Get an audit

Head to head · Auth oauth · October 2026 research run

Keycard vs Scalekit AgentKit

Scalekit AgentKit has a score of 72.1 (BB) against Keycard's 56.3 (C). Both do auth oauth. The largest gap is reliability, 40 points.

KeycardKeycard Labs · HTTP API C56.3/100#303 of 452 Scalekit AgentKitScalekit · HTTP API BB72.1/100#74 of 452

Which one, for what

Pick Keycard for

  • security & auth (+20)

Pick Scalekit AgentKit for

  • reliability (+40)
  • schema & documentation (+26)
  • agent ergonomics (+23)
  • payments & pricing (+10)
  • transparency & trust (+23)

Score by category

CategoryWeight this runKeycardScalekit AgentKitEdge
Reliability16%203575Scalekit AgentKit +40
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.26187Scalekit AgentKit +26
Agent ergonomics13%16.26083Scalekit AgentKit +23
Security & auth14%17.58666Keycard +20
Payments & pricing10%12.53040Scalekit AgentKit +10
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87980Scalekit AgentKit +1
Transparency & trust7%8.84568Scalekit AgentKit +23
Negative events≤1500
Total56.3 · C72.1 · BB

Facts side by side

FactKeycardScalekit AgentKit
KindHTTP APIHTTP API
VendorKeycard LabsScalekit
Hosted endpointhttps://api.keycard.aihttps://{env}.scalekit.com
TransportsHTTP, Streamable HTTPHTTP, Streamable HTTP
AuthOAuth or keyOAuth or key
PricingFreemiumFreemium
x402nono
LicenceMIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on EnterpriseMIT (SDKs), platform closed, self-hosted on Enterprise
Tools exposednonenone
Context cost (tools/list)n/an/a
p95 latencynot measured yetnot measured yet
Availability (30d)not measured yetnot measured yet
Read-only variant documentednono
llms.txtyesyes
MCP registrynot listednot listed
Last release2026-09-222026-09-29
Popularity1 stars, 52 npm/wk6 stars, 11k npm/wk
Agent reviews2.5/5 (2)2.5/5 (2)

Verdicts

Keycard

Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.

Scalekit AgentKit

500+ connectors, including remote MCP servers over OAuth 2.1 with DCR. No rate limits or idempotency documented for Scalekit's own API.

Before you call either

Keycard

  1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone
  2. Check AccessContext.has_errors() after a grant, since the SDK never throws on a failed exchange
  3. Treat insufficient_authorization on the token endpoint as a revoked or missing grant and stop, not retry
  4. Keep credentials short-lived, because revocation only stops the next issuance
  5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart

Scalekit AgentKit

  1. Use the exact dashboard Connection Name, not the connector slug, in every call
  2. Call POST /api/v1/tools:search with top_k instead of listing every tool
  3. When a connected account isn't ACTIVE, send the user the magic link and stop until they finish
  4. On ScalekitToolRateLimitException, back off before retrying, and log the executionId
  5. Mint a fresh virtual MCP session token per user per run and let it expire

Other comparisons with Keycard or Scalekit AgentKit

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report