Arcade

As an actions runtime, Arcade offers 8,000+ permission aware tools plus custom or third party MCP servers the customer builds or brings (homepage). Authorization is delegated so the agent acts as its user within scope, Arcade handles OAuth across dozens of auth providers, and hosted remote MCP servers connect through Arcade to systems such as Salesforce, ServiceNow, GitHub, Atlassian and Snowflake, among others (docs). Agents take authenticated action in outside systems through that framework.

Sourcearcade.devread 2026-09-22

Arcade executes the tool calls an agent makes and returns results. Sequencing, branching and multi agent handoff live in the customer's own framework, and Arcade publishes setup guides for frameworks such as LangChain, CrewAI, OpenAI Agents, Google ADK and Mastra, among others. No workflow runtime of its own is documented, so retries, routing and deterministic workflow steps sit outside the platform.

Sourcearcade.devread 2026-09-22

Agents get authenticated tools that read from and act in outside systems, but no retrieval structure that Arcade maintains over the customer's documents, such as an index, graph or embeddings layer, is documented.

Sourcearcade.devread 2026-09-22

Contextual access runs the customer's own policy logic inline. An access hook decides which tools each user can see, a pre execution hook allows, denies or modifies inputs before each tool call, and a post execution hook allows, denies or modifies the output. Users authorize each scope before a tool acts for them, and rate limits apply. These are customer controlled limits on what an agent may do, but no step where a person reviews or approves an action before it commits is documented, and consent to a scope is not review of an action.

Sourcedocs.arcade.dev/en/operate/governance/contextual-accessread 2026-09-22

The access surface is deep and first party. Authentication runs against the customer's identity provider (Okta, Microsoft Entra ID, Auth0 and Stytch user sources in the docs), and authorization is delegated so an agent acts as its user and never past its own scope. Contextual access hooks enforce the customer's policies on every tool call, role based access control has organization admin, project admin and member roles, and SSO and audit logs are included on Enterprise (homepage and pricing page). No security attestation is published.

Sourcearcade.devread 2026-09-22

Every action taken through Arcade leaves one record naming the agent, the user and the system, streamed to the customer's SIEM (homepage). Administrative actions are captured separately in an audit log that is on by default, with a filterable dashboard and a REST API for pulling events into the customer's SIEM or compliance tooling (Audit Logs page). Agent behavior and admin activity are recorded apart, and both export to the customer's own tools.

Sourcedocs.arcade.dev/en/operate/governance/audit-logsread 2026-09-22

Each user's OAuth tokens and authorization grants are kept so tools can act without asking for consent again. No memory layer that persists an agent's state or a user's context across runs is documented, and the stored credentials carry no such state.

Sourcearcade.devread 2026-09-22

Customers choose between Arcade Cloud and their own infrastructure. A turnkey Arcade operated platform can be deployed into the customer's cloud account (Azure Marketplace managed app, AWS private offer), or a self managed Helm deployment can run on the customer's Kubernetes cluster, for data residency, network isolation or compliance (Hosting options page). The pricing page adds VPC and fully air gapped deployment on Enterprise.

Sourcedocs.arcade.dev/en/operate/deployread 2026-09-22

The catalog holds tools and MCP servers, which give an agent actions rather than doing work when selected, and the sample apps are example code. No ready made workflows, templates or named prebuilt agents of Arcade's own are documented.

Sourcearcade.devread 2026-09-22

Tools in Arcade run when an agent or MCP client calls them. No schedule, event, webhook or inbound queue that starts an agent run is documented, so nothing wakes an agent without a caller.

Sourcearcade.devread 2026-09-22

Any client, any model and any framework the customer picks can use Arcade's tools (homepage), with setup guides for the customer's own LLM and for frameworks such as LangChain, OpenAI Agents, Google ADK, CrewAI, Mastra and Vercel AI SDK, among others. The evaluation command runs against the providers and models the customer names, so the model stays the customer's choice throughout.

Sourcearcade.devread 2026-09-22

Developers get a documented API (the Arcade API Reference and a Contextual Access Webhook API), SDKs used in the framework guides, the Arcade CLI, and an MCP framework for building MCP servers that Arcade hosts or connects. The Audit Logs page shows the REST API called with an Arcade API key.

Sourcedocs.arcade.dev/llms.txtread 2026-09-22

The arcade evals command runs evaluation suites the customer writes against its tools, with detailed results and critic feedback, a failures only view, multiple runs and output formats, and comparisons across providers and models in one run (Run evaluations page), alongside a documented comparative evaluations guide. The results are scored and comparable, showing how the customer's agent uses its tools.

Sourcedocs.arcade.dev/en/build/create-tools/evaluate-tools/run-evaluationsread 2026-09-22

Arcade acts through authenticated APIs and MCP tools, and no browser, desktop or remote computer session that it runs for an agent is documented. The toolkits that reach other vendors' scraping and sandbox services lead to those vendors' capabilities rather than Arcade's own.

Sourcearcade.devread 2026-09-22