This comparison is part of our MCP comparisons, within The MCP Guide. Facts are checked against each vendor's own documentation and pricing pages on the date shown.
Pick Cloudflare if you want to host a small, fast remote MCP server on Workers or give staff one approved MCP URL behind Cloudflare Zero Trust. Pick AWS AgentCore if your APIs, Lambda functions and identity already live in AWS and you want a managed gateway that turns them into MCP tools.
Both clouds cover the same two jobs: running MCP servers and putting a gateway in front of them. They split the work differently and price it differently.
Checked against: Cloudflare's remote MCP server guide and AWS's AgentCore Gateway docs on 28 October 2026. eSEOspace did not test either product.
Key Takeaways
- Cloudflare hosts remote MCP servers on Workers with the Agents SDK; AWS hosts them in AgentCore Runtime as containers.
- AgentCore Gateway converts APIs, Lambda functions and existing services into MCP tools, with OpenAPI, Smithy and Lambda as input types.
- Cloudflare's MCP server portals put up to 80 remote MCP servers behind one URL, controlled by Zero Trust Access policies.
- Workers Paid starts at a $5 monthly minimum; AgentCore Gateway charges $0.005 per 1,000 API invocations, plus other usage fees.
- Both support OAuth sign-in for MCP clients, but you set it up differently: Workers OAuth Provider on Cloudflare, a JWT authorizer such as Cognito or Auth0 on AWS.
At a glance
| Item | Cloudflare | AWS AgentCore |
|---|---|---|
| Host your own MCP server | Workers, Agents SDK (createMcpHandler) | AgentCore Runtime, MCP protocol containers |
| Transport | Streamable HTTP at /mcp | Stateless or stateful Streamable HTTP at /mcp |
| Turn APIs into MCP tools | Not documented on the pages checked | Gateway: OpenAPI, Smithy, Lambda |
| Combine many servers behind one URL | MCP server portals (up to 80 per portal) | Gateway composition behind one endpoint |
| Tool search for large tool sets | Not documented | Semantic tool selection |
| Staff access control | Zero Trust Access policies, identity provider | OAuth inbound auth; fine-grained access control |
| Starting price | Workers Free; Paid from $5/month minimum | Pay per use; up to $200 Free Tier credits for new AWS customers |
Where Cloudflare is stronger
Simple hosting for remote servers
Cloudflare's remote MCP server guide builds a server with createMcpHandler from the Agents SDK. The handler is stateless and creates a fresh server per request. You can deploy from the dashboard in one click or with npx wrangler deploy. Data that must outlive a request goes in a binding such as KV, D1 or a Durable Object.
The guide says any client with Streamable HTTP support can connect to the deployed /mcp endpoint. It gives a Claude Code example. Note that the older McpAgent class is now deprecated, so new projects should follow the current guide. Our lesson on deploying a remote MCP server explains the steps in plain English.
A portal for staff
Cloudflare's MCP server portal docs say a portal "centralizes multiple Model Context Protocol (MCP) servers onto a single HTTP endpoint." Admins can turn off individual tools or use an allowlist. A server link "will only appear in the portal for users who match an Allow policy." This is useful when you want staff to reach approved third-party servers, not just your own.
Data loss checks
Portal traffic can route through Cloudflare Gateway, where data loss prevention (DLP) policies scan it. The docs note that DLP inspection requires TLS decryption, which portals handle automatically.
Low entry price
Cloudflare's Workers pricing page lists a free plan with 100,000 requests a day. That is often enough to prototype an internal MCP server.
Where AWS AgentCore is stronger
APIs and Lambda become tools
AWS's Gateway docs describe "a fully managed AI gateway" that "converts APIs, Lambda functions, and existing services into Model Context Protocol (MCP)-compatible tools." It supports OpenAPI, Smithy and Lambda as tool input types. It also lists one-click integrations with Salesforce, Slack, Jira, Asana and Zendesk.
Inbound and outbound auth in one place
The docs say Gateway manages "both inbound authentication (verifying agent identity) and outbound authentication (connecting to tools)." It handles OAuth flows, token refresh and credential storage for third-party services. That saves you from storing each tool's keys in each agent.
Large tool catalogs
Gateway's semantic tool selection lets agents search for the right tool. AWS says this allows agents "to use thousands of tools while minimizing prompt size and reducing latency." Cloudflare's portal pages do not describe a search feature.
Stateful servers
The AgentCore Runtime MCP guide supports stateless and stateful Streamable HTTP servers. Stateful mode enables elicitation, sampling and progress notifications. Those are MCP features where the server asks the user a question, asks the model for text, or reports progress. See our explainer on MCP elicitation.
Pricing
Cloudflare Workers, from the Workers pricing page on 28 October 2026:
| Cloudflare item | Price |
|---|---|
| Workers Free | $0; 100,000 requests a day, 10 ms CPU per invocation |
| Workers Paid | $5 a month minimum; 10 million requests included, then $0.30 per million |
| Workers Paid CPU | 30 million CPU ms included, then $0.02 per million CPU ms |
| Durable Objects (Paid) | 1 million requests included, then $0.15 per million, plus duration charges |
Cloudflare's Zero Trust plans page offers a free plan for a proof of concept but does not list per-user prices. The portal docs show no pricing. Exporting portal logs with Logpush is Enterprise only.
AWS AgentCore, from the AgentCore pricing page on 28 October 2026:
| AgentCore item | Price |
|---|---|
| Gateway API invocations (ListTools, InvokeTool, Ping) | $0.005 per 1,000 |
| Gateway search API | $0.025 per 1,000 |
| Gateway tool indexing | $0.02 per 100 tools a month |
| Runtime CPU (v1) | $0.0895 per vCPU-hour |
| Runtime memory (v1) | $0.00945 per GB-hour |
| Identity | $0.010 per 1,000 token or key requests; no extra charge through Runtime or Gateway |
AWS bills Runtime per second with a 1-second minimum. A newer v2 Runtime has different rates on the same page. New AWS customers can get "up to $200 in Free Tier credits," per AWS.
Both models are usage-based. Estimate your monthly tool calls before you compare them.
Security and admin controls
| Control | Cloudflare | AWS AgentCore |
|---|---|---|
| Client sign-in to your server | Optional OAuth with Workers OAuth Provider | JWT authorizer (Cognito, Auth0 and others) |
| OAuth discovery | 401 response points the client to the auth server | 401 with protected resource metadata URL |
| Who sees which server | Access Allow policies per server and portal | Gateway OAuth and fine-grained access control |
| Credentials for upstream tools | Not detailed for portals | Gateway injects per-tool credentials |
| Logs | Access logs each tool request; Gateway HTTP logs | Built-in observability and auditing |
| Requirements | Active domain on Cloudflare plus an identity provider in Zero Trust | AWS account; Cognito or another identity provider |
Cloudflare's portal docs list limits. Only remote HTTP MCP servers are supported, and some Access features, such as independent MFA, do not apply to servers authorized through a portal. On AWS, the Runtime guide notes that OAuth-configured runtimes follow OAuth 2.0 and return a resource metadata URL. Our MCP authentication guide explains how that discovery works.
Which to choose
Pick Cloudflare if:
- You are building one or two remote MCP servers and want cheap, fast hosting.
- Your company already uses Cloudflare Zero Trust and wants one approved MCP URL for staff.
- You want DLP scanning on MCP traffic.
Pick AWS AgentCore if:
- Your business logic already sits in Lambda functions or APIs described with OpenAPI or Smithy.
- You need inbound and outbound OAuth handled in one managed service.
- Your agents need to search across a large tool catalog.
Mixed setups are common. You can host a server anywhere and still reach it through either gateway. For the full field, see our list of MCP gateways, the Cloudflare MCP server profile and our other MCP comparisons.
Next step
Write down where your data and APIs live today, and how many tool calls you expect each month. That usually points to one cloud. If you want help building or hosting the server, our MCP development team can scope it with you.
Frequently asked questions
Can I host an MCP server on Cloudflare for free?
Workers Free includes 100,000 requests a day, per Cloudflare's pricing page. That is often enough for testing. Production use usually moves to Workers Paid, which has a $5 monthly minimum.
Does AWS AgentCore host MCP servers or just route to them?
Both. AgentCore Runtime runs MCP server containers at /mcp, and AgentCore Gateway converts APIs and Lambda functions into MCP tools behind one endpoint.
Do Cloudflare MCP portals work with local stdio servers?
No. Cloudflare's docs say only remote HTTP MCP servers are supported. A stdio server must be hosted behind an HTTP endpoint first.
Which one is cheaper?
It depends on volume. Cloudflare charges per request and CPU time, with a $5 monthly minimum on Workers Paid. AgentCore charges per gateway call, per search and per tool indexed, plus Runtime compute.
