Arcade

Arcade is an actions runtime for teams putting AI agents into production. It sits between an agent and the business systems the agent needs to use, providing one place to authorize, execute, and audit actions. This is especially useful when a prototype must move beyond answering questions and start doing real work, such as updating Salesforce, sending Slack messages, managing Google data, or closing support tickets. Arcade says its catalog contains more than 8,000 permission-aware tools, while also supporting custom MCP integrations that customers build or bring. Its MCP support is central to the product: Arcade operates as an MCP-compatible runtime/server that can connect to MCP clients, and the vendor says its team authored the MCP tool-authorization specification.

The security model is a major differentiator. Authentication runs against the customer's identity provider, authorization is delegated per user, and policies are enforced outside the language model. This avoids giving an agent a broadly shared service account or simply inheriting every permission held by a human. Arcade also offers built-in evaluations intended to catch hallucinated or destructive tool calls before execution. A central control plane can grant, revoke, and version tools, while each action produces an audit record identifying the agent, user, and target system. The vendor advertises SOC 2 compliance, SSO, RBAC, audit logs, SIEM streaming, and cloud, VPC, on-premises, air-gapped, or hybrid deployment options.

The free plan is practical for prototypes, with 2,000 authentication events and 2,000 tool calls per month. The Team plan adds production-oriented usage billing and email support. Enterprise is aimed at organizations that need private registries, flexible deployment, formal support, and centralized governance. Arcade is best suited to product teams building multi-user agents and security teams that need to constrain what those agents can do without forcing developers to create a separate authentication and policy layer for every integration.

Practical assessment

Arcade’s strongest distinction is the separation between model reasoning and action enforcement. Authentication runs against the organization’s identity provider, authorization is delegated per user, and policy is enforced outside the LLM. A malicious or mistaken prompt therefore cannot directly override the policy layer. The central control plane can grant, revoke, and version tools, while audit records identify the agent, user, and target system involved in an action. The live site also lists SOC 2 compliance, SSO, RBAC, audit logs, SIEM streaming, and cloud, VPC, air-gapped, or hybrid deployment.

MCP is not an incidental connector here. Arcade operates as an MCP-compatible runtime, supports tools a customer builds or brings, and says its team authored the MCP tool-authorization specification. Builders using LangChain can retain their orchestration framework while moving action governance into Arcade. Teams comparing agent integration catalogs should test Composio. If the main need is application identity rather than agent tool execution, Auth0 is a useful architectural comparison. Production teams can pair the runtime with AgentOps to investigate tool failures, latency, and agent traces.

The live pricing page lists Free at $0 per month with 2,000 authentication events and 2,000 tool calls monthly. Team costs $25 per month plus $0.10 per authentication event and $0.01 per tool call. Enterprise uses custom annual bundles and adds volume discounts, VPC or air-gapped deployment, 24/7 SLA-backed support, a dedicated forward-deployed engineer and account team, SSO, RBAC, audit logs, and private registries. A Team deployment with 10,000 auth events and 100,000 tool calls would cost $2,025 for that month before tax: the $25 platform fee plus $1,000 for each usage category. Buyers should confirm how retries and multi-step runs are metered.

Arcade is best for multi-user agents that must act as individual users and for security-conscious organizations standardizing MCP access. It is less compelling for a read-only assistant or one stable integration that is cheap to maintain directly. Pilot at least three real integrations and deliberately test expired credentials, revoked consent, denied policy, duplicate requests, upstream timeouts, and destructive-action approval. Measure successful action rate, p95 latency, unauthorized-action count, support response, and cost per completed workflow. Built-in evaluations reduce risk but do not replace narrow scopes, approval gates, idempotency, rate limits, and incident procedures.