AI agent support for Super Connect: how the field does it

Research date: 2026-09-18. Competitor claims were verified against docs source in public GitHub repos (Nango, Composio, Trigger.dev) and vendor pages via search snippets; vendor sites themselves were blocked from this session. Super Connect facts come from the mertdogar/super-connect repo at commit fc3f96a. Items marked (snippet) rest on search summaries only; pricing figures are approximate.

1. The short version

Every serious player has converged on the same shape in 2026, and Super Connect already owns the hard half of it.

The product is "an MCP server per end user, minted by your backend." Nango calls it Agent sessions (public beta, 2 Sept 2026). Composio calls it Sessions (ex Tool Router, GA Dec 2025). Pipedream, Klavis, Paragon, Unified and Apideck all ship the same thing under different names.
Nobody loads thousands of tool schemas into the context. The winning pattern is 3 to 7 meta-tools: search tools, get schema, execute, manage connections, optional raw proxy. Anthropic's tool search and the 2026-07-28 MCP spec push in the same direction.
Auth happens mid-conversation. When the user has not connected an app, the tool call returns a connect link and the agent pastes it into the chat. Super Connect's connectLink already exists for exactly this.
Tokens never reach the model. Execution stays server side; the agent only sees results. Composio's May 2026 breach (malicious tool definitions in the sandbox, ~10k tokens exfiltrated) is the field's cautionary tale.
Trigger.dev is a customer, not a competitor. It dropped its own OAuth integrations in v3 and now ships a "use Nango for per-user OAuth" guide. A Super Connect guide of the same shape is a cheap distribution win.

Super Connect already has the primitives the others built agent layers on: 2,211 zod-typed actions across 68 catalogs whose JSON Schema is served by the actions listing route, a raw proxy with refresh, an invocation log, connect links, health, and inbound webhooks. What is missing is the agent-facing surface: a per-user MCP endpoint with meta-tools, SDK helpers that turn actions into framework tools, tool annotations, and docs written for agent builders. Recommendation: build "Agent sessions" on Cloudflare in three phases (section 6).

2. Where Super Connect stands today

From the repo, not the docs:

Primitive	State	Agent relevance
Typed actions	2,211 actions, vendored from Nango's catalog format (`createAction` with zod input/output). `listActions` in `src/catalog.ts` already emits JSON Schema per action.	Tool definitions are one function call away.
Action tags	Only ~110 actions carry `read`, `write` or `destructive` tags in `index.generated.ts`.	MCP tool annotations (`readOnlyHint`, `destructiveHint`) need these on every action.
Raw proxy	`/proxy/:id/*` with refresh, ownership check by `X-User-Id`.	The escape-hatch tool Nango calls `nango_proxy`.
Connect sessions	`POST /connect/sessions` returns a `connectLink` usable without the modal.	The "auth link in chat" flow.
Health	Derived, with `needs_reauthorization` filter.	Agent can tell the user to reauthorize instead of failing silently.
Invocations	Every proxy call and action run is logged.	Audit trail and metering for tool calls.
Webhooks	Outbound auth events, inbound Slack and GitHub adapters.	Triggers for agents. Stable event `id` already there for idempotency.
Runtime	Cloudflare Worker, D1, cron every 10 min, Better Auth with `organization`, `admin` and `apiKey` plugins.	Cloudflare's Agents SDK and `workers-oauth-provider` are first-party fits.
Agent-operable docs	`llms.txt`, a skill inside `@super-connect/client`, a coding-agent setup how-to.	Already ahead of most on the "coding agent builds the integration" side. Nothing yet on the "product agent uses the integration" side.

Limits that matter for an agent layer: 30 s action wall clock, 50 subrequests per action, D1 as the store.

3. Competitor by competitor

Nango (closest model, and the one Super Connect already tracks)

Nango repositioned in 2025 to 2026 as "the integrations layer for AI agents" and has three MCP surfaces:

Per-connection MCP (May 2025): https://api.nango.dev/mcp, Streamable HTTP only, auth by secret key plus connection-id and provider-config-key headers. Exposes the integration's enabled actions as tools. For your backend, not for end users pasting a URL into ChatGPT.
Agent sessions (public beta, 2 Sept 2026): POST /sessions returns a session token, an mcp_url of the form /session/<id>/mcp, and an expiry (60 s to 15 days). The body selects a tenant's connections by tags or explicit pins, an allow or deny toolset, pinned_tools that appear in tools/list immediately, and meta-tools: nango_tool_search, nango_execute, and an opt-in nango_proxy (raw HTTP with credential headers stripped, 5 MB cap). Everything not pinned is searchable but unlisted. Sessions are immutable and revocable. Docs show wiring for Anthropic's MCP connector, OpenAI Responses, Vercel AI SDK, LangChain and Mastra.
Management MCP (beta, July 2026): https://mcp.nango.dev/mcp for coding agents to manage integrations, connections, deploy functions and search docs, scoped by API key permissions.

Also: MCP Auth, where Nango OAuths a user against a third-party MCP server (Notion, HubSpot, Linear, Supabase) and proxies JSON-RPC to it, with CIMD support since July 2026. Tool calling without MCP is "wrap triggerAction in your framework's tool()"; there is no first-party AI SDK package. A remote Functions API (compile, dry-run, deploy) lets an agent inside a customer's product generate a just-in-time integration.

Pricing: MCP and agent sessions are not a separate SKU. Free cloud plan includes them; free self-hosting excludes functions, webhooks and MCP. Metered on connections, action executions, records and proxy requests. Gaps: no OAuth front door for consumer MCP clients, sessions must resolve to exactly one connection per integration, docs inconsistencies around the MCP proxy path.

Composio (most agent-native, most cautionary)

Composio is tools plus auth for agents: 1,000+ toolkits, 20k+ tools, per-user connected accounts. In 2026 the product recentred on Sessions: composio.create(userId, { toolkits, authConfigs }) yields a handful of meta-tools (COMPOSIO_SEARCH_TOOLS, GET_TOOL_SCHEMAS, MANAGE_CONNECTIONS, WAIT_FOR_CONNECTIONS, MULTI_EXECUTE_TOOL, plus a remote sandbox and bash tool). Search responses embed usage-derived "skills" (recommended plan steps, known pitfalls). The direct path (tools.get(userId, { tools }) formatted for OpenAI, Anthropic, Vercel, LangChain, Google ADK, Mastra and more) is now labelled legacy. Any session can be exposed as a hosted MCP endpoint with mcp: true; a shared Composio Connect MCP server does OAuth sign-in to Composio for Claude, ChatGPT and Cursor users, then obtains per-app credentials via Connect Links. Rube, the consumer MCP, was shut down in May 2026.

Auth in chat: MANAGE_CONNECTIONS returns a Connect Link the agent pastes into the conversation; headless code does session.authorize(toolkit) then waitForConnection(). Customers can bring their own OAuth app. Triggers: per-user trigger instances, one webhook URL per project, triggers.parse() verifies the signature. Execution extras: before and after modifiers (do not run over MCP), custom tools that inherit a toolkit's auth, proxy execute, pinned toolkit versions, file handling.

Pricing was restructured on 15 Aug 2026 (snippet): reported as roughly 13 to 16 times more per tool call for new signups, with grandfathering to year end. Criticisms: the May 2026 breach, closed-source toolkits, reliability incidents, extra LLM turns from the search-then-execute pattern.

Trigger.dev (durable agent runtime, explicitly not an auth broker)

Trigger.dev positions itself as "the open source platform for durable AI agents." Relevant features: chat.agent() durable multi-turn agents (GA July 2026), Sessions with durable in and out streams, ai.toolExecute(task) to run a schema task as a durable subtask when the model calls a tool, waitpoints (wait.forToken) for human approval with no compute billed while waiting, idempotency keys on triggers, Realtime Streams v2, an MCP server and Agent Skills for coding assistants.

The stance on third-party auth is unambiguous: v3 removed integrations ("just use official SDKs"), and the docs ship a "Nango OAuth with Trigger.dev" guide where the task receives a connectionId in its payload and fetches a fresh token inside the run. No Composio or Pipedream guide exists. Lessons for Super Connect: expose credentials by reference so a token can be fetched fresh on every retry, accept an idempotency key on write actions, give webhook events stable IDs, and ship a guide of the same shape.

The rest of the field

Platform	Agent surface	Auth pattern	Pricing note
Pipedream Connect	Per-user remote MCP at `remote.mcp.pipedream.net` keyed by `externalUserId` and app slug; tool discovery mode; returns a Connect Link inline when unconnected.	Connect API with external user id.	~$99/mo plus ~$2 per external user (snippet). Nango claims it looks unmaintained since late 2025.
Paragon ActionKit	Open-source MCP server (MIT), 1,000+ actions, JWT-authenticated per-user sessions, magic links to the Connect Portal.	Per-user Connect Portal.	Quote based, five-figure minimums.
Arcade.dev	"Auth-first" tool calling: `tools.authorize({tool_name, user_id})` returns a URL, agent surfaces it, then `wait_for_completion`. Hosted MCP gateway. $60M Series A June 2026 (snippet).	Arcade runs OAuth, vaults tokens.	Free 100 auth challenges; $0.05 per challenge, $0.01 per execution beyond.
Klavis (Strata)	One MCP server with progressive discovery: categories, then read/write/search action types, then one schema, then execute. Claims +13% accuracy.	Per-user hosted OAuth, white-label links.	~$79 to $399/mo (snippet).
Merge Agent Handler	One MCP endpoint over hundreds of connectors, DLP scanning, audit trail, tool scoping per agent surface, Groups for shared org credentials.	Merge Link.	Free 2,000 credits/mo, then contract.
Apideck	Dynamic mode: four meta-tools (`list_tools`, `describe_tool`, `execute_tool`, `list_scopes`) at ~1,300 tokens. Vault handles refresh.	Vault.	Not surfaced.
Unified.to	Hosted MCP bound to one customer connection per session; tools reflect scopes.	Connection-scoped.	From ~$750/mo.
Membrane (ex Integration.app)	Hosted MCP over all ops; "self-integrating" agents that generate connectors; Skills Directory.	OAuth on connect.	Free plus usage.
Pica	ToolKit for Vercel AI SDK, AuthKit embed, MCP with vector search over actions.	Embedded connect component.	Usage based.
Zapier, Make, n8n	MCP over their own automations; Zapier bills 2 tasks per tool call. Not per end user of your product.	Their own accounts.	Task pool.

Identity vendors have named the "outbound token for an agent" plane explicitly: Auth0 Token Vault (RFC 8693 token exchange to a federated connection token), WorkOS Pipes (session-scoped, human-approved tool access), Descope Outbound Apps. Stytch and Clerk cover the inbound plane only (your app or MCP server as an OAuth 2.1 provider with DCR and CIMD).

4. Standards that shape the design

MCP 2026-07-28 is the current spec: stateless core, multi round-trip requests replacing server-initiated requests (so elicitation, including URL-mode elicitation for auth links, works statelessly), header-based routing, cacheable list results, formal extensions for Tasks and MCP Apps, CIMD preferred over DCR for client auth. A stateless design is what a Cloudflare Worker wants anyway.
Tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) are required by the Claude connectors directory and drive approval UI in OpenAI's require_approval and Vercel AI SDK's human-in-the-loop.
Anthropic's MCP connector in the Messages API takes an mcp_servers list with a bearer token, so a minted session token is enough; no OAuth needed for backend agents. OpenAI Responses type: "mcp" and Vercel @ai-sdk/mcp are the same shape.
Anthropic tool search / defer_loading cuts ~85% of tool tokens and is the non-MCP version of "search then execute."
Agent Skills (SKILL.md) is an open standard now; Super Connect already ships one.
Cloudflare: @cloudflare/workers-oauth-provider v0.3 supports CIMD and works with claude.ai; the Agents SDK has createMcpHandler and McpAgent. Cloudflare's own remote servers already speak 2026-07-28.

5. Cross-cutting patterns worth copying

Backend mints a scoped, expiring session; agent gets an MCP URL and a bearer token. Scope = end user, allowed integrations, allowed tools, expiry. Immutable, revocable.
Meta-tools instead of catalog dumps. Search, describe, execute, manage connections, optional proxy. Pinned tools for the few the customer always wants listed.
Connect link mid-conversation. The execute or manage-connections tool answers "not connected, here is a link" and the agent relays it. Composio and Pipedream both do this; Arcade's whole product is this.
Credentials by reference, fetched fresh on every attempt. Never mint a token at trigger time and carry it through a durable run.
Annotate every tool. Read, write, destructive. Let hosts gate approval.
Idempotency on writes and stable event IDs on webhooks. Retrying agents double-post otherwise.
Meter per tool call. Everyone counts executions; Arcade also counts auth challenges.
Two auth planes, kept apart. Who the MCP client is (org API key or session token today; OAuth 2.1 with CIMD later if consumer clients matter) versus whose third-party account is used (connection owned by userId).

6. Proposal for Super Connect: Agent sessions

Stay inside the four nouns. An agent session is a connect session's sibling: a scoped credential for using connections rather than creating them.

Phase 1: tools without MCP (days)

Fill in read, write or destructive tags on all 2,211 actions (generate from HTTP method in the action body, then hand-check the destructive ones) and expose them as MCP-style annotations in the actions listing.
Add sc.tools(connectionId, { actions?, format }) to @super-connect/client returning tool definitions for Vercel AI SDK, OpenAI and Anthropic, with execute bound to runAction. Zero new server work; the JSON Schema already exists.
Ship a docs/how-to/tool-calling.md and a Trigger.dev guide mirroring Nango's: task payload carries connectionId, the task calls proxy or runAction fresh on each attempt.
Accept an Idempotency-Key header on action runs; store the key with the invocation and replay the stored result within a window. Write actions in agent loops need this.

Phase 2: agent sessions MCP endpoint (weeks)

POST /api/v1/agent/sessions { userId, allowedIntegrations?, tools?: allow|deny, pinnedTools?, proxy?: boolean, expiresIn } returns { sessionId, token, mcpUrl, expiresAt }. Hash-stored like connect sessions, revocable with DELETE.
POST /mcp/:sessionId speaks Streamable HTTP, stateless, spec 2026-07-28, bearer = session token. Runs on the existing Worker; the @modelcontextprotocol/sdk server works on Workers, or use Cloudflare's createMcpHandler.
Tools: search_tools (keyword over name, description and tags for the session's integrations; a small D1 FTS table or in-memory over the loaded catalogs), get_tool_schema, execute ({ tool: "github__create-issue", input } routed to invokeAction with the user's connection), manage_connections (lists connections with health; for a missing or needs_reauthorization one, mints a connect session and returns the connectLink), and proxy (off by default, strips credential headers, caps body size). Pinned tools appear directly in tools/list with their annotations.
Every execute is an invocation row with session_id, so the existing log is the audit trail and the metering source.
Wire-up docs for Anthropic MCP connector, OpenAI Responses, Vercel @ai-sdk/mcp, Claude Agent SDK and Mastra, copied in shape from Nango's page.

Phase 3: events and approvals (weeks, optional)

Expose inbound provider webhooks as a per-session events resource or a customer webhook with a stable id, so Trigger.dev-style runs can fan out with idempotency keys. Slack and GitHub adapters already exist.
A requires_approval list on the session: destructive tools return an approval token instead of running, the customer's UI completes it. This is the WorkOS Pipes and Trigger.dev waitpoint pattern, and it plays well with hosts that already gate on destructiveHint.

Deliberately deferred

Consumer MCP with OAuth sign-in (Claude.ai, ChatGPT, Cursor users connecting directly). That is a different product with a different buyer, it requires an OAuth 2.1 provider with CIMD, and Nango has stayed out of it. If it ever matters, workers-oauth-provider or Better Auth's OAuth provider plugin make it feasible on the current stack.
Syncs and records. Nango's "syncs as knowledge" story is a much bigger runtime commitment than a Worker with a 30 s limit should take on now.
Sandboxes. Composio's remote workbench is where its breach happened. Not the layer to compete on.

Pricing

Follow Nango, not Composio: agent sessions included on every plan, metered on action executions (an MCP execute is an invocation like any other) and connection-months, which already exist in src/billing.ts. Composio's August 2026 repricing is a visible opening for "simpler, cheaper hosted alternative" positioning.

7. Risks

Context bloat versus extra turns. Meta-tools cost one search turn per task. Pinned tools mitigate it; measure with the invocation log.
Tool definition integrity. Actions are vendored code compiled into the Worker, never registered at runtime, which is the safeguard Composio lacked. Keep it that way; no customer-supplied tool code in the execution path.
Worker limits. Loading a large catalog on a cold start for search; keep listings cached per isolate and consider a precomputed search index at build time.
Session semantics. Nango's "exactly one connection per integration" rule is a known annoyance. Allow several and let manage_connections disambiguate.
Spec churn. Target 2026-07-28 stateless mode, avoid server-initiated requests, and keep the transport layer thin.

8. Sources

Nango: docs source in NangoHQ/nango (guides/agent-sessions.mdx, updates/changelog.mdx, reference/backend/management-mcp.mdx, guides/auth/mcp-auth.mdx, guides/platform/self-hosting.mdx, getting-started/use-cases/tool-calling.mdx, packages/shared/lib/services/plans/definitions.ts), NangoHQ/nango-mcp-client-example, NangoHQ/skills, PR #7390, issue #6647. Composio: docs source in ComposioHQ/composio@next (how-composio-works, configuring-sessions, sessions-via-mcp, composio-connect, sessions-vs-direct-execution, triggers, authentication/*, extending-sessions/*, sandbox/remote), pricing and breach coverage via composio.dev, scalekit.com and material.security (snippet). Trigger.dev: docs source in triggerdotdev/trigger.dev (guides/ai-agents/overview.mdx, guides/frameworks/nango.mdx, guides/use-cases/upgrading-from-v2.mdx, tasks/schemaTask.mdx, wait-for-token.mdx, idempotency.mdx, mcp-tools.mdx, ai-chat/*), trigger.dev/pricing (snippet). Others: pipedream.com/docs/connect/mcp, docs.useparagon.com/actionkit, docs.arcade.dev, klavis.ai blog, docs.merge.dev/merge-agent-handler, docs.unified.to/mcp, developers.apideck.com/mcp, docs.getmembrane.com, docs.picaos.com, docs.zapier.com/mcp, auth0.com/ai/docs/intro/token-vault, workos.com/blog/pipes-mcp, docs.descope.com/identity-federation/outbound-apps, stytch.com and clerk.com AI docs. Standards: modelcontextprotocol.io specification changelog 2026-07-28, platform.claude.com MCP connector and tool search docs, openai.github.io/openai-agents-python/mcp, vercel.com/docs/mcp, agentskills.io, github.com/cloudflare/workers-oauth-provider, developers.cloudflare.com/agents.