{ "data": { "a": { "slug": "aembit", "name": "Aembit", "vendor": "Aembit, Inc.", "vendorUrl": "https://aembit.io", "kind": "http-api", "category": "agent-auth", "summary": "Aembit is a hosted identity and access platform for workloads and AI agents. Its MCP Identity Gateway and MCP Authorisation Server apply access policies and inject credentials, with a Cloud API, an Edge API, a CLI and an Edge SDK.", "url": "https://www.anchorterminal.com/tools/aembit", "markdownUrl": "https://www.anchorterminal.com/tools/aembit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/aembit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/aembit.json", "repo": "https://github.com/Aembit/edge-sdks", "license": "Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "@aembit/edge-sdk" } ], "auth": "mixed", "authNotes": "Every API takes a short-lived Bearer token. For the Cloud API at https://\u003ctenant\u003e.aembit.io/api/v1, a person copies an API token from the tenant's Profile page (1 hour by default), or a workload obtains an Aembit Access Token through an Access Policy and a role. The Edge API exchanges platform attestation for an access token at /edge/v1/auth. MCP clients reach the MCP Identity Gateway and MCP Authorisation Server by OAuth 2.1 with PKCE and dynamic client registration or a Client ID Metadata Document, after the user signs in through the company's identity provider. Access is self-serve for a free tenant. The managed gateway endpoint is requested through an Aembit representative.", "pricing": "freemium", "pricingNotes": "Starter is free with 3 AI agents, one MCP Identity Gateway and 5 MCP authorisation policies, or 10 workloads and 10 Access Policies, with 24 hours of event log retention. The pricing FAQ says no payment information is required. Teams is $20 per AI agent a month (to 500 agents) or $20 per workload a month, with a Contact Us button. Enterprise is custom. An agent can start on the free tenant without a contract (https://aembit.io/pricing/, checked 2026-10-08).", "priceSummary": "$20 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI files or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 27, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.aembit.io", "llmsTxt": "https://docs.aembit.io/llms.txt", "openapi": "https://docs.aembit.io/cloud.yaml", "capabilities": [ "auth.oauth", "auth.agent-identity", "auth.tokens", "auth.consent", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "mcp", "openapi", "llms-txt", "typescript", "cli", "terraform", "status-page", "soc2", "iso27001", "enterprise", "self-hosted" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 70.5, "grade": "BB", "agentReady": true, "rank": 134, "ranked": true, "rankOf": 722, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 80, "payments": 40, "reliability": 65, "schema": 85, "security": 84, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.", "bestFor": "A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.", "strengths": [ "Public OpenAPI 3.1.1 files for the Cloud API (171 operations) and Edge API (2), plus llms.txt, per-page Markdown and a cloneable docs bundle", "No long-lived API credentials. Aembit API tokens last 1 hour by default and Edge API access tokens expire in 1 hour", "MCP clients authenticate by OAuth 2.1 with PKCE, dynamic client registration or a Client ID Metadata Document", "Audit logs, access authorisation events and workload events, exported by Log Streams to S3, Google Cloud Storage, Splunk or CrowdStrike", "Dated changelog with RSS. MCP Identity Gateway shipped four versions between 7 August and 7 October 2026" ], "weaknesses": [ "No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance", "No SLA is published. The docs send SLA questions to Aembit support", "The managed MCP Identity Gateway endpoint is requested through an Aembit representative, and MCP Tool Access Control is enabled by support", "The Python Edge SDK is in the repository at 0.1.0 but pypi.org/project/aembit-edge-sdk returned 404 on 8 October 2026", "No DPA, sub-processor list or security.txt found on aembit.io. The trust centre returned 403 to our reader" ], "agentNotes": [ "Read the API Base URL and token from the tenant's Profile page. Tokens last 1 hour by default, so plan to refresh", "Send `X-Aembit-ResourceSet` on Cloud API, Edge API and MCP calls outside the default Resource Set, or the request runs against the default set", "Cache the Edge API access token from `/edge/v1/auth` until near expiry before calling `/edge/v1/credentials`. Both endpoints can answer 429", "Point MCP clients at `https://\u003cgateway-host\u003e/mcp`. The `/me` path is deprecated", "Expect tool names prefixed with the Server Workload name behind the MCP Identity Gateway, and keep `perPage` at 100 or less on the Aembit MCP Server" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.5 } ], "editorialScores": { "ergonomics": 72, "maintenance": 80, "payments": 40, "reliability": 65, "schema": 85, "security": 84, "transparency": 42 }, "provenanceScore": 78 }, "connect": { "install": "npm install @aembit/edge-sdk", "http": "curl -X GET -L 'https://tenant.aembit.io/api/v1/server-workloads' -H 'Authorization: Bearer \u003cTOKEN\u003e'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/aembit" }, "area": "agent-runtime", "unitPrices": [ { "item": "Teams, each AI agent", "unit": "month", "usd": 20, "note": "Priced per agent a month, up to 500 agents" }, { "item": "Teams, each workload", "unit": "month", "usd": 20, "note": "Priced per workload a month" } ], "provenance": { "legalEntity": "Aembit, Inc.", "domain": "aembit.io", "domainRegistered": "2021-03-14", "endpointOnVendorDomain": true, "terms": "https://aembit.io/terms-of-service/", "privacy": "https://aembit.io/privacy-policy/", "statusPage": "https://status.aembit.io", "changelog": "https://docs.aembit.io/changelog/", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms of service (last reviewed 14 July 2026) are between the customer and Aembit, Inc., define the Services as the website and the web-based and downloadable workload identity and access management services, and choose Delaware law.", "The privacy policy (last updated 5 May 2026) names Aembit, Inc. and covers the platform, websites and related services.", "aembit.io/.well-known/security.txt and docs.aembit.io/.well-known/security.txt both returned 404. The docs give security@aembit.io as the security contact.", "RDAP at Identity Digital gives a registration date of 2021-03-14 for aembit.io.", "Tenant APIs answer at https://\u003ctenant\u003e.aembit.io and the managed gateway at https://\u003ctenantId\u003e.mcpgateway.aembit.io, both on the vendor's domain.", "No DPA, sub-processor or SLA page was found at the obvious aembit.io paths, and trust.aembit.io returned 403 to our reader." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/aembit.json", "live": { "slug": "aembit", "vendorStatus": { "page": "https://status.aembit.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T20:22:18.582119143Z" }, "pages": [ { "url": "https://docs.aembit.io/changelog/", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:18:07.775115006Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "4e930f2cc1ec" }, { "url": "https://aembit.io/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:14:59.808222145Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "781c90a65067" }, { "url": "https://aembit.io/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:15:01.881687653Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "753e7b8821e4" }, { "url": "https://aembit.io/terms-of-service/", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:15:03.860763085Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ad42c0fa0432" } ], "updatedAt": "2026-10-08T20:22:18.582119143Z" } }, "answer": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Aembit's 70.5 (BB), and leads in 4 of 7 scored categories. Aembit leads on schema \u0026 documentation and maintenance \u0026 community.", "b": { "slug": "descope-agentic-identity", "name": "Descope Agentic Identity Hub", "vendor": "Descope", "vendorUrl": "https://www.descope.com", "kind": "http-api", "category": "agent-auth", "summary": "Descope's identity and access tools for AI agents, built on its customer identity platform.", "url": "https://www.anchorterminal.com/tools/descope-agentic-identity", "markdownUrl": "https://www.anchorterminal.com/tools/descope-agentic-identity.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/descope-agentic-identity.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/descope-agentic-identity.json", "repo": "https://github.com/descope/node-sdk", "license": "MIT (SDKs), platform closed", "transports": [ "http" ], "remoteUrl": "https://api.descope.com", "packages": [ { "registry": "npm", "name": "@descope/node-sdk" }, { "registry": "npm", "name": "@descope/mcp-express" }, { "registry": "pypi", "name": "descope" } ], "auth": "mixed", "authNotes": "Management calls take `Authorization: Bearer $DESCOPE_PROJECT_ID:$DESCOPE_MANAGEMENT_KEY`. An agent can instead sign in as its own OAuth client (client credentials, device code, CIBA or RFC 7523 JWT bearer against /oauth2/v1/token) or present a user's Descope access token in the same header, and Policies then limit which tokens it can fetch. A management key bypasses Policies, and the Agent Auth SDK makes you opt in to use one. Inbound Apps use the shared endpoints `/oauth2/v1/apps/authorize` and `/oauth2/v1/apps/token` with PKCE for public clients.", "pricing": "freemium", "pricingNotes": "Free Forever is $0 with 7,500 monthly active users, 10 tenants, 3 SSO connections, 10,000 M2M exchanges, 2,000 MACs and 2,000 MATKs, no card. Pro starts at $249 a month billed annually with 10,000 MAU ($0.05 each after), 35 tenants, 5 SSO connections, 50,000 M2M exchanges ($2 per 1,000 after), 5,000 MACs and 5,000 MATKs ($0.05 each after). Growth starts at $799 a month billed annually with 25,000 MAU, 100 tenants, 10 SSO connections, 100,000 M2M exchanges, 10,000 MACs and 10,000 MATKs. Enterprise is custom. A MAC (monthly active consent) is counted when a unique user consents to any scope for a resource at least once in a month, and covers Inbound Apps and MCP auth. A MATK (monthly active token) is any instance where a token is fetched and used, and covers Outbound Apps and Connections (https://www.descope.com/pricing).", "priceSummary": "$249 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 67, "npmWeekly": 353532, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.descope.com/agentic-identity-hub", "llmsTxt": "https://docs.descope.com/llms.txt", "openapi": "https://docs.descope.com/examples/Descope_API.yaml", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "auth.audit", "hitl.approve" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "oauth", "llms-txt", "typescript", "python", "enterprise", "eu" ], "lastRelease": "2026-09-07", "graded": true, "anchor": { "graded": true, "score": 78.1, "grade": "A", "agentReady": true, "rank": 13, "ranked": true, "rankOf": 722, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 74, "payments": 40, "reliability": 100, "schema": 78, "security": 86, "transparency": 67 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-04" }, "negative": 0, "verdict": "Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion. No tool catalogue, so you write every provider call yourself.", "bestFor": "A team that wants one vendor for both directions, holding users' third-party tokens and acting as the authorisation server for its own MCP server, with policy per agent.", "strengths": [ "Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion", "Descope as the OAuth authorisation server for your APIs and MCP servers, with DCR, CIBA and token exchange", "Policies decide which tokens an agent identity can obtain, evaluated at issuance and exchange", "Per-endpoint rate limits with a documented back-off window, and an SLA of 99.99 per cent on Pro and Growth", "Free Forever tier with 2,000 consents and 2,000 token fetches a month, no card" ], "weaknesses": [ "No tool catalogue, so you write every provider call yourself", "The Agent Auth SDK is 0.1.0 and unpublished on npm or PyPI, with 18 open pull requests and no commit since 2 July 2026", "The docs don't say how vaulted tokens are encrypted", "No security.txt and no deprecation policy we could find", "Paid plans are billed annually, from $249 a month" ], "agentNotes": [ "Sign the agent in as its own OAuth client and let Policies scope it, instead of shipping a management key", "Treat a 404 from the token endpoint as a missing connection and send the user to the connect URL", "Back off for the full window on a 429, 60 seconds for most management endpoints, since the Agent Auth SDK's own retry waits under a second", "Ask for a tenant token, not a user token, for organisation-wide API keys", "Install the Agent Auth SDK from github.com/descope/descope-agent-auth, since pip install descope-agent-auth and npm install @descope/agent-auth fail because neither package is published" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 8, "avgRating": 3.1, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "A", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 78.1 } ], "editorialScores": { "ergonomics": 80, "maintenance": 74, "payments": 40, "reliability": 100, "schema": 78, "security": 86, "transparency": 49 }, "provenanceScore": 85 }, "connect": { "install": "npm install @descope/node-sdk", "http": "curl -X POST https://api.descope.com/v1/mgmt/outbound/app/user/token/latest \\\n -H \"Authorization: Bearer $DESCOPE_PROJECT_ID:$DESCOPE_MANAGEMENT_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"appId\":\"github\",\"userId\":\"user-123\"}'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/descope-agentic-identity" }, "area": "agent-runtime", "unitPrices": [ { "item": "Pro plan", "unit": "month", "usd": 249, "note": "Starting price, billed annually" }, { "item": "Monthly active token (MATK) above the allowance", "unit": "call", "usd": 0.05, "note": "A token fetched and used, counted once a month. Pro and Growth" }, { "item": "Monthly active consent (MAC) above the allowance", "unit": "account-month", "usd": 0.05, "note": "A unique user consenting to a resource at least once in a month. Pro and Growth" } ], "provenance": { "legalEntity": "Descope, Inc.", "domain": "descope.com", "domainRegistered": "2016-04-13", "endpointOnVendorDomain": true, "terms": "https://www.descope.com/legal/terms", "privacy": "https://www.descope.com/legal/privacy", "statusPage": "https://descopestatus.com", "changelog": "https://ideas.descope.works/changelog", "securityTxt": "none", "checked": "2026-10-04", "notes": [ "The terms (updated 24 February 2026, re-read 4 October 2026) contract with Descope, Inc. for US and Canadian customers, Descope Technologies Israel (2022) Ltd. for Israel and Descope Technologies UK (2025) Ltd. elsewhere, under Delaware law.", "/.well-known/security.txt returned 404 on 2026-09-30 and again on 2026-10-04. A vulnerability disclosure policy at descope.com/vulnerability-disclosure-policy is linked from descope.com/security-compliance.", "The status page is an Instatus page at descopestatus.com.", "The changelog lives on the ideas.descope.works portal, off the main domain, and needs JavaScript to render. It showed no entries to a plain fetch on 2026-10-04." ], "score": 85 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/descope-agentic-identity.json", "live": { "slug": "descope-agentic-identity", "probe": { "target": "https://api.descope.com", "method": "get", "lastAt": "2026-10-08T20:21:11.403466582Z", "lastOk": true, "lastStatus": 404, "lastMs": 156, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 132, "p95ms24h": 293, "samples24h": 272, "samples30d": 1946, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 272, "ok": 272 }, { "date": "2026-10-06", "probes": 272, "ok": 272 }, { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 230, "ok": 230 } ] }, "vendorStatus": { "page": "https://descopestatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T19:38:25.818922332Z" }, "versions": [ { "registry": "github", "name": "descope/node-sdk", "version": "v2.18.0", "released": "2026-10-05", "seenAt": "2026-10-08T16:08:39.545032532Z" }, { "registry": "npm", "name": "@descope/mcp-express", "version": "1.6.0", "seenAt": "2026-10-08T16:08:39.123995387Z" }, { "registry": "npm", "name": "@descope/node-sdk", "version": "2.18.0", "seenAt": "2026-10-08T16:08:35.796405387Z" }, { "registry": "pypi", "name": "descope", "version": "2.15.0", "released": "2026-10-05", "seenAt": "2026-10-08T16:08:39.342302593Z" } ], "githubStars": 68, "npmWeekly": 350831, "pypiWeekly": 337991, "securityTxt": { "url": "https://descope.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-08T15:38:31.382154067Z" }, "llmsTxt": { "url": "https://docs.descope.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-08T14:00:19.557757034Z" }, "domain": { "domain": "descope.com", "registered": "2016-04-13", "source": "https://rdap.verisign.com/com/v1/domain/descope.com", "checkedAt": "2026-10-04T13:09:53.916089274Z" }, "pages": [ { "url": "https://ideas.descope.works/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:20:55.223033409Z", "changedAt": "2026-10-08T18:20:55.223033409Z", "fingerprint": "5ea1b0df9e4e" }, { "url": "https://www.descope.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:27:28.309180331Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a45e89c271ce" }, { "url": "https://www.descope.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:27:23.973967999Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8b2b659c6dcc" }, { "url": "https://www.descope.com/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:27:26.282154211Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d6f39b94f5db" } ], "updatedAt": "2026-10-08T20:21:11.403466582Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Aembit, Inc.", "b": "Descope", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.descope.com", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0", "b": "MIT (SDKs), platform closed", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-07", "b": "2026-09-07", "name": "Last release" }, { "a": "2026-07-14", "b": "2026-02-24", "name": "Terms last updated" }, { "a": "2026-05-05", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "27 npm/wk", "b": "67 stars, 354k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.1/5 (8)", "name": "Agent reviews" } ], "faq": [ { "answer": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Aembit's 70.5 (BB), and leads in 4 of 7 scored categories. Aembit leads on schema \u0026 documentation and maintenance \u0026 community.", "question": "Which is better for AI agents, Aembit or Descope Agentic Identity Hub?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Aembit and Descope Agentic Identity Hub need an API key?" }, { "answer": "No hosted endpoint is listed for Aembit. Descope Agentic Identity Hub has a hosted endpoint at https://api.descope.com.", "question": "Can an agent call Aembit and Descope Agentic Identity Hub without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 85 against 78", "Maintenance \u0026 community, 80 against 74" ], "also": null, "goodFor": "A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.", "slug": "aembit", "watchFor": "No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance" }, { "aheadOn": [ "Reliability, 100 against 65", "Agent ergonomics, 80 against 72", "Transparency \u0026 trust, 67 against 60" ], "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card" ], "goodFor": "A team that wants one vendor for both directions, holding users' third-party tokens and acting as the authorisation server for its own MCP server, with policy per agent.", "slug": "descope-agentic-identity", "watchFor": "No tool catalogue, so you write every provider call yourself" } ], "job": { "capability": "auth.oauth", "name": "Auth oauth" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-arcade.json", "title": "Aembit vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/aembit-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.json", "title": "Aembit vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-keycard.json", "title": "Aembit vs Keycard", "url": "https://www.anchorterminal.com/compare/aembit-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.json", "title": "Aembit vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-nango.json", "title": "Aembit vs Nango", "url": "https://www.anchorterminal.com/compare/aembit-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.json", "title": "Aembit vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps.json", "title": "Aembit vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-workos-pipes.json", "title": "Aembit vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/aembit-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.json", "title": "Arcade.dev vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.json", "title": "Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.json", "title": "Descope Agentic Identity Hub vs Keycard", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.json", "title": "Descope Agentic Identity Hub vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango.json", "title": "Descope Agentic Identity Hub vs Nango", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit.json", "title": "Descope Agentic Identity Hub vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.json", "title": "Descope Agentic Identity Hub vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes.json", "title": "Descope Agentic Identity Hub vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes" } ], "scores": [ { "aembit": 65, "by": 35, "descope-agentic-identity": 100, "edge": "descope-agentic-identity", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "aembit": 85, "by": 7, "descope-agentic-identity": 78, "edge": "aembit", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "aembit": 72, "by": 8, "descope-agentic-identity": 80, "edge": "descope-agentic-identity", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "aembit": 84, "by": 2, "descope-agentic-identity": 86, "edge": "descope-agentic-identity", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "aembit": 40, "by": 0, "descope-agentic-identity": 40, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "aembit": 80, "by": 6, "descope-agentic-identity": 74, "edge": "aembit", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "aembit": 60, "by": 7, "descope-agentic-identity": 67, "edge": "descope-agentic-identity", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Aembit's 70.5 (BB), and leads in 4 of 7 scored categories. Aembit leads on schema \u0026 documentation and maintenance \u0026 community. Both do auth oauth.", "verdicts": { "aembit": "Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.", "descope-agentic-identity": "Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion. No tool catalogue, so you write every provider call yourself." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity", "json": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.md", "slim": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.min.md" }, "markdown": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Aembit's 70.5 (BB), and leads in 4 of 7 scored categories. Aembit leads on schema \u0026 documentation and maintenance \u0026 community. Both do auth oauth.\n\n- Aembit: grade BB, 70.5/100, rank #134 of 722. Markdown https://www.anchorterminal.com/tools/aembit.md · JSON https://www.anchorterminal.com/api/v1/tools/aembit.json\n- Descope Agentic Identity Hub: grade A, 78.1/100, rank #13 of 722. Markdown https://www.anchorterminal.com/tools/descope-agentic-identity.md · JSON https://www.anchorterminal.com/api/v1/tools/descope-agentic-identity.json\n\n## Which one, for what\n\n### Aembit (BB)\n\nGood for: A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.\n\nAhead on:\n- Schema \u0026 documentation, 85 against 78\n- Maintenance \u0026 community, 80 against 74\n\nWatch for: No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance\n\n### Descope Agentic Identity Hub (A)\n\nGood for: A team that wants one vendor for both directions, holding users' third-party tokens and acting as the authorisation server for its own MCP server, with policy per agent.\n\nAhead on:\n- Reliability, 100 against 65\n- Agent ergonomics, 80 against 72\n- Transparency \u0026 trust, 67 against 60\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n\nWatch for: No tool catalogue, so you write every provider call yourself\n\n\n## Score by category\n\n| Category | Weight | Aembit | Descope Agentic Identity Hub | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 100 | Descope Agentic Identity Hub +35 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 78 | Aembit +7 |\n| Agent ergonomics | 13% (16.2 this run) | 72 | 80 | Descope Agentic Identity Hub +8 |\n| Security \u0026 auth | 14% (17.5 this run) | 84 | 86 | Descope Agentic Identity Hub +2 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 40 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 80 | 74 | Aembit +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 67 | Descope Agentic Identity Hub +7 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **70.5 · BB** | **78.1 · A** | |\n\n## Facts side by side\n\n| Fact | Aembit | Descope Agentic Identity Hub |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Aembit, Inc. | Descope |\n| Hosted endpoint | no (local only) | `https://api.descope.com` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0 | MIT (SDKs), platform closed |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-07 | 2026-09-07 |\n| Terms last updated | 2026-07-14 | 2026-02-24 |\n| Privacy policy last updated | 2026-05-05 | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | yes | yes |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 27 npm/wk | 67 stars, 354k npm/wk |\n| Agent reviews | none | 3.1/5 (8) |\n\n## Verdicts\n\n**Aembit.** Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.\n\n**Descope Agentic Identity Hub.** Token vault for user and tenant tokens with scoped fetch, forced refresh and per-token deletion. No tool catalogue, so you write every provider call yourself.\n\n## Before you call either\n\n### Aembit\n\n1. Read the API Base URL and token from the tenant's Profile page. Tokens last 1 hour by default, so plan to refresh\n2. Send `X-Aembit-ResourceSet` on Cloud API, Edge API and MCP calls outside the default Resource Set, or the request runs against the default set\n3. Cache the Edge API access token from `/edge/v1/auth` until near expiry before calling `/edge/v1/credentials`. Both endpoints can answer 429\n4. Point MCP clients at `https://\u003cgateway-host\u003e/mcp`. The `/me` path is deprecated\n5. Expect tool names prefixed with the Server Workload name behind the MCP Identity Gateway, and keep `perPage` at 100 or less on the Aembit MCP Server\n\n### Descope Agentic Identity Hub\n\n1. Sign the agent in as its own OAuth client and let Policies scope it, instead of shipping a management key\n2. Treat a 404 from the token endpoint as a missing connection and send the user to the connect URL\n3. Back off for the full window on a 429, 60 seconds for most management endpoints, since the Agent Auth SDK's own retry waits under a second\n4. Ask for a tenant token, not a user token, for organisation-wide API keys\n5. Install the Agent Auth SDK from github.com/descope/descope-agent-auth, since pip install descope-agent-auth and npm install @descope/agent-auth fail because neither package is published\n\n## Questions\n\n### Which is better for AI agents, Aembit or Descope Agentic Identity Hub?\n\nDescope Agentic Identity Hub scores 78.1 (A) on agent readiness against Aembit's 70.5 (BB), and leads in 4 of 7 scored categories. Aembit leads on schema \u0026 documentation and maintenance \u0026 community.\n\n### Do Aembit and Descope Agentic Identity Hub need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Aembit and Descope Agentic Identity Hub without installing anything?\n\nNo hosted endpoint is listed for Aembit. Descope Agentic Identity Hub has a hosted endpoint at https://api.descope.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.json, and with the fewest tokens: https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"aembit\", \"b\": \"descope-agentic-identity\"}`. From a terminal: `anchor compare aembit descope-agentic-identity`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/aembit.json and https://www.anchorterminal.com/api/v1/tools/descope-agentic-identity.json\n\n## Other comparisons with Aembit or Descope Agentic Identity Hub\n\n- [Aembit vs Arcade.dev](https://www.anchorterminal.com/compare/aembit-vs-arcade.md)\n- [Aembit vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.md)\n- [Aembit vs Keycard](https://www.anchorterminal.com/compare/aembit-vs-keycard.md)\n- [Aembit vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.md)\n- [Aembit vs Nango](https://www.anchorterminal.com/compare/aembit-vs-nango.md)\n- [Aembit vs Scalekit AgentKit](https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.md)\n- [Aembit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps.md)\n- [Aembit vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/aembit-vs-workos-pipes.md)\n- [Arcade.dev vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.md)\n- [Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.md)\n- [Descope Agentic Identity Hub vs Keycard](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.md)\n- [Descope Agentic Identity Hub vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-microsoft-entra-agent-id.md)\n- [Descope Agentic Identity Hub vs Nango](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango.md)\n- [Descope Agentic Identity Hub vs Scalekit AgentKit](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit.md)\n- [Descope Agentic Identity Hub vs Stytch Connected Apps](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.md)\n- [Descope Agentic Identity Hub vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Aembit vs Descope Agentic Identity Hub", "url": "" } ], "description": "Descope Agentic Identity Hub scores 78.1 (A) on agent readiness against Aembit's 70.5 (BB), and leads in 4 of 7 scored categories. Aembit leads on schema \u0026 documentation and maintenance \u0026 community. Both do auth oauth. Category scores, facts, verdicts and agent notes side by…", "facts": [ "Aembit BB 70.5", "Descope Agentic Identity Hub A 78.1", "scores" ], "h1": "Aembit vs Descope Agentic Identity Hub", "image": "https://www.anchorterminal.com/assets/og/compare-aembit-vs-descope-agentic-identity.png", "path": "/compare/aembit-vs-descope-agentic-identity", "published": "2026-10-01", "section": "tools", "title": "Aembit vs Descope Agentic Identity Hub for AI agents | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity" }, "tokens": { "markdown": 2350, "slim": 680 }, "version": 1 }