Best MCP Integration Platforms and Tool Hubs for AI Agents in 2026

If your agent needs authenticated tools for many different users, pick a managed platform: Composio or Arcade.dev for agent-first products, Pipedream or Nango if you want usage-based or self-hostable plumbing, Merge Agent Handler when governance and DLP lead the requirements, and Zapier MCP when breadth of apps and a familiar admin console beat cost per call. If you just need to run a server you wrote, Cloudflare is the cheapest hosted route, and Docker is the cleanest local one.

The category also moved fast in the last quarter. Smithery was acquired by Arcade and its hosted proxy was scheduled to shut down on October 31, 2026, Klavis's repository is now marked deprecated, and mcp.run now redirects to a different product. Those changes are covered below, because a comparison written in the spring would send you to services that no longer take new customers. All prices below are as of Nov 12, 2026, taken from the vendors' own pages.

Composio's own three-minute walkthrough of connecting an agent to a large app catalog, a useful picture of the managed-auth model this article compares.

Short Answer and Quick Picks

There is no single winner because the platforms solve three different problems: tools for your product's end users, governed tools for your employees, and hosting for servers you control. Use the table to find your row, then read that vendor's section.

If you only want a list of useful servers to install today, our guides to the top MCP servers and the best MCP servers for Claude Code cover that. This article is about the layer that makes those tools safe to hand to other people's accounts.

Master Comparison Table

Every cell comes from a vendor page fetched on Nov 12, 2026. Where a page did not state something, the cell says so rather than guessing. Catalog sizes are vendor-stated and are counted differently (apps, APIs, tools, actions), so they are not directly comparable.

What Changed in the Market

Three shifts shape this list. First, consolidation: Arcade.dev announced on August 5, 2026 that it had acquired Smithery, and Workday announced in November 2025 that it would acquire Pipedream (the deal was expected to close by the end of Workday's fiscal year on January 31, 2026; Pipedream's current site lists Workday only as a customer logo, so check the status yourself before assuming any change in terms). Second, retreat from hosted proxies: Smithery is closing its connection services and sending users to vendor-run MCP URLs. Third, a security reckoning: Composio disclosed a May 2026 incident, which pushed the whole category toward envelope encryption, token redaction and customer-managed keys.

The practical lesson is vendor risk. A tool hub holds your users' tokens and sits in the critical path of every action your agent takes, so ask about acquisition exposure, shutdown terms and data export as seriously as you ask about price. The same logic applies one layer up, when you choose an agent framework that assumes a particular tool provider.

Composio

Composio is the most agent-native option in this group. It exposes a catalog of toolkits through SDKs and MCP, and its model is per-user: every end user connects their own accounts, and every tool call runs against that user's connected account. Its pricing page cites 1,700+ apps on every plan, although one of its own articles dated October 2, 2026 says 1,500+ in the body, so treat the exact number as approximate.

Auth handling. Per Composio's docs, managed auth covers most toolkits so you do not need your own OAuth app. When a tool needs an account, the agent generates a Connect Link, the user signs in on a hosted page, and Composio stores the account. You can bring your own OAuth app, request specific scopes and remove Composio branding, and it supports OAuth2, Bearer, API key and Basic auth configs. OAuth tokens are refreshed before expiry; if a refresh token is revoked the connection becomes EXPIRED and you can listen for a webhook to prompt re-authentication. A user can hold several accounts for one toolkit, such as work and personal Gmail.

Pricing (as of Nov 12, 2026). Free is $0 with up to 3 members, 10,000 tool calls per month, $2 of one-time credits and up to 3 custom MCP servers. Standard is $18 per seat per month with 10,000 calls per seat, any number of custom MCP servers, firewall, SSO and zero data retention. Enterprise is custom and adds BYOC, custom internal connectors, SCIM and audit logs, and SIEM streaming. The pricing page did not state a self-hosted option beyond BYOC.

Strengths. Broadest managed-auth catalog among agent-first vendors, a clear per-user model, white-label auth, and a cheap entry point. Composio holds a SOC 2 Type II report according to its docs, and the Enterprise tier supports a stateless credential proxy in your own cloud with AWS KMS, Google Cloud KMS or HashiCorp Vault Transit.

Weaknesses. The May 2026 incident. In an article published October 21, 2026, Composio says an attacker reached internal systems and compromised customer credentials, that leaked connections were about 0.3% of active connections (including 5,001 GitHub connections), and that 5,241 API keys were identified as potentially exposed. It reports having retired and rebuilt its tool-building service, adopted AES-256-GCM envelope encryption with an AWS KMS key, stored API keys only as hashes, removed raw tokens from connected-account responses, and added IP allowlisting (changelog June 4, 2026). Third-party reviews by AppSecure and Latacora are cited, with Latacora's work still partly in progress as of the September 16 update. All of this is vendor-reported. Include it in your security review and use Proxy Execute rather than handling tokens yourself.

Best for. Teams shipping an agent product that must act inside many customers' SaaS accounts, who want to start free and scale per seat.

// Pattern from Composio docs: a per-user session exposes an MCP URL and headers
// session.mcp.url      -> remote MCP endpoint for this user
// session.mcp.headers  -> auth headers to send with every request
// Point any MCP client that supports HTTP transport at those two values.

Arcade.dev

Arcade positions itself around authorization: its home page says "Ship agents. Not auth infrastructure." Tools run through Arcade's runtime, and users grant access through OAuth providers the first time a tool needs it.

Auth handling. Arcade's docs list 33 named auth providers (GitHub, Google, Microsoft, Slack, Salesforce and others) plus a generic OAuth 2.0 option. Built-in providers show Arcade's name and logo and share rate limits with other customers; you can configure your own provider for branding and isolated limits. The gateway docs describe three user modes: Arcade Auth for development and internal use, User Source (recommended for production) which redirects users to your OIDC identity provider, and Arcade Headers as a fallback for clients that cannot run a browser OAuth flow. In the first two modes the client token only works on the gateway for the signed-in user. With Arcade Headers the client holds your project API key, which the docs warn is a project-wide credential, so keep that mode away from untrusted clients.

Pricing (as of Nov 12, 2026). Free is $0 with 2,000 tool calls per month on Arcade Cloud. Team is $25 per month plus $0.01 per tool call with next-business-day email support. Enterprise is custom with annual call bundles, 24/7 SLA support, SSO, RBAC, audit logs, private registry access, and deployment on Arcade Cloud, in your VPC or fully air-gapped. At $0.01 per call, 100,000 calls on Team cost $1,000 plus the platform fee, which makes cost easy to forecast and also easy to outgrow.

Strengths. The clearest authorization model for production gateways, the strongest self-host story (VPC and air-gapped) among the hosted vendors, and gateways that federate many MCP servers behind one URL. Tool Recommendation, the default for new gateways in organizations that have it, returns only the allowed tools that fit a task, which helps with context bloat.

Weaknesses. Self-hosting is Enterprise-only, and the pages I fetched did not state a total integration count, so compare it app by app against your list. One hands-on reviewer reported that tool-level auth only worked once the tool was hosted on Arcade's runtime and that the docs were unclear about it; treat that as one author's experience, not a verified limitation. With Smithery now part of Arcade, expect the registry and the runtime to converge, which raises neutrality questions that commentators have already noted.

Best for. B2B products that must prove who authorized what, and enterprises that need VPC or air-gapped deployment.

# Arcade MCP gateway URL format (from Arcade docs)
claude mcp add --transport http my-tools https://api.arcade.dev/mcp/YOUR-GATEWAY-SLUG

Smithery

Smithery was the best-known public registry and hosting layer for MCP servers. As of Nov 12, 2026 it is a directory, not a platform. Its page says Smithery is now part of Arcade, and its shutdown notice says that effective October 31, 2026 the server URLs on run.tools and server.smithery.ai, the Smithery API, Connect and Toolbox, Smithery accounts and API keys, and the CLI and SDKs stop working. The public directory stays online, with a curated set of verified servers whose pages list direct vendor MCP URLs such as mcp.linear.app/mcp.

Pricing. Not applicable for new use. The notice says every charge since August 5 will be refunded and subscriptions cancelled, with refunds typically appearing in 5 to 10 business days. Migration. Individual users should switch to the vendor's official MCP URL, listed on each server page. Platforms that manage connections for their own users must choose a replacement, and the notice offers help even if the choice is not Arcade. I could not independently confirm after the date that the shutdown completed as scheduled, so verify before relying on either state.

Best for. Discovering servers and finding the official vendor URL. Not for new production dependencies.

Klavis AI

Klavis offered open-source MCP integrations plus a hosted platform and its Strata connector layer. The GitHub repository now states the project is deprecated and no longer in active development, and that the company shifted to RL environments and training data. The notice does not announce a shutdown of the hosted service, and existing customers can still reach the MCP platform from klavis.ai. The repository advertises 100+ prebuilt integrations with OAuth support under the Apache-2.0 license, and you can run an integration as a Docker container or install Strata locally with pipx.

Pricing. The hosted pricing page returned a 404 and the home page listed no plans, so I cannot quote a price. Weakness. No active development means no new integrations or security patches from the vendor. Best for. Forking the Apache-2.0 code as a starting point for your own servers, or keeping an existing deployment alive while you migrate. Not a safe choice for a new build.

Pipedream MCP

Pipedream turns its connector library into a hosted remote MCP server. Its site cites 3,000+ integrated APIs, 10,000+ prebuilt tools and triggers, and 1M+ connected accounts, and calls itself the integration layer for AI agents. It has two products: Connect, for developers who embed connectors in agents and apps, and Conduit, an early-access gateway that lets employees connect their apps to agents with SSO, access policies and audit trails.

Auth handling. Your backend authenticates to Pipedream with client-credentials OAuth, then sends the project, environment and an external user ID with each request. The external user ID is your own identifier, and requests are tied to that user's connected accounts. If a required account is missing, the server returns a connect link in the tool response, and Pipedream stores and refreshes tokens. Failed calls return isError: true with an attribution field that says where the error came from.

Pricing (as of Nov 12, 2026). Free is $0 for development only, with no production environment and no external users, but with the full 3,000+ connector catalog. Startup is $99 per month billed annually or $150 per month billed monthly, with production access, 100 external users included (then $2 per user) and 10,000 usage credits (then $0.012 each). Business is custom on an annual contract with SSO, SCIM, HIPAA, dedicated static egress IPs and SLAs. MCP servers, the Connect proxy and custom OAuth clients are included on all plans. Each action, MCP tool call, proxy request or trigger event uses one credit per 30 seconds of compute. My fetch of the pricing page rendered the Startup price poorly, so confirm the exact figure on the page.

Strengths. Usage-based pricing that maps to your end users, a large connector library, and a free tier that exposes the whole catalog for building. Docs mention a self-hosted MCP server option but do not describe how to run it, so I cannot rate it. Weaknesses. Credit accounting by compute time is harder to forecast than a flat per-call fee, and the Workday acquisition announced in November 2025 adds roadmap uncertainty you should ask about. Best for. Multi-tenant products that want hosted MCP with predictable per-user pricing.

# Pipedream remote MCP server (from Pipedream docs)
URL:      https://remote.mcp.pipedream.net/v3
Auth:     Authorization: Bearer <access token from client-credentials OAuth>
Headers:  x-pd-project-id, x-pd-environment (development | production),
          x-pd-external-user-id, x-pd-app-slug (for example: notion, gmail)

Zapier MCP

Zapier MCP exposes Zapier's connection layer to any MCP client. The page claims 9,000+ apps and 66,000+ triggers and actions, while its developer FAQ cites 30,000+ actions, so the number depends on how you count. Credentials stay in Zapier's connection layer and are not passed to the model; the agent uses apps you already connected in Zapier.

Pricing (as of Nov 12, 2026). MCP is included in every Zapier plan, and each tool call uses two tasks from your existing task quota. Free gives 100 tasks per month, which is about 50 calls. On monthly billing, Professional is $29.99 for 750 tasks, $58.50 for 1,500, $73.50 for 2,000 and $133.50 for 5,000; Team starts at $103.50 for 2,000 tasks. At two tasks per call, 2,000 tasks buys about 1,000 calls. Annual billing is 33% cheaper and Enterprise is custom.

Security. You choose which apps and individual actions the agent can use and can remove access at any time, every MCP action is recorded in History, Enterprise admins can enable or disable MCP per workspace, and Zapier is SOC 2 Type II certified. Strengths. Unmatched app breadth, no separate contract, a familiar admin experience. Weaknesses. Task-based economics penalize chatty agents, there is no self-hosting, and it is designed around a Zapier account holder rather than embedding auth for your own customers. Best for. Individuals and teams who already run Zapier and want agents to reach the same apps. For automation tools compared head to head, see n8n vs Zapier vs Make for AI automation.

Cloudflare Remote MCP

Cloudflare is not a catalog. It is the cheapest serious place to host an MCP server you write, with first-class OAuth. You deploy from a "Deploy to Workers" button or with the CLI, use createMcpHandler from the Agents SDK for a stateless Streamable HTTP server, and persist data in KV, D1 or Durable Objects.

Cloudflare Developers walk through building and deploying a remote MCP server.

Auth handling. The authorization docs describe three routes: the Workers OAuth Provider library (an authorization-server Worker plus a resource-server Worker that returns 401 without a valid token), third-party identity providers such as Stytch, Auth0, WorkOS and Descope, and Cloudflare Access with your configured IdP. Tools can read the signed-in user with getMcpAuthContext(), check permissions in handlers, or register tools conditionally so the model never sees them, and can gate on OAuth scopes.

Pricing (as of Nov 12, 2026). Workers Free is $0 with 100,000 requests per day and 10 ms CPU per invocation. Workers Paid has a $5 per month minimum with 10 million requests and 30 million CPU ms included, then $0.30 per extra million requests and $0.02 per extra million CPU ms. The remote MCP guide itself does not list pricing. Strengths. Low cost, global edge, real OAuth 2.1 plumbing, and no lock-in to a catalog. Weaknesses. You write and maintain every tool, there are no prebuilt SaaS connectors, and you own the upstream OAuth to each third-party service. Best for. Internal APIs and custom servers. It pairs with the hosting options in our agent hosting roundup.

# Cloudflare: scaffold, test, deploy (from Cloudflare docs)
npm create cloudflare@latest   # choose the remote-mcp-authless template
npm start                      # local endpoint: http://localhost:8788/mcp
npx wrangler@latest deploy     # served from a workers.dev subdomain

# Connect Claude Code
claude mcp add --transport http my-server https://<your-worker>.workers.dev/mcp

Docker MCP Catalog and Toolkit

Docker's MCP Catalog is a curated collection, which its docs describe as 300+ verified servers, packaged as container images with versioning, provenance and security updates. The MCP Toolkit and MCP Gateway let you configure servers once, group them in profiles, and connect several clients such as Claude Code, Cursor and Zed through one gateway.

Docker's tutorial for the Catalog and Toolkit.

Auth and security. The open-source docker/mcp-gateway (MIT) runs each local MCP server in its own container, gives npx and uvx servers minimal host privileges, keeps credentials out of environment variables through the Docker Desktop secrets store, includes built-in OAuth flows, and offers logging and call tracing. Access to the Gateway as part of Docker AI Governance is invite-only through Docker Sales.

Pricing (as of Nov 12, 2026). The pricing page lists Docker Personal at $0, Pro at $11 per month ($9 billed annually), Team at $16 ($15 annual) and Business at $24, but it does not mention the MCP Toolkit, so I cannot say which tier includes it. It lists an MCP Enterprise Gateway as a separate product with no price. The gateway needs Docker Desktop 4.59 or later with the MCP Toolkit feature enabled, or can run outside Desktop. Strengths. Strong isolation, local control, no per-call fee, and open source. Weaknesses. It runs on your machine, so it does not solve multi-user OAuth for a hosted product, and the pages I fetched did not detail image signing. Best for. Developers and teams who want containerized servers behind a coding agent. See best AI agent sandboxes for the wider isolation picture.

# Docker MCP Gateway (from the docker/mcp-gateway README)
docker mcp --help                       # verify the CLI plugin (Docker Desktop 4.59+)
docker mcp feature enable profiles      # outside Docker Desktop, with DOCKER_MCP_IN_CONTAINER=1

Glama and mcp.run

Glama began as a registry and has grown into hosting and a gateway. Its registry page listed 119,812 MCP servers when I fetched it on Nov 12, 2026, with letter grades for license, quality and maintenance (the page does not explain how they are calculated). The Glama MCP Gateway is a reverse proxy: clients connect to one Glama URL and calls are forwarded upstream. It offers managed OAuth 2.1 with automatic token refresh and encrypted credential storage, per-tool access rules, a log of every JSON-RPC message exportable as JSON for a SIEM, and alerts when a server changes its tool definitions. Open source servers can be deployed to Glama's infrastructure in one click. The pricing page I fetched showed no plans or prices, only a free signup, so I cannot quote costs. Glama is a good fit for teams that want a gateway with audit and tool-change alerts and a huge registry for discovery; weigh that the registry is breadth, not vetted managed connectors.

mcp.run now redirects (HTTP 301) to turbomcp.ai. That site describes Turbo MCP as a standards-compliant, self-hosted MCP gateway and management platform that ships as a single container, with OIDC integration, RBAC for admin approval of servers, audited admin logs, DLP features, a centralized kill switch that cuts agent access without blocking human users, and automatic OAuth with Dynamic Client Registration. The page does not mention mcp.run, lists no pricing, and is dated January 8, 2026, so I cannot confirm the relationship between the two or the product's release stage. Treat mcp.run as unavailable under its old name and evaluate Turbo MCP separately if a self-hosted gateway is what you need.

Merge Agent Handler

Merge, known for unified APIs, built Agent Handler on MCP for three audiences: teams building agent products, IT and security teams governing employee AI, and individuals connecting Claude or Cursor. Its guided connect flow appears automatically when an agent needs an unauthorized connector, and the platform manages credentials. The page says "thousands of pre-built tools" in some places and "hundreds" of enterprise systems in others, so I cannot give a reliable connector count.

Security. This is the standout. Tool-call inputs and outputs are scanned for sensitive data (DLP), rules can block, redact or mask data before it reaches a model or third-party system, and every action is logged with identity, arguments, downstream API calls and outcome, with full audit logs on all plans. Merge reports regular penetration tests, weekly automated scans and SOC 2 compliance.

Pricing (as of Nov 12, 2026). Free is $0 with 2,000 monthly credits, unlimited registered users and tool packs. Pro is $1,000 per month with 25,000 credits by default and tiers up to 100,000, overage billed at month end. Enterprise is custom, adding custom connectors, bulk discounts, custom or on-prem deployment, forward-deployed engineers and SIEM streaming of tool-call and API logs. The page does not say how many credits one tool call costs. Strengths. Governance depth and a generous free tier for prototyping. Weaknesses. The jump from $0 to $1,000 per month is steep for small teams, and credit cost per call is undocumented. Best for. Enterprises and B2B vendors for whom DLP and audit are procurement requirements.

Nango

Nango started as open-source infrastructure for product integrations and now covers AI tool calling and MCP. Its pricing page cites auth for 1,200+ APIs and 10,000+ prebuilt tools, triggers and syncs; its GitHub page says 1,000+ APIs. It provides managed OAuth, API keys and token refresh, a white-label auth flow you can embed, a proxy that injects credentials and handles retries and rate limits, and TypeScript Functions that run on Nango's runtime. It can also add any public MCP server.

Pricing (as of Nov 12, 2026). Free is $0 with 10 connections, 10 compute hours and 10 GB of data transfer per month as hard caps, and MCP auth and tools are included. Pay as you go is $50 per month including $50 in credits, then $0.29 per connection, $0.72 per compute hour and $0.50 per GB. Enterprise is custom, with connections falling to about $0.01 per connection per month at scale, plus self-hosting and BYOC in AWS, GCP or Azure regions. A $450 per month Growth add-on gives a shared Slack channel and a 5-day integration turnaround.

Self-host. The project is open source under the Elastic License and can be self-hosted for free with a limited feature set. The Elastic License restricts offering Nango as a managed service, so read it if you resell. Strengths. You can own the auth layer, cost scales with connections rather than calls, and SOC 2 Type II, HIPAA and GDPR are claimed on its page. Weaknesses. More engineering than a turnkey hub, and new integration turnaround on the free plan is 20 days. Best for. Product teams that already build integrations and want one auth and sync layer shared with their agent.

Security Controls Compared

Tool hubs concentrate risk: one breach exposes tokens for many users across many services. Judge them on the controls below, and ask for each answer in writing.

Two cautions. A SOC 2 report covers specific controls over a period, and Composio's own article notes it does not cover agent-specific risks such as prompt injection or the security of third-party apps. And tool-definition changes matter because an MCP server can change what a tool does after you approved it, which is why Glama's change alerts are worth copying in your own review process. For browser-based tools, also read our browser infrastructure guide.

Benchmarks and Independent Data

No neutral benchmark compares these platforms on latency, tool-call success or auth reliability. The numbers vendors publish (catalog sizes, tool counts, user counts) are marketing figures counted in incompatible ways, so this article labels every count as vendor-stated and does not rank by them. Trade-press commentary on the Arcade and Smithery deal also points out that Arcade runs its own MCP server quality benchmark, so grades published by a vendor with a registry stake deserve the same skepticism as any vendor-reported score. The most reliable test is your own: pick your five most important apps, run an end-to-end authorization, a token expiry, and a revoked-access case on each shortlisted platform, and measure latency from your region.

How to Choose

A five-step evaluation works for any shortlist. First, list the ten apps your users need and check each against the vendor's catalog, not its headline count. Second, run the OAuth flow as a brand-new end user and note whether the consent screen shows your name or the vendor's. Third, expire a token and revoke access to see how failures surface to the agent. Fourth, price your expected monthly calls and users on each model, remembering Zapier's two tasks per call and Pipedream's compute-time credits. Fifth, read the shutdown, export and acquisition terms. If your agent also needs retrieval, our coding agents roundup shows which clients speak MCP natively.

How We Evaluated

We fetched each vendor's pricing, docs, repository or product page on Nov 12, 2026 and recorded what it stated. We did not run paid accounts for every platform, so statements about behavior come from vendor documentation unless marked otherwise. There is no paid placement, sponsorship or affiliate link in this ranking, and order within sections reflects the category grouping, not a score. Where a page was unavailable, garbled or inconsistent (Klavis pricing, Smithery post-shutdown status, Merge connector counts, the Pipedream Startup price display, mcp.run's relationship to Turbo MCP), we say so. Prices change often, so check the vendor page before you buy.

FAQ

Sources

All fetched November 12, 2026.

• Composio pricing
• Composio docs: authentication
• Composio: how Composio rebuilt credential security after May 2026 (Oct 21, 2026)
• Composio: correcting the record on SOC 2 scope (Oct 2, 2026)
• Arcade pricing
• Arcade docs: auth providers
• Arcade docs: MCP gateways
• Arcade: Smithery joins Arcade (Aug 5, 2026)
• Smithery: what is changing
• Klavis AI on GitHub
• Pipedream pricing
• Pipedream docs: MCP for developers
• Pipedream home page
• SiliconANGLE: Workday to acquire Pipedream (Nov 19, 2025)
• Zapier MCP
• Zapier pricing
• Cloudflare: build a remote MCP server
• Cloudflare: MCP authorization
• Cloudflare Workers pricing
• Docker: MCP Catalog and Toolkit
• Docker MCP Gateway on GitHub
• Docker pricing
• Glama MCP server registry
• Glama MCP Gateway
• Turbo MCP (mcp.run redirect target)
• Merge Agent Handler
• Merge Agent Handler pricing
• Nango pricing
• Nango on GitHub