{
  "@context": "https://schema.org",
  "name": "IdentityConnectors",
  "description": "Evidence-first discovery of identity, authentication, authorization, credential and workload-identity infrastructure for AI agents and developers.",
  "domain": "identityconnectors.com",
  "snapshot_date": "2026-09-23",
  "recommendation_endpoint": "https://identityconnectors.com/api/recommend?q={natural-language-task}",
  "ai_recommendation_endpoint": "https://identityconnectors.com/api/ai-recommend?q={natural-language-task}",
  "representative_queries": [
    "My agent needs Gmail and Salesforce access on behalf of users, with OAuth tokens kept outside the model and MCP support.",
    "Find identity infrastructure for delegated Microsoft 365 access plus workload identity.",
    "I need fine-grained authorization for a RAG agent so users only retrieve documents they are allowed to see.",
    "Which identity systems explicitly support AI-agent identity or MCP authorization?"
  ],
  "evidence_semantics": "Unknown support is not treated as confirmed support.",
  "count": 30,
  "records": [
    {
      "slug": "workos",
      "name": "WorkOS",
      "provider": "WorkOS",
      "description": "Enterprise identity infrastructure for adding SSO and directory provisioning to SaaS applications.",
      "category": "Identity Platform",
      "website": "https://workos.com",
      "docs_url": "https://workos.com/docs",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Directory Sync",
        "SCIM Provisioning",
        "Audit & Governance",
        "Delegated OAuth",
        "Token Management",
        "Fine-Grained Authorization"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "SCIM"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://workos.com/docs/authkit/mcp",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 75,
      "best_for": "B2B SaaS teams that need enterprise SSO and directory provisioning without building IdP-specific integrations.",
      "representative_query": "I need to add enterprise SSO and directory provisioning for customers using Okta and Microsoft Entra.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-23",
      "tracked_website_url": "https://identityconnectors.com/go/provider/workos",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/workos"
    },
    {
      "slug": "auth0",
      "name": "Auth0",
      "provider": "Okta",
      "description": "Customer identity platform supporting OAuth/OIDC, enterprise federation and machine-to-machine access.",
      "category": "Identity Platform",
      "website": "https://auth0.com",
      "docs_url": "https://auth0.com/docs",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Social Login",
        "Delegated OAuth",
        "Token Management",
        "Fine-Grained Authorization",
        "Credential Brokering",
        "Consent Management"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "JWT",
        "Client Credentials",
        "PKCE"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": true,
      "credential_vaulting": true,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://auth0.com/blog/auth0-auth-for-mcp-servers-generally-available/",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 85,
      "best_for": "Applications needing customer identity, delegated OAuth and machine-to-machine authorization with a broad ecosystem.",
      "representative_query": "My SaaS needs user login, enterprise federation, delegated API access and backend machine tokens.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-23",
      "tracked_website_url": "https://identityconnectors.com/go/provider/auth0",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/auth0"
    },
    {
      "slug": "okta",
      "name": "Okta",
      "provider": "Okta",
      "description": "Enterprise identity platform with a large integration catalog and standards-based SSO, provisioning and service applications.",
      "category": "Identity Platform",
      "website": "https://www.okta.com",
      "docs_url": "https://developer.okta.com/docs/",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Directory Sync",
        "SCIM Provisioning",
        "Delegated OAuth",
        "Token Management",
        "Audit & Governance"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "SCIM",
        "Client Credentials"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Enterprises standardizing workforce identity, SaaS application SSO and provisioning across a large integration catalog.",
      "representative_query": "I need workforce SSO, SCIM provisioning and secure service access across many enterprise applications.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/okta",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/okta"
    },
    {
      "slug": "microsoft-entra-id",
      "name": "Microsoft Entra ID",
      "provider": "Microsoft",
      "description": "Microsoft identity platform for user, application, workload and increasingly agent identities across Microsoft and third-party resources.",
      "category": "Identity Platform",
      "website": "https://www.microsoft.com/en-us/security/business/microsoft-entra",
      "docs_url": "https://learn.microsoft.com/en-us/entra/identity-platform/",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Delegated OAuth",
        "Token Management",
        "Workload Identity",
        "Agent Identity",
        "Audit & Governance"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "JWT",
        "Service Account",
        "Client Credentials"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": true,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 70,
      "best_for": "Organizations using Microsoft 365/Azure that need user-delegated access, service principals, managed identities and emerging agent identity controls.",
      "representative_query": "My agent needs delegated Microsoft Graph access for users plus a separate machine identity for unattended tasks.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/microsoft-entra-id",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/microsoft-entra-id"
    },
    {
      "slug": "clerk",
      "name": "Clerk",
      "provider": "Clerk",
      "description": "Developer identity platform for application authentication, enterprise SSO, directory sync and OAuth provider use cases.",
      "category": "Identity Platform",
      "website": "https://clerk.com",
      "docs_url": "https://clerk.com/docs",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Directory Sync",
        "SCIM Provisioning",
        "Delegated OAuth"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "SCIM",
        "PKCE"
      ],
      "delegated_user_access": true,
      "service_to_service": false,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://clerk.com/docs/guides/ai/mcp/build-mcp-server",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Developer teams wanting fast application auth plus enterprise SSO/SCIM and OAuth-based access for third-party tools.",
      "representative_query": "I need my users to log in with enterprise SSO and authorize an MCP tool using their existing app identity.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-23",
      "tracked_website_url": "https://identityconnectors.com/go/provider/clerk",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/clerk"
    },
    {
      "slug": "stytch",
      "name": "Stytch",
      "provider": "Stytch",
      "description": "Authentication platform for consumer and B2B applications with enterprise identity and programmatic auth capabilities.",
      "category": "Identity Platform",
      "website": "https://stytch.com",
      "docs_url": "https://stytch.com/docs",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Directory Sync",
        "SCIM Provisioning",
        "Delegated OAuth",
        "Token Management",
        "Consent Management"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "SCIM"
      ],
      "delegated_user_access": true,
      "service_to_service": false,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://stytch.com/connected-apps",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "B2B applications needing flexible authentication and enterprise identity without operating their own auth stack.",
      "representative_query": "I need B2B authentication with SSO, SCIM and modern OAuth flows.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-23",
      "tracked_website_url": "https://identityconnectors.com/go/provider/stytch",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/stytch"
    },
    {
      "slug": "descope",
      "name": "Descope",
      "provider": "Descope",
      "description": "Customer identity platform with authentication flows, B2B SSO and enterprise federation.",
      "category": "Agent Identity & Trust",
      "website": "https://www.descope.com",
      "docs_url": "https://docs.descope.com",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Delegated OAuth",
        "Token Management",
        "Credential Brokering",
        "Consent Management",
        "Fine-Grained Authorization",
        "Agent Identity",
        "Workload Identity"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "JWT"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": true,
      "credential_vaulting": true,
      "agent_identity": true,
      "mcp": "Yes",
      "mcp_evidence_url": "https://docs.descope.com/mcp",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 100,
      "best_for": "Multi-tenant B2B applications that need flexible authentication flows and enterprise SSO.",
      "representative_query": "I need tenant-specific SSO with SAML or OIDC and programmatic authentication flows.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-23",
      "tracked_website_url": "https://identityconnectors.com/go/provider/descope",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/descope"
    },
    {
      "slug": "fusionauth",
      "name": "FusionAuth",
      "provider": "FusionAuth",
      "description": "Self-hostable or managed CIAM platform implementing OAuth2, OIDC, SAML and SCIM.",
      "category": "Identity Platform",
      "website": "https://fusionauth.io",
      "docs_url": "https://fusionauth.io/docs/",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Directory Sync",
        "SCIM Provisioning",
        "Delegated OAuth",
        "Token Management"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "SCIM",
        "JWT",
        "Client Credentials"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Teams needing a deploy-anywhere identity server with standards coverage and control over hosting.",
      "representative_query": "I need a self-hosted identity server with OAuth, OIDC, SAML and SCIM support.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/fusionauth",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/fusionauth"
    },
    {
      "slug": "frontegg",
      "name": "Frontegg",
      "provider": "Frontegg",
      "description": "Customer identity and access platform focused on B2B SaaS, enterprise SSO and self-service administration.",
      "category": "Identity Platform",
      "website": "https://frontegg.com",
      "docs_url": "https://developers.frontegg.com/",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Directory Sync",
        "SCIM Provisioning",
        "Delegated OAuth"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "SCIM"
      ],
      "delegated_user_access": true,
      "service_to_service": false,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 45,
      "best_for": "B2B SaaS products that want customer-facing enterprise identity and self-service SSO configuration.",
      "representative_query": "My enterprise customers need to configure their own SAML or OIDC connection inside my SaaS app.",
      "assessment_status": "Researching",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/frontegg",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/frontegg"
    },
    {
      "slug": "zitadel",
      "name": "ZITADEL",
      "provider": "ZITADEL",
      "description": "Open-source identity infrastructure for authentication, authorization, multi-tenancy and service accounts.",
      "category": "Identity Platform",
      "website": "https://zitadel.com",
      "docs_url": "https://zitadel.com/docs",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Delegated OAuth",
        "Token Management",
        "Workload Identity",
        "Audit & Governance"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "JWT",
        "Service Account",
        "Client Credentials",
        "PKCE"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Teams wanting open-source identity infrastructure with standards-based user and service authentication.",
      "representative_query": "I need one identity platform for user OIDC login and service-account access to APIs.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/zitadel",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/zitadel"
    },
    {
      "slug": "keycloak",
      "name": "Keycloak",
      "provider": "Red Hat / Keycloak",
      "description": "Open-source identity and access management server with identity brokering, OIDC, OAuth and SAML.",
      "category": "Identity Platform",
      "website": "https://www.keycloak.org",
      "docs_url": "https://www.keycloak.org/documentation",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Delegated OAuth",
        "Token Management"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "JWT",
        "Client Credentials"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Organizations wanting a mature self-hosted identity broker and standards-based SSO server.",
      "representative_query": "I need to self-host an identity broker that federates multiple SAML and OIDC providers.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/keycloak",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/keycloak"
    },
    {
      "slug": "supertokens",
      "name": "SuperTokens",
      "provider": "SuperTokens",
      "description": "Open-source authentication stack with application login, multi-tenancy and enterprise SSO capabilities.",
      "category": "Identity Platform",
      "website": "https://supertokens.com",
      "docs_url": "https://supertokens.com/docs",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Social Login",
        "Delegated OAuth"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML"
      ],
      "delegated_user_access": true,
      "service_to_service": false,
      "enterprise_sso": true,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 45,
      "best_for": "Developer teams that want open-source authentication with customizable application flows and enterprise SSO.",
      "representative_query": "I need open-source app authentication with tenant-specific SAML enterprise login.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/supertokens",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/supertokens"
    },
    {
      "slug": "ory",
      "name": "Ory",
      "provider": "Ory",
      "description": "Open-source identity infrastructure spanning OAuth/OIDC authorization, user identity and permissions services.",
      "category": "Identity Platform",
      "website": "https://www.ory.sh",
      "docs_url": "https://www.ory.sh/docs/",
      "capabilities": [
        "Authentication",
        "Delegated OAuth",
        "Token Management",
        "Fine-Grained Authorization"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "JWT",
        "Client Credentials",
        "PKCE"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": false,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Teams assembling an open identity stack with OAuth/OIDC authorization and separate identity/permissions components.",
      "representative_query": "I need an open-source OAuth authorization server plus identity and permission services.",
      "assessment_status": "Researching",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/ory",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/ory"
    },
    {
      "slug": "curity-identity-server",
      "name": "Curity Identity Server",
      "provider": "Curity",
      "description": "OAuth and OpenID Connect identity server with advanced token, federation and MCP authorization patterns.",
      "category": "Identity Platform",
      "website": "https://curity.io",
      "docs_url": "https://curity.io/resources/",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Delegated OAuth",
        "Token Management",
        "Fine-Grained Authorization",
        "Workload Identity"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "JWT",
        "mTLS",
        "Client Credentials",
        "PKCE"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://curity.io/resources/learn/implementing-mcp-authorization-apis/",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 75,
      "best_for": "Security-sensitive API platforms needing advanced OAuth/OIDC and standards-based authorization for MCP/API access.",
      "representative_query": "I need an OAuth authorization server for an MCP server with scoped tokens and token exchange to upstream APIs.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/curity-identity-server",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/curity-identity-server"
    },
    {
      "slug": "scalekit",
      "name": "Scalekit",
      "provider": "Scalekit",
      "description": "Auth and connector infrastructure for SaaS and AI agents, including AgentKit and OAuth 2.1 authorization for MCP servers.",
      "category": "Identity Connector Infrastructure",
      "website": "https://scalekit.com",
      "docs_url": "https://docs.scalekit.com/",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Delegated OAuth",
        "Token Management",
        "Credential Brokering",
        "Fine-Grained Authorization",
        "Agent Identity"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "SCIM",
        "Client Credentials",
        "PKCE"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": true,
      "credential_vaulting": true,
      "agent_identity": true,
      "mcp": "Yes",
      "mcp_evidence_url": "https://docs.scalekit.com/authenticate/mcp/quickstart/",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 100,
      "best_for": "Agent builders needing delegated app access, managed token storage and production OAuth authorization for MCP servers.",
      "representative_query": "My agent must connect to GitHub on behalf of users and my MCP server also needs OAuth 2.1 authorization.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/scalekit",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/scalekit"
    },
    {
      "slug": "permit-io",
      "name": "Permit.io",
      "provider": "Permit.io",
      "description": "Fine-grained authorization platform for RBAC, ABAC and relationship-aware application permissions.",
      "category": "Authorization",
      "website": "https://www.permit.io",
      "docs_url": "https://docs.permit.io/",
      "capabilities": [
        "Fine-Grained Authorization",
        "Audit & Governance"
      ],
      "auth_methods": [
        "JWT"
      ],
      "delegated_user_access": false,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://www.permit.io/blog/announcing-permit-mcp-gateway",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 40,
      "best_for": "Applications that need centralized fine-grained authorization policies separate from authentication.",
      "representative_query": "I need my agent and human users to share one fine-grained authorization policy layer.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-23",
      "tracked_website_url": "https://identityconnectors.com/go/provider/permit-io",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/permit-io"
    },
    {
      "slug": "oso",
      "name": "Oso",
      "provider": "Oso",
      "description": "Authorization infrastructure for application permissions and fine-grained access control.",
      "category": "Authorization",
      "website": "https://www.osohq.com",
      "docs_url": "https://www.osohq.com/docs",
      "capabilities": [
        "Fine-Grained Authorization",
        "Audit & Governance"
      ],
      "auth_methods": [
        "JWT"
      ],
      "delegated_user_access": false,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 30,
      "best_for": "Engineering teams centralizing application authorization and resource-level permissions.",
      "representative_query": "I need a centralized authorization service for resource-level permissions across my application.",
      "assessment_status": "Researching",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/oso",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/oso"
    },
    {
      "slug": "cerbos",
      "name": "Cerbos",
      "provider": "Cerbos",
      "description": "Authorization layer for decoupling fine-grained access decisions from application code.",
      "category": "Authorization",
      "website": "https://www.cerbos.dev",
      "docs_url": "https://docs.cerbos.dev/",
      "capabilities": [
        "Fine-Grained Authorization",
        "Audit & Governance"
      ],
      "auth_methods": [
        "JWT"
      ],
      "delegated_user_access": false,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://www.cerbos.dev/blog/mcp-authorization",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 40,
      "best_for": "Services and APIs that need policy-based fine-grained authorization with identity supplied by an external IdP.",
      "representative_query": "My APIs receive JWT identities but I need a separate policy layer to decide which resources each actor can use.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-23",
      "tracked_website_url": "https://identityconnectors.com/go/provider/cerbos",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/cerbos"
    },
    {
      "slug": "authzed-spicedb",
      "name": "AuthZed / SpiceDB",
      "provider": "AuthZed",
      "description": "Managed and open-source relationship-based authorization built on SpiceDB, with current AI-agent and MCP tooling.",
      "category": "Authorization",
      "website": "https://authzed.com",
      "docs_url": "https://authzed.com/docs/index",
      "capabilities": [
        "Fine-Grained Authorization",
        "Audit & Governance"
      ],
      "auth_methods": [
        "API Key"
      ],
      "delegated_user_access": false,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://authzed.com/docs/index",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 40,
      "best_for": "Complex permission graphs, resource sharing and agent/RAG systems that need authorization enforced before data reaches the model.",
      "representative_query": "My RAG agent must only retrieve documents the current user is actually authorized to read.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/authzed-spicedb",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/authzed-spicedb"
    },
    {
      "slug": "openfga",
      "name": "OpenFGA",
      "provider": "OpenFGA",
      "description": "Open-source fine-grained authorization system based on relationship-based access control and Zanzibar-style models.",
      "category": "Authorization",
      "website": "https://openfga.dev",
      "docs_url": "https://openfga.dev/docs",
      "capabilities": [
        "Fine-Grained Authorization"
      ],
      "auth_methods": [
        "API Key"
      ],
      "delegated_user_access": false,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 30,
      "best_for": "Applications needing portable relationship-based authorization with per-resource permission checks.",
      "representative_query": "I need Google-Drive-style per-resource permissions that can be checked before an agent acts.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/openfga",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/openfga"
    },
    {
      "slug": "authress",
      "name": "Authress",
      "provider": "Authress",
      "description": "Authentication and fine-grained access-control API supporting enterprise SSO and machine/service authorization.",
      "category": "Identity Platform",
      "website": "https://authress.io",
      "docs_url": "https://authress.io/",
      "capabilities": [
        "Authentication",
        "SSO",
        "Enterprise Federation",
        "Delegated OAuth",
        "Fine-Grained Authorization",
        "Audit & Governance"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "JWT",
        "Client Credentials"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": true,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 65,
      "best_for": "Applications wanting hosted login plus granular resource authorization and service-to-service access.",
      "representative_query": "I want one API for enterprise login, machine tokens and fine-grained resource permissions.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/authress",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/authress"
    },
    {
      "slug": "aembit",
      "name": "Aembit",
      "provider": "Aembit",
      "description": "Workload IAM platform for non-human identities and AI agents, including blended user+agent identity and an MCP Identity Gateway.",
      "category": "Agent Identity & Trust",
      "website": "https://aembit.io",
      "docs_url": "https://docs.aembit.io/",
      "capabilities": [
        "Authentication",
        "Delegated OAuth",
        "Token Management",
        "Credential Brokering",
        "Fine-Grained Authorization",
        "Workload Identity",
        "Agent Identity",
        "Audit & Governance"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "OIDC",
        "SAML",
        "JWT",
        "mTLS",
        "Service Account"
      ],
      "delegated_user_access": true,
      "service_to_service": true,
      "enterprise_sso": true,
      "fine_grained_authorization": true,
      "credential_vaulting": true,
      "agent_identity": true,
      "mcp": "Yes",
      "mcp_evidence_url": "https://docs.aembit.io/get-started/use-cases/ai-agents",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 100,
      "best_for": "Enterprises securing AI agents and workloads with short-lived credentials, agent identity and per-user/per-agent access policies.",
      "representative_query": "Claude Desktop users need to reach internal MCP servers, but policy must distinguish both the human and the agent.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/aembit",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/aembit"
    },
    {
      "slug": "hashicorp-vault",
      "name": "HashiCorp Vault",
      "provider": "HashiCorp",
      "description": "Secrets and identity platform for short-lived credentials, workload identity federation, OIDC/JWT and agentic IAM use cases.",
      "category": "Secrets & Workload Identity",
      "website": "https://www.hashicorp.com/products/vault",
      "docs_url": "https://developer.hashicorp.com/vault/docs",
      "capabilities": [
        "Token Management",
        "Credential Brokering",
        "Secrets Management",
        "Workload Identity",
        "Agent Identity",
        "Audit & Governance"
      ],
      "auth_methods": [
        "OIDC",
        "JWT",
        "mTLS",
        "Service Account"
      ],
      "delegated_user_access": false,
      "service_to_service": true,
      "enterprise_sso": false,
      "fine_grained_authorization": false,
      "credential_vaulting": true,
      "agent_identity": true,
      "mcp": "Yes",
      "mcp_evidence_url": "https://developer.hashicorp.com/vault/docs",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 65,
      "best_for": "Infrastructure and agent workloads that need short-lived secrets, workload identity federation and controlled access to backend credentials.",
      "representative_query": "My autonomous agent needs short-lived cloud/database credentials without storing long-lived secrets.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/hashicorp-vault",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/hashicorp-vault"
    },
    {
      "slug": "infisical",
      "name": "Infisical",
      "provider": "Infisical",
      "description": "Secrets management platform with machine identities for workloads and applications accessing protected configuration and credentials.",
      "category": "Secrets & Workload Identity",
      "website": "https://infisical.com",
      "docs_url": "https://infisical.com/docs",
      "capabilities": [
        "Secrets Management",
        "Workload Identity",
        "Token Management"
      ],
      "auth_methods": [
        "OIDC",
        "JWT",
        "Client Credentials"
      ],
      "delegated_user_access": false,
      "service_to_service": true,
      "enterprise_sso": false,
      "fine_grained_authorization": false,
      "credential_vaulting": true,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 40,
      "best_for": "Developer and infrastructure workloads that need secrets management plus machine identities and short-lived API access.",
      "representative_query": "My service or agent needs a machine identity to retrieve secrets without sharing a human credential.",
      "assessment_status": "Researching",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/infisical",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/infisical"
    },
    {
      "slug": "teleport",
      "name": "Teleport",
      "provider": "Teleport",
      "description": "Infrastructure access platform with machine and workload identity based on short-lived credentials and SPIFFE-compatible identities.",
      "category": "Secrets & Workload Identity",
      "website": "https://goteleport.com",
      "docs_url": "https://goteleport.com/docs/",
      "capabilities": [
        "Authentication",
        "Workload Identity",
        "Token Management",
        "Audit & Governance"
      ],
      "auth_methods": [
        "OIDC",
        "JWT",
        "mTLS",
        "Service Account"
      ],
      "delegated_user_access": false,
      "service_to_service": true,
      "enterprise_sso": false,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 30,
      "best_for": "Infrastructure workloads that need short-lived SPIFFE-compatible identities and audited machine-to-machine access.",
      "representative_query": "My workloads need short-lived JWT or X.509 identities that can authenticate to infrastructure and third-party APIs.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/teleport",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/teleport"
    },
    {
      "slug": "spiffe-spire",
      "name": "SPIFFE / SPIRE",
      "provider": "CNCF / SPIFFE",
      "description": "Open standard and reference implementation for portable workload identity using SPIFFE IDs, SVIDs and the Workload API.",
      "category": "Agent Identity & Trust",
      "website": "https://spiffe.io",
      "docs_url": "https://spiffe.io/docs/latest/",
      "capabilities": [
        "Workload Identity",
        "Credential Brokering"
      ],
      "auth_methods": [
        "JWT",
        "mTLS",
        "Service Account"
      ],
      "delegated_user_access": false,
      "service_to_service": true,
      "enterprise_sso": false,
      "fine_grained_authorization": false,
      "credential_vaulting": false,
      "agent_identity": false,
      "mcp": "Unknown",
      "mcp_evidence_url": null,
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 30,
      "best_for": "Protocol-neutral workload identity across heterogeneous infrastructure and trust domains.",
      "representative_query": "I need portable cryptographic identities for workloads across Kubernetes, VMs and multiple clouds.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/spiffe-spire",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/spiffe-spire"
    },
    {
      "slug": "composio",
      "name": "Composio",
      "provider": "Composio",
      "description": "Agent tool and connector platform with per-user managed authentication, token custody and MCP access across a large app catalog.",
      "category": "Identity Connector Infrastructure",
      "website": "https://composio.dev",
      "docs_url": "https://docs.composio.dev/docs",
      "capabilities": [
        "Delegated OAuth",
        "Token Management",
        "Credential Brokering",
        "Consent Management"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "API Key"
      ],
      "delegated_user_access": true,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": false,
      "credential_vaulting": true,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://docs.composio.dev/docs/composio-connect",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Agent builders that need users to connect SaaS accounts while credentials remain outside the model and application.",
      "representative_query": "My agent needs to send Gmail and update Linear on behalf of each user without seeing their OAuth tokens.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/composio",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/composio"
    },
    {
      "slug": "arcade",
      "name": "Arcade",
      "provider": "Arcade",
      "description": "AI tool runtime and authorization platform for agents acting on behalf of users through OAuth-protected APIs and MCP tools.",
      "category": "Identity Connector Infrastructure",
      "website": "https://arcade.dev",
      "docs_url": "https://docs.arcade.dev/",
      "capabilities": [
        "Delegated OAuth",
        "Token Management",
        "Credential Brokering",
        "Consent Management"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "API Key",
        "PKCE"
      ],
      "delegated_user_access": true,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": false,
      "credential_vaulting": true,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://docs.arcade.dev/en/resources/tools",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Agent applications that need user-authorized tool calls with OAuth scopes and a catalog of MCP-compatible integrations.",
      "representative_query": "My agent should ask the user for Gmail permission only when it first needs to send email.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/arcade",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/arcade"
    },
    {
      "slug": "nango",
      "name": "Nango",
      "provider": "Nango",
      "description": "Integration platform with managed authentication, credential storage and agent sessions across 1,000+ APIs.",
      "category": "Identity Connector Infrastructure",
      "website": "https://nango.dev",
      "docs_url": "https://nango.dev/platform/auth",
      "capabilities": [
        "Delegated OAuth",
        "Token Management",
        "Credential Brokering",
        "Consent Management"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "API Key",
        "JWT"
      ],
      "delegated_user_access": true,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": false,
      "credential_vaulting": true,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://nango.dev/",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Products and agents that need managed OAuth, API credentials and tightly scoped temporary access to third-party integrations.",
      "representative_query": "My agent needs five-minute read-only access to one user's Gmail without exposing the OAuth token to the model.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/nango",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/nango"
    },
    {
      "slug": "pipedream-connect",
      "name": "Pipedream Connect",
      "provider": "Pipedream",
      "description": "Integration infrastructure for AI agents with managed per-user auth, API proxying and a hosted MCP server across thousands of apps.",
      "category": "Identity Connector Infrastructure",
      "website": "https://pipedream.com",
      "docs_url": "https://mcp.pipedream.com/developers",
      "capabilities": [
        "Delegated OAuth",
        "Token Management",
        "Credential Brokering",
        "Consent Management"
      ],
      "auth_methods": [
        "OAuth 2.0",
        "API Key"
      ],
      "delegated_user_access": true,
      "service_to_service": false,
      "enterprise_sso": false,
      "fine_grained_authorization": false,
      "credential_vaulting": true,
      "agent_identity": false,
      "mcp": "Yes",
      "mcp_evidence_url": "https://mcp.pipedream.com/developers",
      "a2a": "Unknown",
      "ard": "Unknown",
      "ans": "Unknown",
      "agent_readiness_score": 55,
      "best_for": "Agent developers that want managed user connections and one hosted MCP layer over thousands of APIs and tools.",
      "representative_query": "I need one MCP endpoint that resolves each end user's connected SaaS account and injects fresh tokens automatically.",
      "assessment_status": "Complete",
      "last_assessed": "2026-09-22",
      "tracked_website_url": "https://identityconnectors.com/go/provider/pipedream-connect",
      "tracked_docs_url": "https://identityconnectors.com/go/docs/pipedream-connect"
    }
  ]
}