Composio vs Arcade: Agent Auth and Tool Calling in 2026
The moment an agent has to send an email, file a ticket or update a CRM, it needs to sign in to that app as one of your users. Composio and Arcade are the two best-known hosted platforms for that job. We compare them with two you can run yourself, Nango and ACI.dev, on how each handles sign-in, what each costs at 50 and 1,000 users, and what their licences actually allow.
First: why agents need their own auth layer
A chatbot only needs your model key. An agent that does work needs access to other people's accounts: this user's Gmail, that customer's Salesforce, a team's GitHub. Each app has its own OAuth flow, its own scopes, tokens that expire and rate limits per user. Multiply that by every app and every user, and it becomes a product of its own.
The shortcut most prototypes take is one shared API key or service account. It works in a demo, and it is the wrong design in production: every user's agent can see everything that account can see, and the logs cannot tell you which user asked for what.
Act as the user, not as you
Each user connects their own account once. The agent then acts with exactly that user's permissions, so it cannot read another customer's data.
Keep tokens out of the model
The platform attaches the token when the tool runs. The model only sees the tool and its result, so a prompt injection cannot make it print a credential it never had.
Refresh and revoke without code
Expired tokens are refreshed in the background, and when a user disconnects an app, access stops everywhere at once.
Ready-made tools
"Send email" or "create issue" arrives as a tested tool definition, so you do not write and maintain a wrapper for each API.
What it does not do: it does not decide whether an action is wise. An agent with a valid Gmail token can still send the wrong email. Limit scopes to what each feature needs, require a human to confirm destructive actions, and screen tool results for injected instructions. Our guide to AI guardrails covers that layer.
Do you need this yet? If your agent only touches your own database and one or two internal APIs with a fixed key, no. You need it when end users connect their own accounts, or when you integrate more apps than you want to maintain OAuth code for.
Quick Verdict
Hosted platform with the largest catalog: 1,500+ apps, managed OAuth, triggers and an MCP gateway. The free tier covers 100,000 tool calls a month and Pro calls cost $0.0003 each.
An MCP runtime built around authorization. Each call is limited to what both the user and the agent may do, with policy hooks before and after. Enterprise runs in your VPC or air-gapped.
Integration platform for 1,000+ APIs with tool calls, an MCP server, data syncs and webhooks. Source on GitHub under the Elastic License; the free self-hosted build covers auth and the proxy.
Apache-2.0 platform you can run end to end: 600+ integrations, multi-tenant OAuth for your users, one MCP server. The most permissive licence here, and the least recent activity.
TL;DR
No single winner. Pick on your constraint. Most apps covered at the lowest per-call price → Composio. Strict per-user, per-call authorization or a VPC deployment → Arcade. The same integrations also need data syncs, and you want the source → Nango. A fully open-source platform you run yourself, at $0 in licences → ACI.dev, after checking it is still maintained.
The question that decides it: what are you controlling?
All four run OAuth, store tokens and expose tools over MCP. They differ in what they treat as the core problem, and that shows up in pricing, in the licence and in what you can audit later.
1. Coverage: how many apps, how cheaply
Composio optimizes for breadth. Most apps your users ask for are already in the catalog, and the price per tool call is a fraction of a cent. The trade is that it is a hosted service, so tokens and tool traffic live in Composio's cloud.
2. Authorization: who may do what, on every call
Arcade treats each tool call as an access decision: the overlap between what the user can do and what the agent is scoped to do. Anything outside it is stopped, and hooks let you add your own rules. It bills authorization events and tool calls separately, and the per-call price is higher.
3. Ownership: running it yourself
Nango and ACI.dev publish their code. Nango's Elastic License lets you self-host and embed it in your product but not resell it as a service, and the free build stops at auth and the proxy. ACI.dev's Apache-2.0 has no such limits, but you take on the token store, its encryption and its upgrades.
A quick test: if a security reviewer will ask "can the agent do anything the user cannot?", start with Arcade. If the first question is "do you support the app our customers use?", start with Composio. If it is "where do the tokens live?", look at Nango and ACI.dev.
The platforms, in detail
Plans, prices and limits as published on each vendor's site or repository in October 2026.
Composio
Hosted tool calling and managed OAuth
Free · Pro $29/mo + usage
$0.0003 per tool call, $0.003 per trigger event on Pro
- 1,500+ apps with OAuth, API keys and token refresh handled end to end
- Hobby: 100,000 tool calls and 50,000 trigger events a month, free; usage pauses at the cap
- Triggers push app events (new email, new ticket) back to the agent
- Works with any MCP client and with frameworks such as LangGraph and the Vercel AI SDK
- SOC 2 Type II and ISO 27001
- Enterprise: SSO/SCIM, customer-managed keys, BAA and zero data retention included
- SDK is MIT-licensed (about 30K GitHub stars)
- CaveatPricing changed for signups from August 15, 2026, so many comparison pages still quote the old tiers. On Pro, a BAA, IP allowlist and zero data retention are per-call add-ons. No self-hosted option is published.
Best for: Products whose users connect many different apps, where per-call cost matters.
Arcade
Authorization-first MCP runtime
Free · Team $25/mo + usage
$0.10 per authorization event, $0.01 per tool call on Team
- 8,000+ permission-aware tools, plus custom MCP tools you build or bring
- Agent acts as the signed-in user through your existing OAuth and identity provider
- Each call is limited to the overlap of user and agent permissions
- Pre- and post-call hooks to block actions or redact PII without forking the runtime
- Open-source framework (arcade-mcp, MIT) for writing tools in Python or JavaScript
- States SOC 2 compliance; SSO, RBAC and audit logs
- Enterprise runs in Arcade Cloud, your VPC or fully air-gapped
- CaveatThe free tier is small: 2,000 tool calls a month. At $0.01 a call, a busy agent costs far more than on Composio, and self-hosting is Enterprise-only.
Best for: Teams selling to security-conscious customers, or agents whose actions must be audited per user.
Nango
Source-available integrations platform
Free · Pay-as-you-go from $50/mo
$0.29 per connection, $0.72 per compute hour, $0.50 per GB
- Managed auth (OAuth, API keys, refresh) for 1,000+ APIs
- Expose any integration as an agent tool through an MCP server
- Incremental data syncs and verified webhooks from the same integrations
- Integrations are code, which Claude Code or Cursor can write for you
- Free cloud plan: 10 connections, hard-capped
- Self-host for free (auth and proxy) or on Enterprise with BYOC
- Used by teams at Replit, Vapi and Motion, per its site
- CaveatThe Elastic License 2.0 is source-available, not OSI open source: you cannot offer Nango itself as a hosted service. The free self-hosted build excludes syncs, tool calls, webhooks and the MCP server. Per-connection pricing grows with every user who connects an app.
Best for: Products that need to sync customer data for RAG as well as let an agent act on it.
ACI.dev
Open-source tool-calling platform
$0 licence (Apache-2.0)
You pay for hosting; a managed service is also offered
- 600+ pre-built integrations
- Multi-tenant OAuth flows and secrets management for your end users
- One unified MCP server, or a light SDK for direct function calling
- Natural-language permission boundaries on what an agent may do
- Dynamic tool discovery so the agent loads only the tools it needs
- About 4.9K GitHub stars
- CaveatThe main repository has had no commits since May 28, 2026. Check its activity before you build on it. You also own the token store: encryption, backups and access to it are your problem.
Best for: Teams that need everything inside their own infrastructure and can maintain a fork if they must.
What it costs at 50 and 1,000 users
Our assumptions: each user connects 3 apps and the agent makes 300 tool calls per user per month, with one authorization event per connected app per month. Prices are from each vendor's October 2026 pricing page. ACI.dev is our hosting estimate for a small container and Postgres, excluding anyone's time. Your mix will differ; the point is how each model scales.
| Monthly volume | Composio | Arcade | Nango (cloud) | ACI.dev (self-hosted) |
|---|---|---|---|---|
| 50 users · 15K calls · 150 connections | $0 (inside the free tier) | ~$190 (Team) | ~$50 (inside the credit) | ~$20–50 hosting |
| 1,000 users · 300K calls · 3,000 connections | ~$60–90 (Pro) | ~$3,300 (Team) | ~$870 + compute | ~$50–150 hosting |
Why the spread is so wide: each vendor bills a different unit. Composio bills tool calls at a fraction of a cent, Arcade bills calls and authorizations at higher rates, and Nango bills connected accounts. A product with few users and a very busy agent is cheapest on Composio; one with many users who each connect apps but rarely act grows fastest on Nango. Arcade's Enterprise bundle discounts these rates, so at volume ask for a quote rather than multiplying list prices. The Composio range depends on whether Pro keeps the Hobby allowance, which its page does not state.
Feature comparison
Integration counts are each vendor's own and count different things (apps, tools or APIs), so they are not directly comparable. A cross means the feature is not described on the vendor's site.
Security questions to ask any of them
Whichever you choose, this layer holds the keys to your users' accounts. These are the questions that matter more than the integration count.
Does the model ever see a token?
It should not. All four attach credentials at execution time. Check that your own logging and tracing do not copy tool inputs with headers into a place the model, or your observability vendor, can read.
What scopes does each integration request?
Ready-made integrations often ask for broad scopes so every tool works. Use your own OAuth app with narrower scopes where the platform allows it, so a user can see exactly what they are granting.
Can a tool result carry an attack?
Yes. An email or ticket the agent reads can contain instructions. Auth stops the agent from doing what the user cannot; it does not stop it doing the wrong thing the user can. Pair it with guardrails and human confirmation for destructive actions.
If you self-host, who guards the vault?
With Nango or ACI.dev, the token store is a database you run. Encrypt it with a key in a secrets manager, keep it off the public internet, and plan how you will rotate every token if it leaks.
Which one should you pick?
Your users connect lots of different apps
Composio. The catalog is the widest, and the free tier carries a prototype and an early launch. Check that the specific apps your first customers use are covered with the actions you need, not just listed.
Every action must be authorized and auditable per user
Arcade. Per-call checks against both user and agent permissions, policy hooks and audit logs are the product, and Enterprise can run inside your VPC. Budget for the higher per-call price.
Your agent also needs your customers' data synced
Nango. One integration both syncs records for retrieval and exposes actions as tools, so you are not running two systems against the same API.
Tokens may not leave your infrastructure, and the licence must be open
ACI.dev for an Apache-2.0 platform you control end to end, or Nango self-hosted if source-available is acceptable and you mainly need auth. Either way, run a two-week pilot that includes a token-rotation drill before you commit.
The app has no usable API
None of these. The agent has to use the website itself, in a browser session that stays signed in. See our guide to browser infrastructure for AI agents. Many products use an API-based platform for most apps and a browser for the rest.
Frequently Asked Questions
Which is better, Composio or Arcade?
Neither is better overall; they lead on different things. Composio has the larger catalog (1,500+ apps), a free tier of 100,000 tool calls a month and very low per-call pricing, so it suits products that call many apps often. Arcade is built around authorization: every call is limited to what both the signed-in user and the agent are allowed to do, policy hooks can block or redact, and Enterprise runs in your VPC or air-gapped. Pick on whether your bigger risk is coverage and cost, or control.
What is agent auth?
Agent auth is the layer that lets an AI agent act inside third-party apps on behalf of a specific user. It runs the OAuth sign-in for each app, stores and refreshes the tokens, and attaches the right token when the agent calls a tool, so the agent acts as that user and the model itself never sees a credential. Without it, teams either share one service account across all users, which over-grants access, or build token storage and refresh for every app themselves.
Is there an open-source alternative to Composio?
Yes, with a licence caveat. ACI.dev is Apache-2.0: you can run the whole platform, with 600+ integrations, multi-tenant OAuth and an MCP server, but its main repository has had no commits since May 2026. Nango publishes its code on GitHub under the Elastic License 2.0, which lets you self-host and embed it but is not an OSI open-source licence, and its free self-hosted build covers auth and the proxy only. Composio’s own SDK is MIT-licensed, but the platform behind it is hosted.
How much does Composio cost in 2026?
For signups from August 15, 2026: Hobby is free with 100,000 tool calls and 50,000 trigger events a month, and usage pauses at the cap. Pro is $29 a month including $29 of usage, then $0.0003 per tool call and $0.003 per trigger event. Enterprise is custom and includes SSO, a BAA and zero data retention. On Pro, a BAA and an IP allowlist are per-call add-ons. Customers who signed up earlier keep their old plan until December 31, 2026.
How much does Arcade cost?
Arcade’s Free plan includes 2,000 authorization events and 2,000 tool calls a month on Arcade Cloud. Team is $25 a month plus $0.10 per authorization event and $0.01 per tool call. Enterprise is an annual bundle with discounted overage, and adds VPC or air-gapped deployment, SSO, RBAC, audit logs and a private tool registry. Prices as listed in October 2026.
Do I need agent auth if I use MCP?
MCP standardizes how an agent discovers and calls tools, and its authorization spec uses OAuth 2.1 between the client and an MCP server. It does not store each of your users’ Gmail or Salesforce tokens or refresh them for you. That is what these platforms add behind the MCP server. All four in this guide expose their tools over MCP.
What if the app my agent needs has no API?
Then an API-based auth layer cannot reach it, and the agent has to use the website itself in a real browser session that stays signed in. That is a different layer, browser infrastructure, covered in our guide to browser infrastructure for AI agents. Many products end up with both: APIs where they exist, a browser where they do not.