Best Managed MCP Server Platforms (2026)

The best managed MCP server platform depends on whom the agent acts for. If it acts for many end users, you need per-user OAuth, token refresh and scoped endpoints; Scalekit is built for that case. If it acts for your own team, one shared connection can be enough. This guide compares ten platforms, with sources linked for each vendor. Last checked: October 9, 2026.

TL;DR

• Pick Scalekit if your agent acts on behalf of your customers' users. Each user connects their accounts once. Scalekit stores and refreshes the tokens, and every tool call runs as that user.
• Each run is bound to one user. A session token ties the run to one user's connected accounts, so one user's run cannot use another user's credentials. The agent never sees a raw OAuth token.
• One Virtual MCP server per agent role exposes only the tools that role needs, across 500+ connectors and 20,000+ tools, with custom connectors for any REST API or remote MCP server.
• Deployment options: Scalekit's US or EU cloud, or your VPC, on-prem or air-gapped on Enterprise, with SOC 2 Type II and ISO 27001.
• Other platforms lead in other areas: Zapier, Pipedream and Composio on catalog breadth, Merge Agent Handler on DLP scanning, and Nango on source-available code. The sections below compare all ten.

Quick pick by situation

What a managed MCP server platform does

An MCP server exposes tools that an AI agent can call through the Model Context Protocol. A managed platform hosts those servers for you, connects them to third-party apps such as Gmail, Slack and Salesforce, and handles the OAuth flow for each app. The alternative is to run each app's official or open-source MCP server yourself and build the token storage around it.

The main difference between the platforms is whose token each tool call uses. A server configured with one account acts as that account for everyone. A server that supports per-user connections stores a token for each user who connected, refreshes it, and picks the right one on every call.

Gateways that govern agents your employees already use are a related but different category. Top MCP gateways for AI agents covers those.

How we evaluated, and who wrote this

Scalekit's team wrote this guide, and Scalekit is one of the ten platforms. We list Scalekit first because we know it best; the others follow in alphabetical order. Competitor facts come from the vendors' own pages, linked in each section and checked on October 9, 2026. Pricing and catalog counts change often, so check the linked page before you decide. If a vendor finds an error, contact us and we will correct it.

We compared each platform on nine points:

• Catalog size, as the vendor states it.
• Per-user auth model: how the MCP endpoint identifies the end user.
• Token refresh handled by the platform.
• Tool scoping per server, agent or user.
• Hosting and self-hosting options.
• Audit logs, DLP and other guardrails.
• Client and framework support.
• Pricing unit and entry price.
• Compliance certifications.

The platforms

1. Scalekit

Scalekit runs each user's OAuth flow, stores their tokens in a vault and executes tool calls as that user, from the SDK, the REST API or a Virtual MCP server. A Virtual MCP server is one URL per agent role, such as a support assistant, shared by all your users. Before each run you mint a session token for one user; the agent connects with that token and can call only the tools you listed, as that user. Session tokens last one hour by default and can be set between 60 seconds and 24 hours.

Each session token is bound to one user and that user's connected accounts, so one user's run cannot act with another user's credentials. The agent never receives the user's OAuth token or API key, and tool-call responses pass through without being stored.

Best for: Products whose agents act on behalf of many end users across many customer organizations.

Strengths

• The session token limits each run to one user's connected accounts.
• Tokens are refreshed automatically before each call, and your code never handles OAuth tokens.
• Tool scoping per agent role through Virtual MCP servers. What is a Virtual MCP server explains the design.
• 500+ connectors and 20,000+ tools, with custom connectors for any REST API, internal API or remote MCP server under the same auth model.
• Cloud in a US or EU region, or VPC, on-prem and air-gapped deployments on Enterprise. Bring your own key from Google Cloud KMS for the token vault on Enterprise.
• Adapters for LangChain, Google ADK, Anthropic, OpenAI, Vercel AI SDK and Mastra, plus Claude Managed Agents and any MCP client.
• SOC 2 Type II and ISO 27001; HIPAA BAA on Enterprise.

Sprouts.ai uses Scalekit for agents that act on behalf of each of its customers:

"Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer."
Kartikay Dhar, Director of Product, AI, Sprouts

Limits

• Scalekit has fewer connectors (500+) than Zapier (9,000+ apps), Pipedream (3,000+ APIs) or Composio (1,600+ toolkits). If you need many long-tail apps today, check the connector list first.
• Audit log retention is 30 days on Free and Growth; longer retention (up to one year) and SIEM streaming are on Enterprise (pricing).
• There is no DLP scanning of tool-call payloads of the kind Merge offers, and Scalekit is not open source.

Pricing: metered on tool calls. Free includes 10,000 tool calls a month; Growth is $99 a month for 100,000 tool calls, then $0.50 per 1,000; Enterprise is custom (pricing).

2. Arcade.dev

Arcade offers MCP gateways with 8,000+ tools. A gateway has a shared URL, and the end user is identified through your identity provider or an Arcade-User-ID header. Arcade acquired Smithery in August 2026.

Best for: Per-user authorization with hooks around each tool call.

Strengths

• Tools chosen per gateway, pre- and post-call hooks such as PII redaction, and audit logs.
• VPC and air-gapped on Enterprise; arcade-mcp is MIT-licensed.

Limits

• Arcade's 8,000+ tools are fewer than Composio's 20,000+ or Pipedream's 10,000+.
• Arcade lists SOC 2, but not ISO 27001 or HIPAA.

Pricing: free for 2,000 tool calls and 2,000 auth events a month; Team is $25 a month plus usage (pricing). See Arcade alternatives.

3. Composio

Composio lists 1,600+ toolkits and generates MCP servers from them. One server URL serves all users, and each request names the user with a user_id (docs), and Composio stores and refreshes credentials per user.

Best for: A large prebuilt catalog, per-user auth and a generous free tier.

Strengths

• 1,600+ toolkits and 20,000+ tools, with tool allowlists per server.
• Gateway audit records, 7 days to 1 year, with SIEM export; SOC 2 Type II and ISO 27001.

Limits

• Self-hosting and VPC deployment are Enterprise options.
• Composio-managed OAuth apps cost more per call than your own.

Pricing: Hobby is free for 100,000 tool calls a month; Pro is $29 a month (pricing). See Composio alternatives and its 2026 pricing change.

4. Merge Agent Handler

Agent Handler groups tools into Tool Packs. Each MCP URL names a Tool Pack and a registered user (docs), and Merge refreshes tokens near expiry.

Best for: Enterprises that need DLP and redaction on every tool call.

Strengths

• DLP scanning on inputs and outputs, which redacts matched values or blocks the call.
• Audit logs on all plans and SIEM streaming on Enterprise. SOC 2 Type 2, ISO 27001 and HIPAA, with on-prem on Enterprise.

Limits

• Merge gives no exact catalog count.
• No tier between Free and the $1,000 Pro plan.

Pricing: free for 2,000 credits a month; Pro is $1,000 a month for 25,000 credits (pricing). See Merge alternatives.

5. Nango

Nango covers 1,000+ APIs and 7,000+ tools. Its MCP server uses a session URL and a session token valid for up to 15 days. The code is on GitHub under the Elastic License 2.0, with about 12,600 stars.

Best for: Code-first integrations you can read, change and self-host.

Strengths

• Tool definitions live in your repository, and token refresh is handled for every API.
• Tool allow and deny lists, an audit trail of account changes on Enterprise, and SOC 2 Type 2 and HIPAA with a BAA.

Limits

• Self-hosting is on the Enterprise plan.
• The license is source-available, not OSI open source.

Pricing: free for 10 connections; pay-as-you-go from $50 a month, at $0.29 per connection and $0.72 per compute hour (pricing). See Nango alternatives.

6. Paragon ActionKit

ActionKit exposes 1,000+ integration actions and is offered as a managed MCP server. Users are identified with a JWT your backend signs, and Paragon handles token refresh, retries and logging. A self-run server is also available.

Best for: SaaS teams already using Paragon for embedded integrations.

Strengths

• Agent actions on top of an established embedded-integration platform.
• SOC 2 Type II, GDPR and HIPAA, with on-prem deployment on Enterprise.

Limits

• Pricing is not public, and there is a free trial rather than a free tier.
• Tool scoping by integration, tool or category, not per agent role.

Pricing: custom, per connected user (pricing). See Paragon alternatives.

7. Pipedream Connect

Pipedream offers 3,000+ APIs and 10,000+ tools. Its remote MCP server has one base URL, and an x-pd-external-user-id header names the user (docs). Workday announced and completed its acquisition of Pipedream.

Best for: Broad app coverage behind one base URL, with an MCP server per app under it.

Strengths

• Per-user headers keep integration simple, and token storage and refresh are handled.
• SOC 2 Type 2 and GDPR on all plans, with HIPAA on Business (pricing).

Limits

• The self-hosted server uses the Pipedream Source Available License.
• The free plan is development-only.

Pricing: from $99 a month billed annually, including 100 external users and 10,000 credits (pricing). See Pipedream alternatives.

8. StackOne

StackOne lists 540+ connectors and 33,000+ actions behind a Tool Gateway MCP. The endpoint is shared, and an x-account-id header selects the account; the tools follow each account's enabled actions (docs).

Best for: A large action catalog with a prompt-injection guard.

Strengths

• Prompt Injection Guard on every plan (pricing).
• A search-and-execute mode exposes two meta-tools instead of the full catalog. StackOne lists SOC 2 Type II and HIPAA.

Limits

• Audit logs, SIEM export and self-hosting are Enterprise features.

Pricing: free for 1,000 credits per seat a month; Team is $600 a month (pricing).

9. Truto

Truto creates an MCP server per connected account across 850+ integrations, scoped by method, tag and time-to-live. It refreshes tokens and sends a webhook when refresh fails. Truto also publishes its own platform list.

Best for: B2B products that need unified data models and on-prem.

Strengths

• Unified models across categories such as HRIS and CRM.
• On-prem on Enterprise. Truto lists SOC 2 Type II, ISO 27001 and HIPAA.

Limits

• There is no free tier; Truto offers a 30-day sandbox.
• Truto requires at least 10 connectors, so the minimum is $9,990 a year.

Pricing: from $999 per connector per year (pricing).

10. Zapier MCP

Zapier MCP exposes actions across 9,000+ apps. An embed gives each of your users a unique server URL, and Zapier handles OAuth.

Best for: Internal and personal agents on teams already using Zapier.

Strengths

• The largest app catalog on this list.
• Admins choose which apps and actions are exposed, and Zapier keeps an action history. Zapier lists SOC 2 Type II.

Limits

• Each tool call uses two Zapier tasks.
• Zapier MCP cannot be self-hosted.

Pricing: billed in tasks; free for 100 tasks a month, Professional from $19.99 a month billed annually (pricing).

Comparison matrix

All three tables were checked on October 9, 2026. The sources are linked in each platform section above.

Auth model and hosting

Pricing and compliance

Token refresh, audit and guardrails

When Scalekit fits, and when it does not

Scalekit fits when your agent acts on behalf of your customers' users and every call has to run with the right user's credentials: a support, sales or operations agent inside a B2B product, where each customer's admins need to know what the agent can reach and on whose behalf. It also fits when the deployment has to move into a customer's VPC or an air-gapped network later without rebuilding the auth layer.

Another platform is the better choice when you need a long tail of apps today and do not want to build custom connectors, when the agent is a personal or internal assistant that a shared connection serves well, or when payload-level DLP scanning is a hard requirement.

Decision framework

Answer these in order. After the third question you should have two platforms left to trial.

1. Who does the agent act as? If it acts as your company or one employee, a shared or per-employee connection works and catalog size matters most. If it acts for your customers' users, you need per-user connections and tenant isolation. How tool calling auth changes from single-tenant to multi-tenant covers the difference.
2. Which apps must work on day one? Check each platform's catalog for your top ten apps, and check whether a custom connector can fill the gaps under the same auth model.
3. Where must it run? If tokens and tool calls must stay inside your network or your customer's, narrow to platforms with VPC, on-prem or source-available options. Best self-hosted agent integration platforms goes deeper.
4. What do your security reviewers need? Audit log retention, DLP or redaction, SIEM export and certifications. These are often enterprise-plan features, so price that plan.
5. How will cost grow? Model your expected tool calls, users and connections a year out. Per-task, per-credit, per-user and per-connector pricing diverge quickly as usage grows.
6. Trial two. Connect two real user accounts to the same app, run the same agent task for each, and confirm each call used the right user's token. The Scalekit quickstart walks through this setup.

Frequently asked questions

What is a managed MCP server?

A managed MCP server is a Model Context Protocol server that a vendor hosts and maintains for you. It connects an AI agent to third-party apps through MCP and handles each app's OAuth flow, token storage and refresh, so you do not run or patch the server yourself.

Composio vs Zapier MCP: which is better?

Zapier MCP has the larger app catalog and suits internal or personal agents, but each tool call uses two Zapier tasks. Composio is built for developers, with per-user auth through a user ID on one server URL and a free tier of 100,000 tool calls a month. For a product serving many end users, Composio is the closer fit of the two.

Is Zapier MCP free?

Zapier MCP uses tasks from your Zapier plan, and each tool call uses two tasks. The free Zapier plan includes 100 tasks a month, which is about 50 MCP tool calls. Paid plans start at $19.99 a month billed annually for 750 tasks.

What is the best MCP platform for a multi-tenant SaaS?

Pick a platform where every tool call resolves to one end user's token, tokens are stored and refreshed for you, and tools can be scoped per agent or per customer. Scalekit, Arcade, Composio and Merge Agent Handler all support this model; they differ on catalog size, deployment options and data controls.

Can I self-host a managed MCP server?

Yes, on some platforms. Nango's code is source-available under the Elastic License 2.0. Scalekit, Arcade, Merge Agent Handler, Truto, Composio, StackOne and Paragon offer VPC, on-prem or self-hosted deployments, usually on Enterprise plans. Pipedream publishes a source-available MCP server. Zapier MCP has no self-hosted option.

How is a managed MCP platform different from an MCP gateway?

A managed MCP platform hosts the servers and connects them to apps on behalf of your users. An MCP gateway sits in front of MCP servers to govern access, often for agents your employees already use. Some products do both.

Next step

To test per-user tool calling with your own accounts, follow the Scalekit quickstart. To compare notes on your architecture with an engineer, book a technical session.