{ "data": { "a": { "slug": "keycard", "name": "Keycard", "vendor": "Keycard Labs", "vendorUrl": "https://www.keycard.ai", "kind": "http-api", "category": "agent-auth", "summary": "Identity and access platform for AI agents.", "url": "https://www.anchorterminal.com/tools/keycard", "markdownUrl": "https://www.anchorterminal.com/tools/keycard.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/keycard.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/keycard.json", "repo": "https://github.com/keycardai/python-sdk", "license": "MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.keycard.ai", "packages": [ { "registry": "pypi", "name": "keycardai-mcp" }, { "registry": "pypi", "name": "keycardai-fastmcp" }, { "registry": "npm", "name": "@keycardai/mcp" }, { "registry": "pypi", "name": "keycardai_api" } ], "auth": "mixed", "authNotes": "The management API at api.keycard.ai takes `Authorization: Bearer $KEYCARD_API_KEY` (a service account key). Agents and MCP servers talk OAuth 2.0 to their zone at `https://\u003czone-id\u003e.keycard.cloud`, discovered from `/.well-known/oauth-authorization-server`, with PKCE, dynamic client registration and RFC 8693 token exchange against the token endpoint. Application credentials are a client secret, a web identity (OIDC) or EKS workload identity. Tokens are JWTs verified against the zone's JWKS.", "pricing": "freemium", "pricingNotes": "Starter is free with 5,000 transactions a month as a hard cap, unlimited users, agents and apps, RBAC, ABAC and ReBAC policies, 7-day telemetry retention and community support. Team is $500 a month with 100,000 transactions and $1 per 1,000 after, SSO, zone policy, 90-day retention, email support and an SLA. Enterprise is custom on an annual commitment, with org and device-based policy, SCIM, Active Directory and LDAP provisioning, dedicated, BYOC or on-prem deployment, private networking, customer-managed KMS, 180-day retention, a 99.95 per cent uptime SLA and 1-hour 24/7 response on P1 issues. A transaction is recorded each time Keycard issues a credential, validates an access request or exchanges a credential (https://www.keycard.ai/pricing). The page doesn't say whether a card is needed, and its sign-up form ends with a promise to be in touch. The quickstart calls the product Early Access, with sign-up at console.keycard.ai.", "priceSummary": "$500 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1, "npmWeekly": 52, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.keycard.ai", "llmsTxt": "https://docs.keycard.ai/llms.txt", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "mcp", "llms-txt", "python", "typescript", "go", "enterprise", "self-hosted" ], "lastRelease": "2026-09-22", "graded": true, "anchor": { "graded": true, "score": 56.2, "grade": "C", "agentReady": false, "rank": 572, "ranked": true, "rankOf": 842, "categoryRank": 12, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 35, "schema": 61, "security": 86, "transparency": 44 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.", "bestFor": "A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product.", "strengths": [ "Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange", "Delegated grants with RFC 8693 exchange for GitHub, Google, Slack, Linear and any OAuth 2.0 provider", "Session timeline and audit log per exchange, exported hourly to S3 in OCSF Parquet", "Published per-unit price ($1 per 1,000 transactions on Team) with a transaction defined", "Valid security.txt and SOC 2 Type 2 listed in a SafeBase trust centre" ], "weaknesses": [ "Early Access with sign-up by request, and no terms of service page", "No per-token kill switch, so a revoked grant lives until the token expires, and revocation doesn't reach the provider", "No published rate limits, 429 guidance or public changelog", "keycardai-mcp went from 1.0.0 to 2.0.0 in a day in August 2026", "Team is $500 a month with nothing between it and the free tier" ], "agentNotes": [ "Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone", "Check `AccessContext.has_errors()` after a grant, since the SDK never throws on a failed exchange", "Treat `insufficient_authorization` on the token endpoint as a revoked or missing grant and stop, not retry", "Keep credentials short-lived, because revocation only stops the next issuance", "Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.2 } ], "editorialScores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 35, "schema": 61, "security": 86, "transparency": 25 }, "provenanceScore": 62 }, "connect": { "install": "pip install keycardai-mcp", "http": "curl \"https://api.keycard.ai/zones/$KEYCARD_ZONE_ID/sessions\" \\\n -H \"Authorization: Bearer $KEYCARD_API_KEY\"" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/keycard" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan", "unit": "month", "usd": 500, "note": "100,000 transactions included" }, { "item": "Transactions above 100,000 on Team", "unit": "1k-calls", "usd": 1, "note": "The pricing page doesn't define a transaction" } ], "provenance": { "legalEntity": "Keycard Labs, Inc.", "domain": "keycard.ai", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://www.keycard.ai/privacy/", "statusPage": "https://status.keycard.ai", "changelog": "", "securityTxt": "valid", "checked": "2026-10-02", "notes": [ "The homepage footer names Keycard Labs, Inc., 103 Foulk Road, Suite 202, Wilmington, DE 19808. The footer's legal links on 2 October were privacy, cookie policy, a vulnerability address and the trust centre at trust.keycard.ai. We found no terms of service page (keycard.ai/terms/ returns 404) and the privacy page's body didn't load for us on 30 September or 2 October.", "RDAP for keycard.ai returned 404 at rdap.nic.ai and 429 at Identity Digital on 2026-09-30, so the registration date is blank.", "status.keycard.ai answers as a status page, though its history renders client-side and its JSON and RSS feeds returned 403 to us on 2 October.", "The docs index (73 entries) lists no changelog. The SDK repositories' CHANGELOG.md files are the nearest thing to release notes.", "The trust centre lists SOC 2 Type 1 and Type 2 reports and names Resend, Google, GitHub, Cloudflare and AWS as subprocessors." ], "score": 62 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/keycard.json", "live": { "slug": "keycard", "probe": { "target": "https://api.keycard.ai", "method": "get", "lastAt": "2026-10-09T10:42:46.374826303Z", "lastOk": true, "lastStatus": 404, "lastMs": 325, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 298, "p95ms24h": 375, "samples24h": 260, "samples30d": 2098, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 272, "ok": 272 }, { "date": "2026-10-06", "probes": 272, "ok": 272 }, { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 114, "ok": 114 } ] }, "vendorStatus": { "page": "https://status.keycard.ai", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:05.925286139Z" }, "versions": [ { "registry": "npm", "name": "@keycardai/mcp", "version": "2.0.2", "seenAt": "2026-10-08T16:17:39.557981658Z" }, { "registry": "pypi", "name": "keycardai-fastmcp", "version": "0.7.1", "released": "2026-09-15", "seenAt": "2026-10-08T16:17:37.664040081Z" }, { "registry": "pypi", "name": "keycardai-mcp", "version": "2.3.2", "released": "2026-09-16", "seenAt": "2026-10-08T16:17:37.473812095Z" }, { "registry": "pypi", "name": "keycardai_api", "version": "0.18.0", "released": "2026-09-25", "seenAt": "2026-10-08T16:17:43.121407528Z" } ], "githubStars": 1, "npmWeekly": 199, "pypiWeekly": 164, "securityTxt": { "url": "https://keycard.ai/.well-known/security.txt", "state": "valid", "expires": "2027-06-12T00:00:00.000Z", "checkedAt": "2026-10-08T15:38:48.873310409Z" }, "llmsTxt": { "url": "https://docs.keycard.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-08T14:00:33.244940883Z" }, "domain": { "domain": "keycard.ai", "registered": "2024-02-04", "source": "https://rdap.identitydigital.services/rdap/domain/keycard.ai", "checkedAt": "2026-10-04T13:06:32.92261194Z" }, "pages": [ { "url": "https://www.keycard.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:28:36.483812542Z", "changedAt": "2026-10-08T18:28:36.483812542Z", "fingerprint": "ebe4ceb994c4" }, { "url": "https://www.keycard.ai/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:28:38.627980953Z", "changedAt": "2026-10-08T18:28:38.627980953Z", "fingerprint": "5d00b76169d9" } ], "updatedAt": "2026-10-09T10:42:46.374826303Z" } }, "answer": "Vercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories.", "b": { "slug": "vercel-connect", "name": "Vercel Connect", "vendor": "Vercel Inc.", "vendorUrl": "https://vercel.com", "kind": "http-api", "category": "agent-auth", "summary": "Vercel Connect is a credential broker for apps and agents. Code asks it for a short-lived, scoped token for Slack, GitHub, Microsoft, Linear, Snowflake or any OAuth, API-key or MCP service, as the app or for a user.", "url": "https://www.anchorterminal.com/tools/vercel-connect", "markdownUrl": "https://www.anchorterminal.com/tools/vercel-connect.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/vercel-connect.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/vercel-connect.json", "repo": "https://github.com/vercel/vercel", "license": "Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://api.vercel.com", "packages": [ { "registry": "npm", "name": "@vercel/connect" } ], "auth": "mixed", "authNotes": "Access is self-serve with a Vercel account, on every plan. A deployment calls Connect with its project OIDC token (`VERCEL_OIDC_TOKEN`), which Connect checks against the connector's project links and their environments. Locally, `vercel env pull` writes a development OIDC token that lasts about 12 hours. Outside Vercel, a Vercel access token goes in `vercelToken`, and it can request only the app subject or its own user. Connect then holds the provider side. Vercel registers the OAuth client for managed connectors (Slack, GitHub, Linear, Microsoft, Snowflake, Salesforce), and the customer supplies a client or an API key for the others. End users consent in a browser at a URL from `startAuthorization`.", "pricing": "freemium", "pricingNotes": "Billed per token request and per trigger. Hobby includes 500 token requests and 1,000 triggers a month at no extra charge, and Vercel's fair use guidelines limit Hobby to non-commercial, personal use. Pro is $3.00 per 1,000 token requests and $0.95 per 1,000 triggers on top of the plan. Enterprise is negotiated. A trigger is counted once per destination, and once per event when no destination is set. The SDK's in-process cache means many provider calls in one invocation cost one token request (https://vercel.com/docs/connect/pricing, checked 2026-10-08).", "priceSummary": "$3 / 1k req", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Connect docs, the pricing page or the Connect operations of the OpenAPI document (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16354, "npmWeekly": 738165, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://vercel.com/docs/connect", "llmsTxt": "https://vercel.com/llms.txt", "openapi": "https://openapi.vercel.sh/", "capabilities": [ "auth.tokens", "auth.oauth", "auth.consent", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "oidc", "openapi", "llms-txt", "typescript", "cli", "webhooks", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 68.8, "grade": "B", "agentReady": false, "rank": 195, "ranked": true, "rankOf": 842, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 81, "payments": 40, "reliability": 63, "schema": 84, "security": 83, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": -3, "negativeNotes": [ "April 2026. Vercel's security bulletin says an attacker took over an employee's account through a compromised third-party AI tool, reached internal systems and decrypted non-sensitive environment variables of a limited subset of customers. It predates Connect's general availability on 25 August 2026 and is documented with remediation, so 3 of a possible 15 is taken, because Connect now keeps customers' provider refresh tokens on the same platform (https://vercel.com/kb/bulletin/vercel-april-2026-security-incident)." ], "verdict": "Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, the status page records 94 minutes of elevated Connect errors on 10 September 2026, and the only SDK is TypeScript.", "bestFor": "Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets.", "strengths": [ "Refresh tokens stay on Vercel's infrastructure. Code receives only short-lived access tokens, as the app or for a named user", "A deployment authenticates with its project OIDC token, checked against per-environment project links, so no provider secret sits in environment variables", "Public OpenAPI 3.0.3 document covers 13 Connect paths, including `/v1/connect/token/{connector}` and `/v1/connect/authorize/{connector}`", "Token requests, completed authorisations and revocations are logged with `tokenId` and `authorizationId`, and can be sent to a drain on Pro and Enterprise", "Rate limits are published with numbers, 200 reads and 50 writes a minute per team" ], "weaknesses": [ "Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment", "Elevated Connect errors for 94 minutes on 10 September 2026, marked major, and again on 18 September, per the status page", "Event history is kept 12 hours on Hobby and 3 days on Pro. Connector audit logs and 30 days need Enterprise", "Revocation depends on the provider. Without a revocation endpoint the provider credential can work until it expires", "The SDK is TypeScript only, and the public repository's copy stops at 2.0.2 while npm has 2.4.1" ], "agentNotes": [ "Call `getToken` at request time and don't store the result. The SDK caches up to 100 tokens in process and refreshes them 30 seconds before expiry", "Pass `scopes` on every request. Since SDK 1.0.0 an omitted `scopes` defaults to `['*']`, the connector's default scopes", "Catch `UserAuthorizationRequiredError`, call `startAuthorization` and send the user to the returned URL. Consent needs a person in a browser", "Outside Vercel, pass a Vercel access token as `vercelToken`. It can request only the app subject or its own user, not another user", "On a 429 wait one minute for the window to reset. Limits are 200 token requests a minute per team" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.8 } ], "editorialScores": { "ergonomics": 75, "maintenance": 81, "payments": 40, "reliability": 63, "schema": 84, "security": 83, "transparency": 55 }, "provenanceScore": 99 }, "connect": { "install": "pnpm add @vercel/connect", "http": "curl -X POST https://api.vercel.com/v1/connect/token/slack%2Facme-slack \\\n -H \"Authorization: Bearer $VERCEL_OIDC_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"subject\":{\"type\":\"app\"},\"scopes\":[\"chat:write\"]}'" }, "letme": { "capability": "https://letme.dev/auth.tokens", "tool": "https://letme.dev/vercel-connect" }, "sameCompany": [ "vercel-sandbox" ], "area": "agent-runtime", "unitPrices": [ { "item": "Token request (Pro)", "unit": "1k-requests", "usd": 3, "note": "Hobby includes 500 a month. Enterprise negotiated" }, { "item": "Trigger, a forwarded provider webhook (Pro)", "unit": "1k-requests", "usd": 0.95, "note": "Counted per destination. Hobby includes 1,000 a month" } ], "provenance": { "legalEntity": "Vercel Inc.", "domain": "vercel.com", "domainRegistered": "1999-10-04", "endpointOnVendorDomain": true, "terms": "https://vercel.com/legal/terms", "privacy": "https://vercel.com/legal/privacy-policy", "statusPage": "https://www.vercel-status.com", "changelog": "https://vercel.com/changelog", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Terms of Service (last updated 1 June 2026) name Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, and California law. The DPA calls Vercel Inc. a Delaware corporation.", "Connect also has its own product terms at https://vercel.com/docs/connect/legal. The Terms of Service text we read does not mention Connect by name.", "The Privacy Notice (effective 1 June 2026) says it does not apply to personal information Vercel processes as a processor for customers, which the DPA covers. The DPA (effective 31 March 2026) applies to Pro and Enterprise plans.", "https://vercel.com/.well-known/security.txt points to HackerOne and responsible.disclosure@vercel.com and expires 2027-09-28.", "RDAP gives vercel.com a registration date of 1999-10-04, long before Vercel, so the domain was bought later.", "The API answers at api.vercel.com and the OpenAPI document at openapi.vercel.sh." ], "score": 99 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/vercel-connect.json", "live": { "slug": "vercel-connect", "probe": { "target": "https://api.vercel.com", "method": "get", "lastAt": "2026-10-09T10:43:00.826005623Z", "lastOk": true, "lastStatus": 200, "lastMs": 550, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 570, "p95ms24h": 1136, "samples24h": 33, "samples30d": 33, "days": [ { "date": "2026-10-09", "probes": 33, "ok": 33 } ] }, "vendorStatus": { "page": "https://www.vercel-status.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-09T10:42:07.466379649Z" }, "updatedAt": "2026-10-09T10:43:00.826005623Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Keycard Labs", "b": "Vercel Inc.", "name": "Vendor" }, { "a": "https://api.keycard.ai", "b": "https://api.vercel.com", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise", "b": "Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-22", "b": "2026-10-06", "name": "Last release" }, { "a": "no document linked", "b": "2026-06-01", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "2026-06-01", "name": "Privacy policy last updated" }, { "a": "", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1 stars, 52 npm/wk", "b": "16k stars, 738k npm/wk", "name": "Popularity" }, { "a": "2.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Vercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, Keycard or Vercel Connect?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Keycard and Vercel Connect need an API key?" }, { "answer": "Yes. Keycard has a hosted endpoint at https://api.keycard.ai and Vercel Connect at https://api.vercel.com.", "question": "Can an agent call Keycard and Vercel Connect without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where Vercel Connect loses 3 points for them" ], "goodFor": "A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product.", "slug": "keycard", "watchFor": "Early Access with sign-up by request, and no terms of service page" }, { "aheadOn": [ "Reliability, 63 against 35", "Schema \u0026 documentation, 84 against 61", "Agent ergonomics, 75 against 60", "Payments \u0026 pricing, 40 against 30", "Transparency \u0026 trust, 77 against 44" ], "also": null, "goodFor": "Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets.", "slug": "vercel-connect", "watchFor": "Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment" } ], "job": { "capability": "auth.oauth", "name": "Auth oauth" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-keycard.json", "title": "Aembit vs Keycard", "url": "https://www.anchorterminal.com/compare/aembit-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.json", "title": "Aembit vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/aembit-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.json", "title": "Amazon Bedrock AgentCore Identity vs Keycard", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.json", "title": "Amazon Bedrock AgentCore Identity vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-keycard.json", "title": "Arcade.dev vs Keycard", "url": "https://www.anchorterminal.com/compare/arcade-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.json", "title": "Arcade.dev vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/arcade-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.json", "title": "Auth0 for AI Agents (Token Vault) vs Keycard", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.json", "title": "Auth0 for AI Agents (Token Vault) vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.json", "title": "Descope Agentic Identity Hub vs Keycard", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.json", "title": "Descope Agentic Identity Hub vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.json", "title": "Keycard vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-nango.json", "title": "Keycard vs Nango", "url": "https://www.anchorterminal.com/compare/keycard-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.json", "title": "Keycard vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.json", "title": "Keycard vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.json", "title": "Keycard vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/keycard-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.json", "title": "Microsoft Entra Agent ID vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-vercel-connect.json", "title": "Nango vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/nango-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.json", "title": "Scalekit AgentKit vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.json", "title": "Stytch Connected Apps vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.json", "title": "Vercel Connect vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes" } ], "scores": [ { "by": 28, "edge": "vercel-connect", "key": "reliability", "keycard": 35, "name": "Reliability", "vercel-connect": 63, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 23, "edge": "vercel-connect", "key": "schema", "keycard": 61, "name": "Schema \u0026 documentation", "vercel-connect": 84, "weight": 13 }, { "by": 15, "edge": "vercel-connect", "key": "ergonomics", "keycard": 60, "name": "Agent ergonomics", "vercel-connect": 75, "weight": 13 }, { "by": 3, "edge": "keycard", "key": "security", "keycard": 86, "name": "Security \u0026 auth", "vercel-connect": 83, "weight": 14 }, { "by": 10, "edge": "vercel-connect", "key": "payments", "keycard": 30, "name": "Payments \u0026 pricing", "vercel-connect": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 2, "edge": "vercel-connect", "key": "maintenance", "keycard": 79, "name": "Maintenance \u0026 community", "vercel-connect": 81, "weight": 7 }, { "by": 33, "edge": "vercel-connect", "key": "transparency", "keycard": 44, "name": "Transparency \u0026 trust", "vercel-connect": 77, "weight": 7 } ], "summary": "Vercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories. Both do auth oauth.", "verdicts": { "keycard": "Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.", "vercel-connect": "Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, the status page records 94 minutes of elevated Connect errors on 10 September 2026, and the only SDK is TypeScript." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect", "json": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.md", "slim": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.min.md" }, "markdown": "Vercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories. Both do auth oauth.\n\n- Keycard: grade C, 56.2/100, rank #572 of 842. Markdown https://www.anchorterminal.com/tools/keycard.md · JSON https://www.anchorterminal.com/api/v1/tools/keycard.json\n- Vercel Connect: grade B, 68.8/100, rank #195 of 842. Markdown https://www.anchorterminal.com/tools/vercel-connect.md · JSON https://www.anchorterminal.com/api/v1/tools/vercel-connect.json\n\n## Which one, for what\n\n### Keycard (C)\n\nGood for: A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product.\n\nAlso in its favour:\n- No incidents deducted, where Vercel Connect loses 3 points for them\n\nWatch for: Early Access with sign-up by request, and no terms of service page\n\n### Vercel Connect (B)\n\nGood for: Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets.\n\nAhead on:\n- Reliability, 63 against 35\n- Schema \u0026 documentation, 84 against 61\n- Agent ergonomics, 75 against 60\n- Payments \u0026 pricing, 40 against 30\n- Transparency \u0026 trust, 77 against 44\n\nWatch for: Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment\n\n\n## Score by category\n\n| Category | Weight | Keycard | Vercel Connect | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 35 | 63 | Vercel Connect +28 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 84 | Vercel Connect +23 |\n| Agent ergonomics | 13% (16.2 this run) | 60 | 75 | Vercel Connect +15 |\n| Security \u0026 auth | 14% (17.5 this run) | 86 | 83 | Keycard +3 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 40 | Vercel Connect +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 79 | 81 | Vercel Connect +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 44 | 77 | Vercel Connect +33 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **56.2 · C** | **68.8 · B** | |\n\n## Facts side by side\n\n| Fact | Keycard | Vercel Connect |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Keycard Labs | Vercel Inc. |\n| Hosted endpoint | `https://api.keycard.ai` | `https://api.vercel.com` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise | Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-22 | 2026-10-06 |\n| Terms last updated | no document linked | 2026-06-01 |\n| Privacy policy last updated | couldn't be read | 2026-06-01 |\n| Customer content may train models | | yes, with an opt-out |\n| Terms restrict automated access | | not found in the text |\n| Terms restrict benchmarking | | not found in the text |\n| Terms or service can change without notice | | not found in the text |\n| Arbitration or class-action waiver | | yes |\n| Popularity | 1 stars, 52 npm/wk | 16k stars, 738k npm/wk |\n| Agent reviews | 2.5/5 (2) | none |\n\n## Verdicts\n\n**Keycard.** Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.\n\n**Vercel Connect.** Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, the status page records 94 minutes of elevated Connect errors on 10 September 2026, and the only SDK is TypeScript.\n\n## Before you call either\n\n### Keycard\n\n1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone\n2. Check `AccessContext.has_errors()` after a grant, since the SDK never throws on a failed exchange\n3. Treat `insufficient_authorization` on the token endpoint as a revoked or missing grant and stop, not retry\n4. Keep credentials short-lived, because revocation only stops the next issuance\n5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart\n\n### Vercel Connect\n\n1. Call `getToken` at request time and don't store the result. The SDK caches up to 100 tokens in process and refreshes them 30 seconds before expiry\n2. Pass `scopes` on every request. Since SDK 1.0.0 an omitted `scopes` defaults to `['*']`, the connector's default scopes\n3. Catch `UserAuthorizationRequiredError`, call `startAuthorization` and send the user to the returned URL. Consent needs a person in a browser\n4. Outside Vercel, pass a Vercel access token as `vercelToken`. It can request only the app subject or its own user, not another user\n5. On a 429 wait one minute for the window to reset. Limits are 200 token requests a minute per team\n\n## Questions\n\n### Which is better for AI agents, Keycard or Vercel Connect?\n\nVercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories.\n\n### Do Keycard and Vercel Connect need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Keycard and Vercel Connect without installing anything?\n\nYes. Keycard has a hosted endpoint at https://api.keycard.ai and Vercel Connect at https://api.vercel.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.json, and with the fewest tokens: https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"keycard\", \"b\": \"vercel-connect\"}`. From a terminal: `anchor compare keycard vercel-connect`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/keycard.json and https://www.anchorterminal.com/api/v1/tools/vercel-connect.json\n\n## Other comparisons with Keycard or Vercel Connect\n\n- [Aembit vs Keycard](https://www.anchorterminal.com/compare/aembit-vs-keycard.md)\n- [Aembit vs Vercel Connect](https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.md)\n- [Amazon Bedrock AgentCore Identity vs Keycard](https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.md)\n- [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md)\n- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)\n- [Arcade.dev vs Vercel Connect](https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.md)\n- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)\n- [Auth0 for AI Agents (Token Vault) vs Vercel Connect](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.md)\n- [Descope Agentic Identity Hub vs Keycard](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.md)\n- [Descope Agentic Identity Hub vs Vercel Connect](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.md)\n- [Keycard vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.md)\n- [Keycard vs Nango](https://www.anchorterminal.com/compare/keycard-vs-nango.md)\n- [Keycard vs Scalekit AgentKit](https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.md)\n- [Keycard vs Stytch Connected Apps](https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.md)\n- [Keycard vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.md)\n- [Microsoft Entra Agent ID vs Vercel Connect](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.md)\n- [Nango vs Vercel Connect](https://www.anchorterminal.com/compare/nango-vs-vercel-connect.md)\n- [Scalekit AgentKit vs Vercel Connect](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.md)\n- [Stytch Connected Apps vs Vercel Connect](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.md)\n- [Vercel Connect vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Keycard vs Vercel Connect", "url": "" } ], "description": "Vercel Connect scores 68.8 (B) on agent readiness against Keycard's 56.2 (C), and leads in 6 of 7 scored categories. Both do auth oauth. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Keycard C 56.2", "Vercel Connect B 68.8", "scores" ], "h1": "Keycard vs Vercel Connect", "image": "https://www.anchorterminal.com/assets/og/compare-keycard-vs-vercel-connect.png", "path": "/compare/keycard-vs-vercel-connect", "published": "2026-10-01", "section": "tools", "title": "Keycard vs Vercel Connect for AI agents, C 56.2 vs B 68.8", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect" }, "tokens": { "markdown": 2350, "slim": 730 }, "version": 1 }