Arcade vs Stacklok (2026)

More than 8,000 permission aware tools are available, plus custom or third party MCP servers that the customer builds or brings. Authorization is delegated, so the agent acts as its user within that user's scope, and Arcade handles OAuth across dozens of auth providers. Hosted remote MCP servers connect through Arcade to systems such as Salesforce, ServiceNow, GitHub, Atlassian and Snowflake.

Tool Recommendation, added in October 2026, lets an agent describe a task and get back the few tools that fit instead of loading the whole catalog, which Arcade puts at up to 91% fewer input tokens per session, and a Private Registry lets users browse the tools behind a gateway and request missing ones.

Sourcearcade.devread 2026-10-24

Every tool call carries the identity of the person who made it. Administrators register MCP servers as connectors in the Connector Gateway, an identity aware endpoint for MCP tool calls, and grant them to directory groups. The gateway then brokers each connector's credentials on the caller's behalf. ToolHive runs each MCP server in an isolated container with its own permissions and secrets, and a Virtual MCP Server aggregates backends into one endpoint with tool filtering for a given agent.

Sourcedocs.stacklok.com/connector-gatewayread 2026-09-22

Arcade executes the tool calls an agent makes and returns the results. Sequencing, branching and handoffs between agents live in the customer's own framework. Setup guides cover frameworks such as LangChain, CrewAI, OpenAI Agents, Google ADK and Mastra, among others. No workflow runtime of Arcade's own is named, so retries, routing and deterministic workflow steps sit outside the platform.

Sourcearcade.devread 2026-10-24

A Virtual MCP Server aggregates backend MCP servers behind one endpoint with static backend selection, tool filtering and renaming. The Connector Gateway exposes a toolset scoped to a group. Both route a call to the right server instead of running work. The platform runs no workflow or agent loop of its own, and there is no sequencing, branching or retrying across deterministic workflow steps and autonomous agent steps.

Sourcedocs.stacklok.com/connector-gatewayread 2026-09-22

Tools in Arcade run when an agent or MCP client calls them. No schedule, event, webhook or inbound queue that starts an agent run is named.

Sourcearcade.devread 2026-10-24

A client or agent calling a tool or a model is what sets the platform to work. ToolHive runs the servers and the gateways broker the calls, both at the caller's request. No schedule, event, webhook or inbound queue starts an agent run, and nothing wakes an agent unless a person or client starts the work.

Sourcedocs.stacklok.com/toolhiveread 2026-09-22

Agents get authenticated tools that read from and act in outside systems. Arcade names no index, graph, embeddings layer or other retrieval structure that it maintains over the customer's documents.

Sourcearcade.devread 2026-10-24

The vMCP optimizer searches tool descriptions to surface only the relevant tools for each request and cut token use. The registry catalogs MCP servers and skills. There is no index, graph or embeddings layer over the customer's own documents.

Sourcedocs.stacklok.com/toolhive/guides-vmcp/optimizerread 2026-09-22

Each user's OAuth tokens and authorization grants are kept, so tools can act without asking for consent again. Those stored credentials carry no agent state. Arcade names no memory that keeps an agent's state or a user's context across runs.

Sourcearcade.devread 2026-10-24

The product runs and governs MCP servers, skills and model traffic. None of its components (the ToolHive runtime, Registry Server, vMCP, Connector Gateway, AI Gateway and Enterprise Manager) persists an agent's state or a user's context across runs, so agents get no memory from it.

Sourcedocs.stacklok.com/toolhiveread 2026-09-22

Contextual access runs the customer's own policy logic inline. An access hook decides which tools each user can see. A pre execution hook allows, denies or modifies inputs before each tool call, and a post execution hook allows, denies or modifies the output, so sensitive actions can be blocked and personal data redacted.

Users authorize each scope before a tool acts for them, an agent can line up every authorization a job needs before it starts, and rate limits apply. A tool author can ask the user for input during a call through MCP elicitation, but Arcade names no step where a person reviews or approves an action before it commits.

Sourcedocs.arcade.dev/en/operate/governance/contextual-accessread 2026-10-24

Administrators limit what an agent may do instead of putting a person in the loop. They decide which MCP servers are registered as connectors and which directory groups may use them. Enterprise Manager policies can block servers that are not in the approved registry, and authorization policies limit each role's tools. The AI Gateway screens prompts for injection and scans requests and responses for card and personal data. The customer controls all of these limits, but no person reviews, approves or validates an agent action before it commits.

Sourcedocs.stacklok.com/connector-gatewayread 2026-09-22

Authentication runs against the customer's identity provider, with Okta, Microsoft Entra ID, Auth0 and Stytch as user sources. Authorization is delegated, so an agent acts as its user and never past that user's scope. Contextual access hooks enforce the customer's policies on every tool call. Role based access control has organization admin, project admin and member roles, and SSO and audit logs are included on Enterprise. No security attestation is published.

Sourcearcade.devread 2026-10-24

Identity comes from Okta or Microsoft Entra ID, with SCIM provisioning into a directory of users, groups and subgroups. Virtual API keys are bound to a user's identity. Enterprise authorization uses fleet wide MCP roles in RBAC custom resources, with delegation at the namespace level, and Cedar policies apply to MCP servers.

Connector credentials are stored encrypted at rest in the directory. The distribution itself carries Sigstore signatures, SLSA provenance and SBOMs the customer can verify. Stacklok holds no third party attestation of its own operations and says none applies to a self hosted product that holds no customer data.

Sourcestacklok.com/security-centerread 2026-09-22

Every action taken through Arcade leaves one record naming the agent, the user and the system, streamed to the customer's SIEM, and execution tool logs show which tools ran, who they ran for and whether they succeeded. Administrative actions go to a separate audit log that is on by default, with OpenTelemetry export, a filterable dashboard and a REST API for pulling events into the customer's SIEM or compliance tooling.

Sourcedocs.arcade.dev/en/operate/governance/audit-logsread 2026-10-24

The AI Gateway records structured audit events for model requests, detections and key actions and forwards them to the customer's SIEM. The Connector Gateway's tool usage view shows traffic by time range, connector and tool. An Enterprise Manager telemetry policy enforces OpenTelemetry settings across Stacklok clients, so tool calls are traced into the customer's own stack. A customer can inspect what an agent sent and received, keep audit events apart from traces, and export both to its own tools.

Sourcedocs.stacklok.com/ai-gateway/forward-audit-logsread 2026-09-22

Customers choose between Arcade Cloud and their own infrastructure. A turnkey platform that Arcade operates can be deployed into the customer's cloud account, as an Azure Marketplace managed app or through an AWS private offer. A self managed Helm deployment can run on the customer's Kubernetes cluster, for data residency, network isolation or compliance. Enterprise adds VPC and fully air gapped deployment.

Sourcedocs.arcade.dev/en/operate/deployread 2026-10-24

Everything runs inside the customer's own infrastructure. Stacklok Enterprise deploys as a single umbrella Helm chart into the customer's Kubernetes cluster. Distributed deployments can span several clusters, and an air gapped install mirrors the chart from a private registry. Stacklok neither hosts nor processes customer data.

Sourcedocs.stacklok.com/platformread 2026-09-22

The catalog holds tools and MCP servers that give an agent actions to take. The sample apps are example code. Arcade names no ready made workflows, templates or prebuilt agents of its own.

Sourcearcade.devread 2026-10-24

Agent skills ship with ToolHive. They are reusable bundles of tools, permissions and secrets that a customer browses in a registry and installs into its AI clients. A skill can be built from a local folder as an OCI artifact, then published, listed or deleted through the Registry Server's admin API. The CLI and desktop UI also install, distribute and manage skills.

Sourcedocs.stacklok.com/toolhive/guides-registryread 2026-09-22

Any client, model or framework the customer picks can use Arcade's tools. Setup guides cover the customer's own LLM and frameworks such as LangChain, OpenAI Agents, Google ADK, CrewAI, Mastra and Vercel AI SDK, among others. The evaluation command runs against whichever providers and models the customer names.

Sourcearcade.devread 2026-10-24

Customers and admins decide which model serves a request. The AI Gateway is a self hosted control point between AI clients and model providers. The customer connects OpenAI, Anthropic, AWS Bedrock, Azure OpenAI, Google Vertex AI and OpenAI compatible providers. It then maps model names onto them with a default route, weighted load balancing, priority failover, retries and timeouts, declared as AIGateway and AIPolicy resources.

Sourcedocs.stacklok.com/ai-gatewayread 2026-09-22

Developers get an API, described in the Arcade API Reference, and a Contextual Access Webhook API. SDKs appear throughout the framework guides, alongside the Arcade CLI and an open source MCP framework in Python and JavaScript for building MCP servers that Arcade hosts or connects. The Arcade plugin, released in October 2026, installs into Claude Code, Cursor, Codex, VS Code, Copilot CLI and Claude Desktop, and any remote MCP client can connect through one server URL. The REST API behind audit logs is called with an Arcade API key.

Sourcedocs.arcade.dev/llms.txtread 2026-10-24

Builders get ToolHive, an Apache 2.0 open source platform with a CLI, desktop UI and Kubernetes operator. Its Registry Server implements the MCP registry API for servers, skills and plugins. Stacklok Enterprise publishes a REST API reference for the Enterprise Manager, Connector Gateway and AI Gateway. It also publishes custom resource definitions for authorization and a management API for budgets.

Sourcedocs.stacklok.com/toolhiveread 2026-09-22

The arcade evals command runs evaluation suites that the customer writes against its tools. It gives detailed results and critic feedback, a failures only view, multiple runs for stability and comparisons across providers and models in one run. Capture mode records the tool calls a model makes without scoring them, so they can become test expectations, and Arcade describes its evals as catching hallucinated and destructive calls before they run.

Sourcedocs.arcade.dev/en/build/create-tools/evaluate-tools/run-evaluationsread 2026-10-24

Before an MCP server goes to production, ToolHive's CLI can test and validate it. The registry applies review criteria before a server is listed. There are no scored test cases, pass rates or judge verdicts that give a readable result to compare one change against another.

Sourcedocs.stacklok.com/toolhive/guides-cli/test-mcp-serversread 2026-09-22

Actions go through authenticated APIs and MCP tools. Arcade names no browser, desktop or remote computer session that it runs for an agent. Some toolkits connect to scraping and sandbox services that other vendors run.

Sourcearcade.devread 2026-10-24

The product governs and runs MCP servers and model traffic, and drives no interface itself. It operates no browser, desktop or remote computer session for an agent, and no headless fetch or third party browsing engine is wired in.

Sourcedocs.stacklok.com/toolhiveread 2026-09-22