Best Tool Calling Platforms for AI Agents

An agent tool-calling platform sits between your agent and your users' apps. It runs each user's OAuth flow, stores their tokens, decides which tools a run may call, executes the call as that user, and logs it. Agent frameworks run the model loop; the platform owns the credentials, permissions, and logs.

Suppose a company ships an AI assistant inside its product, and every customer's team connects their own Gmail, Slack, and Salesforce. The engineering lead needs a shortlist of two or three platforms to trial this quarter. This guide compares eight of them on nine criteria.

We build Scalekit, which is one of the eight platforms below, so this list says where AgentKit is not the right choice and where other platforms lead on specific criteria.

TL;DR

• A tool-calling platform gives an AI agent ready-made tools, plus the OAuth, token storage, and permissions behind them; this review compares eight of them on nine criteria.
• Per-tool scope and audit log export set these platforms apart more than catalog size does, since claimed catalogs only range from Paragon's 1,000+ apps to Pipedream's 3,000+ APIs.
• Scalekit fits B2B products where each customer's users authorize their own accounts, with per-tool scope and a per-user log of every tool call.
• Composio gets a team started fastest with a claimed 1,500+ apps, Arcade offers evaluated tools with deployment options it says reach air-gapped networks, and Nango suits teams that want to edit tool code and self-host a source-available platform.
• Merge Agent Handler puts tools behind data loss prevention (DLP) rules, Paragon ActionKit suits teams already running Paragon, and Auth0 Token Vault suits teams on Auth0 that write their own tools and only need token storage.

How Did We Evaluate These Tool Calling Platforms?

Where a company does not publish a fact, the cell says "Not published". We compared paid list prices only, since free tiers change often and do not reflect production use.

The nine criteria follow one tool call from the user's consent to the security team's review:

• Per-user authorization model: whether each call runs with the end user's own grant, or a shared account.
• Token storage and refresh: where OAuth tokens live, how they are encrypted, and who refreshes them.
• Tool discovery and search: how an agent finds the right tool without loading the whole catalog into its context.
• Per-tool scope: whether you can limit an agent to specific tools, not only specific apps.
• Audit and log export: whether each tool call is logged with the user, and whether those logs reach your SIEM.
• Deployment and self-hosting: managed cloud, your own cloud account, or your own infrastructure.
• Framework support: which agent frameworks and MCP clients have documented integrations.
• Catalog: how many apps or tools each platform claims. We report these as the platforms' own claims, since each one counts apps, APIs and tools in a different way.
• Entry paid price: the lowest published paid plan.

Nango's 29 September 2026 ranking of tool-call providers uses seven criteria. Audit logging is not one of them, and per-tool scope appears only inside its customer isolation check. We include both sets of criteria because they decide whether a customer's security team signs off on your agent.

How Do the Top Tool Calling Platforms Compare?

The first table covers the run itself: whose credentials a call uses, where they live, how the agent finds tools, and how far you can narrow them.

The second table covers what happens around the run: how each platform logs calls and where you can host it.

The third table covers what you can plug in and what it costs: frameworks, catalog size, and the first paid plan.

What Are the Best Tool Calling Platforms for AI Agents?

Each review covers what the platform is, who it fits, where it is strong, where it falls short, and what the first paid plan costs.

1. Scalekit for Per-User Authorization in Customer Tenants

Scalekit runs each user's OAuth flow, stores their tokens in a vault, and executes tool calls as that user. You call it from the Python or Node.js SDK, the REST API, or a Virtual MCP server, which is a hosted MCP endpoint that exposes only the tools you pick for one agent role.

Best for: customer-facing agents that act inside each customer's own SaaS accounts and have to pass a security review.

Strengths:

• Per-tool scope in the credential layer. A Virtual MCP server lists the exact tools for a role, and a read-only session token hides every tool that writes, so a hijacked run has no write tool to call.
• Tool search that knows the user. The Search Tools API (beta) ranks tools by intent and returns each one's readiness for the current user, so the agent skips apps that the user has never connected to.
• Native SIEM streaming. Every call is logged with the tool, connection, connected account, user identifier, status, error code, and duration, and Enterprise plans stream those logs straight to Datadog, CrowdStrike, or Google SecOps.
• Tokens stay out of your code. The token vault encrypts tokens with AES-256 at rest, supports your own Google Cloud KMS key, and adds credentials at call time.

Limits:

• We list 600+ connectors and 30,000+ tools. Composio, Nango, and Pipedream claim more apps or APIs, so check that your top apps are covered.
• SIEM streaming, bring-your-own-key, and self-hosting require an Enterprise plan.

Entry paid price: $99 a month for Growth, with 100,000 tool calls a month included.

See how AgentKit handles this in the Virtual MCP server guide.

2. Composio for the Fastest Start With a Large Catalog

Composio gives an agent a session per user, with meta tools that search the catalog, connect accounts, and run tools. Composio claims 1,500+ apps on its site.

Best for: teams that want an agent calling real apps the same day, across many toolkits.

Strengths:

• Search built into every session. By default, a session can reach every toolkit through ^{COMPOSIO_SEARCH_TOOLS}, which keeps the tool list in context short.
• Allowlists down to the tool. Session settings enable or disable whole toolkits or individual tools inside one.
• Wide framework coverage. Composio ships providers for OpenAI, Anthropic, LangChain, the Vercel AI SDK, Mastra, and CrewAI.

Limits:

• A new session can reach the whole catalog until you narrow it, so scoping is a step your team has to remember.
• Self-hosting sits on the Enterprise tier, and SIEM export works by pulling logs from the Logs API.

Entry paid price: $29 a month for Pro, which includes a $29 usage credit.

For a deeper look, see our Composio alternatives guide.

3. Arcade for Evaluated Tools and Flexible Deployment

Arcade calls itself an MCP runtime: it hosts tools, handles each user's authorization and routes calls through MCP gateways. Arcade states it has 8,000+ permission-aware tools, and says its built-in evals catch hallucinated and destructive calls before they run.

Best for: teams that care most about tool quality and need private or isolated deployment.

Strengths:

• Tool evaluations. Arcade publishes an evaluation framework for testing whether models pick the right tool and call it with valid input.
• Deployment range. Arcade lists VPC and air-gapped options under Enterprise on its pricing page, and documents Helm self-hosting on your own Kubernetes cluster.
• Per-gateway tool selection. Each MCP gateway exposes the tools you choose and identifies users through your own identity provider.

Limits:

• Usage pricing counts both auth events and tool calls, so cost tracks how often users connect accounts as well as how often agents act.
• Arcade's pricing page lists SSO, RBAC and audit logs under Enterprise.

Entry paid price: $25 a month for Team, plus $0.10 per auth event and $0.01 per tool call.

See our Arcade alternatives guide for more options.

4. Nango for Code-First Tools on a Source-Available Platform

Nango handles auth for 1,000+ APIs, by its own count, and lets you write or edit the functions behind each tool. It is source-available under the Elastic License 2.0, and its agent sessions expose a chosen toolset to the agent as an MCP server.

Best for: engineering teams that want to own tool code and may need to self-host.

Strengths:

• Editable tool logic. You can use catalog actions or deploy your own action functions when a packaged tool does not fit.
• Scoped sessions. An agent session fixes the toolset, and the agent cannot widen its own scope.
• Self-hosting paths. Enterprise customers can run BYOC or Self-Managed deployments with the same codebase.

Limits:

• The audit trail records control-plane changes, such as connection and settings changes, and is an Enterprise feature.
• Full self-hosting (BYOC or Self-Managed) requires Enterprise; a limited free self-hosted option covers only auth and proxy.

Entry paid price: $50 a month on pay-as-you-go, which includes $50 in credits.

5. Merge Agent Handler for Governed Tools in Enterprise Security Teams

Merge Agent Handler is an MCP server that sits between your agent and the hundreds of connectors Merge lists, attaching each end user's credentials to the call. This review covers Agent Handler only, not Merge's unified API.

Best for: enterprises whose security team wants DLP rules on every tool call.

Strengths:

• Security Gateway. Rules scan tool inputs and outputs for PII and other sensitive data on every call, and redact or block them.
• Tool Packs. A Tool Pack bundles the exact tools one agent surface may use.
• Logs built in. Tool call logs record each step, and Enterprise plans stream them to a SIEM.

Limits:

• The first paid plan is the most expensive entry point in this list.
• On-prem deployment and SIEM streaming need Enterprise.

Entry paid price: $1,000 a month for Pro, with 25,000 credits.

6. Pipedream Connect for the Largest Claimed API Count

Pipedream Connect manages each user's accounts, runs tools in Pipedream's own runtime, and exposes them over MCP. Pipedream claims 3,000+ APIs and 10,000+ tools.

Best for: products that need breadth across many long-tail apps.

Strengths:

• Breadth. The claimed catalog is the largest here, and a proxy reaches endpoints that have no prebuilt tool.
• Simple user model. Every account hangs off an ^{external_user_id} from your own system.

Limits:

• Scoping on MCP is per app; tool-level scope and audit log export for Connect are not published.
• Credentials and tool execution stay on Pipedream's infrastructure; only the MCP server can run on your side.

Entry paid price: $99 a month for Startup, billed annually, or $150 billed monthly.

7. Paragon ActionKit for Teams Already on Paragon

ActionKit is one API and MCP server that gives an agent Paragon's integration actions, which Paragon counts at 1,000+. It shares auth with Paragon's embedded integration products.

Best for: teams that already use Paragon for customer-facing integrations.

Strengths:

• One platform for integrations and agents. The same connected users power syncs, workflows, and agent actions.
• On-premises option. Enterprise customers can host Paragon on AWS, Azure or GCP.

Limits:

• Per-tool scope for agents is not published.
• Pricing is a custom quote based on connected users.

Entry paid price: Not published.

8. Auth0 Token Vault for Token Storage on Auth0

Token Vault stores each user's access and refresh tokens for providers such as Google, Microsoft, and Slack, and your app exchanges an Auth0 token for a provider token at call time. It does not ship tools, so you write each tool yourself.

Best for: teams already running Auth0 that want delegated access without a second identity provider.

Strengths:

• Fits your existing identity stack. Token Vault links connected accounts to the user's Auth0 profile.
• SDKs for common frameworks. Auth0 documents LangChain, LlamaIndex, Vercel AI, and Genkit.

Limits:

• No tool catalog, tool search, or tool-level scope, so your team builds and maintains every tool.
• Tenant logs cover auth events; tool call logging stays in your app.

Entry paid price: $35 a month for Essentials at 500 monthly active users. Token Vault is included on every plan up to a set limit, with more available as an add-on.

Which Platform Fits Each Kind of Agent?

Start from the agent you are shipping, then check the catalog. Most teams need their top 50 to 100 apps done well, and the harder questions sit in authorization, scope, and logging.

For most customer-facing agents, the deciding test is simple. Connect one test user, limit the agent to two tools, call a third tool, and check what the platform refuses and what it logs.

If the platform list feels like the wrong layer, our guide to what an agent tool-calling platform is explains where it sits between your framework and your users' apps. For gateways that govern MCP access across a company's own employees, see our best MCP gateway roundup.

What Did We Leave Out of This Comparison?

We kept the list to platforms that store each user's credentials and run tool calls for a customer-facing agent. A few nearby categories did not make the cut:

• Merge's unified API: It normalizes data across HR, CRM, and accounting apps, which is a different job from agent tool calling. Only Merge Agent Handler is reviewed here.
• Free tiers: Free limits change often and do not reflect production traffic, so we compared paid list prices only.
• Agent frameworks: LangChain, the Vercel AI SDK, and similar frameworks run the model loop and define tools, but they do not store user credentials or log calls per user.
• Self-hosted open-source projects: Projects you run on your own infrastructure get their own list in our guide to self-hosted and open-source tool calling platforms.
• Employee-facing MCP gateways: Gateways that govern which MCP servers a company's staff can use solve a workforce problem, and our best MCP gateway guide covers them.

Which Tool Calling Platform Should You Choose?

Catalog size gets most of the attention, but it rarely decides a security review. What decides it is whether each call runs as the right user, whether the agent can reach only the tools it needs, and whether every call leaves a record your customer's security team can read.

Scalekit was built around those three questions. Each user connects their own accounts, Virtual MCP servers and read-only session tokens narrow what an agent can touch, and every tool call is logged per user, with SIEM streaming on Enterprise.

To see it with your own apps, start with the AgentKit quickstart. Connect one test user, give the agent two tools, and check what it refuses and what it logs.

FAQs

What is the best tool calling platform for AI agents?

It depends on the agent. For customer-facing agents that act in each customer's own accounts, we built AgentKit for per-user authorization, per-tool scope, and audit logs. Composio fits the fastest start, Arcade fits teams that want evaluated tools, and Nango fits teams that want to edit tool code.

Composio vs Arcade: which is better for tool calling?

Composio claims a larger catalog, at 1,500+ apps, and starts at $29 a month. Arcade states 8,000+ tools, publishes a tool evaluation framework, and lists VPC and air-gapped deployment on Enterprise, starting at $25 a month plus usage.

Which tool calling platforms support per-user OAuth?

All eight platforms here store credentials per end user. They differ in how they model that user, from AgentKit's connected accounts and Composio's ^user_id sessions to Merge's Registered Users and Auth0's connected accounts.

Which platforms support per-tool scopes?

Scalekit (Virtual MCP servers), Composio (tool allowlists), Arcade (MCP gateways), Nango (agent session toolsets), and Merge Agent Handler (Tool Packs) all document tool-level scope. Pipedream Connect documents scope per app, and Paragon does not publish tool-level scope.

Which tool calling platforms can be self-hosted?

Scalekit, Composio, Arcade, Nango, Paragon, and Merge Agent Handler all list self-hosted or on-prem options, each on an enterprise plan. Nango is source-available under the Elastic License 2.0, and Pipedream Connect lets you run only its MCP server on your side.

Do I need a tool calling platform if I use MCP?

MCP standardizes how an agent discovers and calls tools, but it does not store each user's OAuth tokens, scope tools per agent role, or keep a per-user audit log. A tool-calling platform adds those layers, and most platforms here expose their tools over MCP.