{ "data": { "a": { "slug": "aembit", "name": "Aembit", "vendor": "Aembit, Inc.", "vendorUrl": "https://aembit.io", "kind": "http-api", "category": "agent-auth", "summary": "Aembit is a hosted identity and access platform for workloads and AI agents. Its MCP Identity Gateway and MCP Authorisation Server apply access policies and inject credentials, with a Cloud API, an Edge API, a CLI and an Edge SDK.", "url": "https://www.anchorterminal.com/tools/aembit", "markdownUrl": "https://www.anchorterminal.com/tools/aembit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/aembit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/aembit.json", "repo": "https://github.com/Aembit/edge-sdks", "license": "Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "@aembit/edge-sdk" } ], "auth": "mixed", "authNotes": "Every API takes a short-lived Bearer token. For the Cloud API at https://\u003ctenant\u003e.aembit.io/api/v1, a person copies an API token from the tenant's Profile page (1 hour by default), or a workload obtains an Aembit Access Token through an Access Policy and a role. The Edge API exchanges platform attestation for an access token at /edge/v1/auth. MCP clients reach the MCP Identity Gateway and MCP Authorisation Server by OAuth 2.1 with PKCE and dynamic client registration or a Client ID Metadata Document, after the user signs in through the company's identity provider. Access is self-serve for a free tenant. The managed gateway endpoint is requested through an Aembit representative.", "pricing": "freemium", "pricingNotes": "Starter is free with 3 AI agents, one MCP Identity Gateway and 5 MCP authorisation policies, or 10 workloads and 10 Access Policies, with 24 hours of event log retention. The pricing FAQ says no payment information is required. Teams is $20 per AI agent a month (to 500 agents) or $20 per workload a month, with a Contact Us button. Enterprise is custom. An agent can start on the free tenant without a contract (https://aembit.io/pricing/, checked 2026-10-08).", "priceSummary": "$20 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI files or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 27, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.aembit.io", "llmsTxt": "https://docs.aembit.io/llms.txt", "openapi": "https://docs.aembit.io/cloud.yaml", "capabilities": [ "auth.oauth", "auth.agent-identity", "auth.tokens", "auth.consent", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "mcp", "openapi", "llms-txt", "typescript", "cli", "terraform", "status-page", "soc2", "iso27001", "enterprise", "self-hosted" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 70.5, "grade": "BB", "agentReady": true, "rank": 147, "ranked": true, "rankOf": 842, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 80, "payments": 40, "reliability": 65, "schema": 85, "security": 84, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.", "bestFor": "A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.", "strengths": [ "Public OpenAPI 3.1.1 files for the Cloud API (171 operations) and Edge API (2), plus llms.txt, per-page Markdown and a cloneable docs bundle", "No long-lived API credentials. Aembit API tokens last 1 hour by default and Edge API access tokens expire in 1 hour", "MCP clients authenticate by OAuth 2.1 with PKCE, dynamic client registration or a Client ID Metadata Document", "Audit logs, access authorisation events and workload events, exported by Log Streams to S3, Google Cloud Storage, Splunk or CrowdStrike", "Dated changelog with RSS. MCP Identity Gateway shipped four versions between 7 August and 7 October 2026" ], "weaknesses": [ "No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance", "No SLA is published. The docs send SLA questions to Aembit support", "The managed MCP Identity Gateway endpoint is requested through an Aembit representative, and MCP Tool Access Control is enabled by support", "The Python Edge SDK is in the repository at 0.1.0 but pypi.org/project/aembit-edge-sdk returned 404 on 8 October 2026", "No DPA, sub-processor list or security.txt found on aembit.io. The trust centre returned 403 to our reader" ], "agentNotes": [ "Read the API Base URL and token from the tenant's Profile page. Tokens last 1 hour by default, so plan to refresh", "Send `X-Aembit-ResourceSet` on Cloud API, Edge API and MCP calls outside the default Resource Set, or the request runs against the default set", "Cache the Edge API access token from `/edge/v1/auth` until near expiry before calling `/edge/v1/credentials`. Both endpoints can answer 429", "Point MCP clients at `https://\u003cgateway-host\u003e/mcp`. The `/me` path is deprecated", "Expect tool names prefixed with the Server Workload name behind the MCP Identity Gateway, and keep `perPage` at 100 or less on the Aembit MCP Server" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.5 } ], "editorialScores": { "ergonomics": 72, "maintenance": 80, "payments": 40, "reliability": 65, "schema": 85, "security": 84, "transparency": 42 }, "provenanceScore": 78 }, "connect": { "install": "npm install @aembit/edge-sdk", "http": "curl -X GET -L 'https://tenant.aembit.io/api/v1/server-workloads' -H 'Authorization: Bearer \u003cTOKEN\u003e'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/aembit" }, "area": "agent-runtime", "unitPrices": [ { "item": "Teams, each AI agent", "unit": "month", "usd": 20, "note": "Priced per agent a month, up to 500 agents" }, { "item": "Teams, each workload", "unit": "month", "usd": 20, "note": "Priced per workload a month" } ], "provenance": { "legalEntity": "Aembit, Inc.", "domain": "aembit.io", "domainRegistered": "2021-03-14", "endpointOnVendorDomain": true, "terms": "https://aembit.io/terms-of-service/", "privacy": "https://aembit.io/privacy-policy/", "statusPage": "https://status.aembit.io", "changelog": "https://docs.aembit.io/changelog/", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms of service (last reviewed 14 July 2026) are between the customer and Aembit, Inc., define the Services as the website and the web-based and downloadable workload identity and access management services, and choose Delaware law.", "The privacy policy (last updated 5 May 2026) names Aembit, Inc. and covers the platform, websites and related services.", "aembit.io/.well-known/security.txt and docs.aembit.io/.well-known/security.txt both returned 404. The docs give security@aembit.io as the security contact.", "RDAP at Identity Digital gives a registration date of 2021-03-14 for aembit.io.", "Tenant APIs answer at https://\u003ctenant\u003e.aembit.io and the managed gateway at https://\u003ctenantId\u003e.mcpgateway.aembit.io, both on the vendor's domain.", "No DPA, sub-processor or SLA page was found at the obvious aembit.io paths, and trust.aembit.io returned 403 to our reader." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/aembit.json", "live": { "slug": "aembit", "vendorStatus": { "page": "https://status.aembit.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-09T10:41:24.601438807Z" }, "pages": [ { "url": "https://docs.aembit.io/changelog/", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:18:07.775115006Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "4e930f2cc1ec" }, { "url": "https://aembit.io/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:14:59.808222145Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "781c90a65067" }, { "url": "https://aembit.io/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:15:01.881687653Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "753e7b8821e4" }, { "url": "https://aembit.io/terms-of-service/", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:15:03.860763085Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ad42c0fa0432" } ], "updatedAt": "2026-10-09T10:41:24.601438807Z" } }, "answer": "Aembit scores 70.5 (BB) on agent readiness against Vercel Connect's 68.8 (B), and leads in 3 of 7 scored categories. Vercel Connect leads on transparency \u0026 trust.", "b": { "slug": "vercel-connect", "name": "Vercel Connect", "vendor": "Vercel Inc.", "vendorUrl": "https://vercel.com", "kind": "http-api", "category": "agent-auth", "summary": "Vercel Connect is a credential broker for apps and agents. Code asks it for a short-lived, scoped token for Slack, GitHub, Microsoft, Linear, Snowflake or any OAuth, API-key or MCP service, as the app or for a user.", "url": "https://www.anchorterminal.com/tools/vercel-connect", "markdownUrl": "https://www.anchorterminal.com/tools/vercel-connect.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/vercel-connect.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/vercel-connect.json", "repo": "https://github.com/vercel/vercel", "license": "Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://api.vercel.com", "packages": [ { "registry": "npm", "name": "@vercel/connect" } ], "auth": "mixed", "authNotes": "Access is self-serve with a Vercel account, on every plan. A deployment calls Connect with its project OIDC token (`VERCEL_OIDC_TOKEN`), which Connect checks against the connector's project links and their environments. Locally, `vercel env pull` writes a development OIDC token that lasts about 12 hours. Outside Vercel, a Vercel access token goes in `vercelToken`, and it can request only the app subject or its own user. Connect then holds the provider side. Vercel registers the OAuth client for managed connectors (Slack, GitHub, Linear, Microsoft, Snowflake, Salesforce), and the customer supplies a client or an API key for the others. End users consent in a browser at a URL from `startAuthorization`.", "pricing": "freemium", "pricingNotes": "Billed per token request and per trigger. Hobby includes 500 token requests and 1,000 triggers a month at no extra charge, and Vercel's fair use guidelines limit Hobby to non-commercial, personal use. Pro is $3.00 per 1,000 token requests and $0.95 per 1,000 triggers on top of the plan. Enterprise is negotiated. A trigger is counted once per destination, and once per event when no destination is set. The SDK's in-process cache means many provider calls in one invocation cost one token request (https://vercel.com/docs/connect/pricing, checked 2026-10-08).", "priceSummary": "$3 / 1k req", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Connect docs, the pricing page or the Connect operations of the OpenAPI document (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16354, "npmWeekly": 738165, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://vercel.com/docs/connect", "llmsTxt": "https://vercel.com/llms.txt", "openapi": "https://openapi.vercel.sh/", "capabilities": [ "auth.tokens", "auth.oauth", "auth.consent", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "oidc", "openapi", "llms-txt", "typescript", "cli", "webhooks", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 68.8, "grade": "B", "agentReady": false, "rank": 195, "ranked": true, "rankOf": 842, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 81, "payments": 40, "reliability": 63, "schema": 84, "security": 83, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": -3, "negativeNotes": [ "April 2026. Vercel's security bulletin says an attacker took over an employee's account through a compromised third-party AI tool, reached internal systems and decrypted non-sensitive environment variables of a limited subset of customers. It predates Connect's general availability on 25 August 2026 and is documented with remediation, so 3 of a possible 15 is taken, because Connect now keeps customers' provider refresh tokens on the same platform (https://vercel.com/kb/bulletin/vercel-april-2026-security-incident)." ], "verdict": "Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, the status page records 94 minutes of elevated Connect errors on 10 September 2026, and the only SDK is TypeScript.", "bestFor": "Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets.", "strengths": [ "Refresh tokens stay on Vercel's infrastructure. Code receives only short-lived access tokens, as the app or for a named user", "A deployment authenticates with its project OIDC token, checked against per-environment project links, so no provider secret sits in environment variables", "Public OpenAPI 3.0.3 document covers 13 Connect paths, including `/v1/connect/token/{connector}` and `/v1/connect/authorize/{connector}`", "Token requests, completed authorisations and revocations are logged with `tokenId` and `authorizationId`, and can be sent to a drain on Pro and Enterprise", "Rate limits are published with numbers, 200 reads and 50 writes a minute per team" ], "weaknesses": [ "Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment", "Elevated Connect errors for 94 minutes on 10 September 2026, marked major, and again on 18 September, per the status page", "Event history is kept 12 hours on Hobby and 3 days on Pro. Connector audit logs and 30 days need Enterprise", "Revocation depends on the provider. Without a revocation endpoint the provider credential can work until it expires", "The SDK is TypeScript only, and the public repository's copy stops at 2.0.2 while npm has 2.4.1" ], "agentNotes": [ "Call `getToken` at request time and don't store the result. The SDK caches up to 100 tokens in process and refreshes them 30 seconds before expiry", "Pass `scopes` on every request. Since SDK 1.0.0 an omitted `scopes` defaults to `['*']`, the connector's default scopes", "Catch `UserAuthorizationRequiredError`, call `startAuthorization` and send the user to the returned URL. Consent needs a person in a browser", "Outside Vercel, pass a Vercel access token as `vercelToken`. It can request only the app subject or its own user, not another user", "On a 429 wait one minute for the window to reset. Limits are 200 token requests a minute per team" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.8 } ], "editorialScores": { "ergonomics": 75, "maintenance": 81, "payments": 40, "reliability": 63, "schema": 84, "security": 83, "transparency": 55 }, "provenanceScore": 99 }, "connect": { "install": "pnpm add @vercel/connect", "http": "curl -X POST https://api.vercel.com/v1/connect/token/slack%2Facme-slack \\\n -H \"Authorization: Bearer $VERCEL_OIDC_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"subject\":{\"type\":\"app\"},\"scopes\":[\"chat:write\"]}'" }, "letme": { "capability": "https://letme.dev/auth.tokens", "tool": "https://letme.dev/vercel-connect" }, "sameCompany": [ "vercel-sandbox" ], "area": "agent-runtime", "unitPrices": [ { "item": "Token request (Pro)", "unit": "1k-requests", "usd": 3, "note": "Hobby includes 500 a month. Enterprise negotiated" }, { "item": "Trigger, a forwarded provider webhook (Pro)", "unit": "1k-requests", "usd": 0.95, "note": "Counted per destination. Hobby includes 1,000 a month" } ], "provenance": { "legalEntity": "Vercel Inc.", "domain": "vercel.com", "domainRegistered": "1999-10-04", "endpointOnVendorDomain": true, "terms": "https://vercel.com/legal/terms", "privacy": "https://vercel.com/legal/privacy-policy", "statusPage": "https://www.vercel-status.com", "changelog": "https://vercel.com/changelog", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Terms of Service (last updated 1 June 2026) name Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, and California law. The DPA calls Vercel Inc. a Delaware corporation.", "Connect also has its own product terms at https://vercel.com/docs/connect/legal. The Terms of Service text we read does not mention Connect by name.", "The Privacy Notice (effective 1 June 2026) says it does not apply to personal information Vercel processes as a processor for customers, which the DPA covers. The DPA (effective 31 March 2026) applies to Pro and Enterprise plans.", "https://vercel.com/.well-known/security.txt points to HackerOne and responsible.disclosure@vercel.com and expires 2027-09-28.", "RDAP gives vercel.com a registration date of 1999-10-04, long before Vercel, so the domain was bought later.", "The API answers at api.vercel.com and the OpenAPI document at openapi.vercel.sh." ], "score": 99 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/vercel-connect.json", "live": { "slug": "vercel-connect", "probe": { "target": "https://api.vercel.com", "method": "get", "lastAt": "2026-10-09T10:43:00.826005623Z", "lastOk": true, "lastStatus": 200, "lastMs": 550, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 570, "p95ms24h": 1136, "samples24h": 33, "samples30d": 33, "days": [ { "date": "2026-10-09", "probes": 33, "ok": 33 } ] }, "vendorStatus": { "page": "https://www.vercel-status.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-09T10:42:07.466379649Z" }, "updatedAt": "2026-10-09T10:43:00.826005623Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Aembit, Inc.", "b": "Vercel Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.vercel.com", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0", "b": "Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-07", "b": "2026-10-06", "name": "Last release" }, { "a": "2026-07-14", "b": "2026-06-01", "name": "Terms last updated" }, { "a": "2026-05-05", "b": "2026-06-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "27 npm/wk", "b": "16k stars, 738k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Aembit scores 70.5 (BB) on agent readiness against Vercel Connect's 68.8 (B), and leads in 3 of 7 scored categories. Vercel Connect leads on transparency \u0026 trust.", "question": "Which is better for AI agents, Aembit or Vercel Connect?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Aembit and Vercel Connect need an API key?" }, { "answer": "No hosted endpoint is listed for Aembit. Vercel Connect has a hosted endpoint at https://api.vercel.com.", "question": "Can an agent call Aembit and Vercel Connect without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Agent-ready, a grade of BB or better", "No incidents deducted, where Vercel Connect loses 3 points for them" ], "goodFor": "A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.", "slug": "aembit", "watchFor": "No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance" }, { "aheadOn": [ "Transparency \u0026 trust, 77 against 60" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets.", "slug": "vercel-connect", "watchFor": "Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment" } ], "job": { "capability": "auth.oauth", "name": "Auth oauth" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity.json", "title": "Aembit vs Amazon Bedrock AgentCore Identity", "url": "https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-arcade.json", "title": "Aembit vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/aembit-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.json", "title": "Aembit vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.json", "title": "Aembit vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-keycard.json", "title": "Aembit vs Keycard", "url": "https://www.anchorterminal.com/compare/aembit-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.json", "title": "Aembit vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-nango.json", "title": "Aembit vs Nango", "url": "https://www.anchorterminal.com/compare/aembit-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.json", "title": "Aembit vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps.json", "title": "Aembit vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-workos-pipes.json", "title": "Aembit vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/aembit-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.json", "title": "Amazon Bedrock AgentCore Identity vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.json", "title": "Arcade.dev vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.json", "title": "Auth0 for AI Agents (Token Vault) vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.json", "title": "Descope Agentic Identity Hub vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.json", "title": "Keycard vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.json", "title": "Microsoft Entra Agent ID vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-vercel-connect.json", "title": "Nango vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/nango-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.json", "title": "Scalekit AgentKit vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.json", "title": "Stytch Connected Apps vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.json", "title": "Vercel Connect vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes" } ], "scores": [ { "aembit": 65, "by": 2, "edge": "aembit", "key": "reliability", "name": "Reliability", "vercel-connect": 63, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "aembit": 85, "by": 1, "edge": "aembit", "key": "schema", "name": "Schema \u0026 documentation", "vercel-connect": 84, "weight": 13 }, { "aembit": 72, "by": 3, "edge": "vercel-connect", "key": "ergonomics", "name": "Agent ergonomics", "vercel-connect": 75, "weight": 13 }, { "aembit": 84, "by": 1, "edge": "aembit", "key": "security", "name": "Security \u0026 auth", "vercel-connect": 83, "weight": 14 }, { "aembit": 40, "by": 0, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "vercel-connect": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "aembit": 80, "by": 1, "edge": "vercel-connect", "key": "maintenance", "name": "Maintenance \u0026 community", "vercel-connect": 81, "weight": 7 }, { "aembit": 60, "by": 17, "edge": "vercel-connect", "key": "transparency", "name": "Transparency \u0026 trust", "vercel-connect": 77, "weight": 7 } ], "summary": "Aembit scores 70.5 (BB) on agent readiness against Vercel Connect's 68.8 (B), and leads in 3 of 7 scored categories. Vercel Connect leads on transparency \u0026 trust. Both do auth oauth.", "verdicts": { "aembit": "Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.", "vercel-connect": "Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, the status page records 94 minutes of elevated Connect errors on 10 September 2026, and the only SDK is TypeScript." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect", "json": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.md", "slim": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.min.md" }, "markdown": "Aembit scores 70.5 (BB) on agent readiness against Vercel Connect's 68.8 (B), and leads in 3 of 7 scored categories. Vercel Connect leads on transparency \u0026 trust. Both do auth oauth.\n\n- Aembit: grade BB, 70.5/100, rank #147 of 842. Markdown https://www.anchorterminal.com/tools/aembit.md · JSON https://www.anchorterminal.com/api/v1/tools/aembit.json\n- Vercel Connect: grade B, 68.8/100, rank #195 of 842. Markdown https://www.anchorterminal.com/tools/vercel-connect.md · JSON https://www.anchorterminal.com/api/v1/tools/vercel-connect.json\n\n## Which one, for what\n\n### Aembit (BB)\n\nGood for: A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- No incidents deducted, where Vercel Connect loses 3 points for them\n\nWatch for: No rate limit figures in the reviewed documentation. The Edge API lists 429 responses without limits or Retry-After guidance\n\n### Vercel Connect (B)\n\nGood for: Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets.\n\nAhead on:\n- Transparency \u0026 trust, 77 against 60\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment\n\n\n## Score by category\n\n| Category | Weight | Aembit | Vercel Connect | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 63 | Aembit +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 84 | Aembit +1 |\n| Agent ergonomics | 13% (16.2 this run) | 72 | 75 | Vercel Connect +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 84 | 83 | Aembit +1 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 40 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 80 | 81 | Vercel Connect +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 77 | Vercel Connect +17 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **70.5 · BB** | **68.8 · B** | |\n\n## Facts side by side\n\n| Fact | Aembit | Vercel Connect |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Aembit, Inc. | Vercel Inc. |\n| Hosted endpoint | no (local only) | `https://api.vercel.com` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0 | Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-07 | 2026-10-06 |\n| Terms last updated | 2026-07-14 | 2026-06-01 |\n| Privacy policy last updated | 2026-05-05 | 2026-06-01 |\n| Customer content may train models | not found in the text | yes, with an opt-out |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 27 npm/wk | 16k stars, 738k npm/wk |\n\n## Verdicts\n\n**Aembit.** Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.\n\n**Vercel Connect.** Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, the status page records 94 minutes of elevated Connect errors on 10 September 2026, and the only SDK is TypeScript.\n\n## Before you call either\n\n### Aembit\n\n1. Read the API Base URL and token from the tenant's Profile page. Tokens last 1 hour by default, so plan to refresh\n2. Send `X-Aembit-ResourceSet` on Cloud API, Edge API and MCP calls outside the default Resource Set, or the request runs against the default set\n3. Cache the Edge API access token from `/edge/v1/auth` until near expiry before calling `/edge/v1/credentials`. Both endpoints can answer 429\n4. Point MCP clients at `https://\u003cgateway-host\u003e/mcp`. The `/me` path is deprecated\n5. Expect tool names prefixed with the Server Workload name behind the MCP Identity Gateway, and keep `perPage` at 100 or less on the Aembit MCP Server\n\n### Vercel Connect\n\n1. Call `getToken` at request time and don't store the result. The SDK caches up to 100 tokens in process and refreshes them 30 seconds before expiry\n2. Pass `scopes` on every request. Since SDK 1.0.0 an omitted `scopes` defaults to `['*']`, the connector's default scopes\n3. Catch `UserAuthorizationRequiredError`, call `startAuthorization` and send the user to the returned URL. Consent needs a person in a browser\n4. Outside Vercel, pass a Vercel access token as `vercelToken`. It can request only the app subject or its own user, not another user\n5. On a 429 wait one minute for the window to reset. Limits are 200 token requests a minute per team\n\n## Questions\n\n### Which is better for AI agents, Aembit or Vercel Connect?\n\nAembit scores 70.5 (BB) on agent readiness against Vercel Connect's 68.8 (B), and leads in 3 of 7 scored categories. Vercel Connect leads on transparency \u0026 trust.\n\n### Do Aembit and Vercel Connect need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Aembit and Vercel Connect without installing anything?\n\nNo hosted endpoint is listed for Aembit. Vercel Connect has a hosted endpoint at https://api.vercel.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.json, and with the fewest tokens: https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"aembit\", \"b\": \"vercel-connect\"}`. From a terminal: `anchor compare aembit vercel-connect`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/aembit.json and https://www.anchorterminal.com/api/v1/tools/vercel-connect.json\n\n## Other comparisons with Aembit or Vercel Connect\n\n- [Aembit vs Amazon Bedrock AgentCore Identity](https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity.md)\n- [Aembit vs Arcade.dev](https://www.anchorterminal.com/compare/aembit-vs-arcade.md)\n- [Aembit vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.md)\n- [Aembit vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/aembit-vs-descope-agentic-identity.md)\n- [Aembit vs Keycard](https://www.anchorterminal.com/compare/aembit-vs-keycard.md)\n- [Aembit vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/aembit-vs-microsoft-entra-agent-id.md)\n- [Aembit vs Nango](https://www.anchorterminal.com/compare/aembit-vs-nango.md)\n- [Aembit vs Scalekit AgentKit](https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.md)\n- [Aembit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps.md)\n- [Aembit vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/aembit-vs-workos-pipes.md)\n- [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md)\n- [Arcade.dev vs Vercel Connect](https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.md)\n- [Auth0 for AI Agents (Token Vault) vs Vercel Connect](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.md)\n- [Descope Agentic Identity Hub vs Vercel Connect](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.md)\n- [Keycard vs Vercel Connect](https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.md)\n- [Microsoft Entra Agent ID vs Vercel Connect](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.md)\n- [Nango vs Vercel Connect](https://www.anchorterminal.com/compare/nango-vs-vercel-connect.md)\n- [Scalekit AgentKit vs Vercel Connect](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.md)\n- [Stytch Connected Apps vs Vercel Connect](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.md)\n- [Vercel Connect vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Aembit vs Vercel Connect", "url": "" } ], "description": "Aembit scores 70.5 (BB) on agent readiness against Vercel Connect's 68.8 (B), and leads in 3 of 7 scored categories. Vercel Connect leads on transparency \u0026 trust. Both do auth oauth. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Aembit BB 70.5", "Vercel Connect B 68.8", "scores" ], "h1": "Aembit vs Vercel Connect", "image": "https://www.anchorterminal.com/assets/og/compare-aembit-vs-vercel-connect.png", "path": "/compare/aembit-vs-vercel-connect", "published": "2026-10-01", "section": "tools", "title": "Aembit vs Vercel Connect for AI agents, BB 70.5 vs B 68.8", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect" }, "tokens": { "markdown": 2400, "slim": 680 }, "version": 1 }