Auth for 1,000+ APIs", "10,000+ tools, one server", "1 Connection = 1 API key or access token of the external API", "Nango-managed OAuth apps can be used in production", the shared-app tradeoff list including portability, and BYOC / Self-Managed / Free Self-Hosted with syncs, tool calls, webhooks, triggers, the MCP server, RBAC, MFA, SAML SSO and the audit trail excluded from the free build (checked 2026-10-29; the pricing page read "7k pre-built tools, triggers & syncs" earlier in October 2026)
• StackOne Tool Gateway MCP — "590+ connectors and 36,000+ actions", a Connector Builder, "Every call goes through per-user OAuth 2.1", "Access is granted per account and per action, so an agent can be given strictly less than the employee behind it", and "Every call records the assistant it came from and the verified user who ran it, not a shared service account" (checked 2026-10-29; read 477 managed MCP servers and 28,753 tools in August 2026)
• Paragon ActionKit and Paragon MCP — "1000+ integration actions", "130+ integrations", "Multi-tenant authentication for every integration", "Prompt users to auth at query time", "Embedded and white-labeled" in-chat authentication, SOC 2 Type II, and "Cloud & Self-Hosting". Audit-log retention and export are not detailed on either page, so no row is claimed for them (checked 2026-10-29)
• Workato Enterprise MCP — "14,000+ apps", Verified User Access where "Agent actions inherit the authenticated user's identity, enforcing role-based access control and maintaining audit trails automatically", "Access policies route agent requests based on authenticated user context", single-console governance, and "searchable logs that support compliance requirements" (checked 2026-10-29; read 12,000+ apps in August 2026)
• Zapier MCP — "66,000+ triggers and actions" across "9,000+ apps", credentials that "stay in Zapier's managed connection layer instead of being passed into the model", action and app access controls, "Review every MCP action in History", account-level restrictions and workspace scoping, SOC 2 Type II (checked 2026-10-29; read 30,000+ actions in August 2026)
• Truto — "950+ Integrations across every SaaS category", "Turn any integration into an MCP server with one API call" with tools "scoped by method, tag, and time-to-live", SOC 2 Type II / ISO 27001 / GDPR / HIPAA / CCPA, and cloud or on-premises deployment (checked 2026-10-29; read 650+ integrations in August 2026)
• Model Context Protocol specification, 2026-07-28
• Agentic Fabriq pricing — ours: developer plans priced on API calls; Free at 20,000 calls a month with bring-your-own OAuth app; shared provider apps for non-restricted scopes on a paid plan after a one-time attestation; Gmail and full Google Drive on your own Google app on every plan; Helm self-install on AWS or GCP on a custom plan (checked 2026-10-29)
• Fabriq Developer, the Developer Quickstart, Agent Permissions, Audit Trail and Shadow AI — ours: the intersection rule, the per-call audit record, the credential path, and agent discovery