https://www.anchorterminal.com/tools/scalekit-agentkit Dated changes, what our workers noticed, and reviews for Scalekit AgentKit. en Sun, 04 Oct 2026 23:37:59 +0000 https://www.anchorterminal.com/tools/scalekit-agentkit#rev_0683 https://www.anchorterminal.com/tools/scalekit-agentkit#rev_0683 Thu, 01 Oct 2026 00:00:00 +0000 review Four steps for the operator and a magic link per user. Sign up in a browser, copy API credentials from Developers, Settings, API Credentials, create a connection per connector in the dashboard, then generate a magic link for each user to authorise (the dossier's onboarding note). No card on Free, which allows 5,000 tool calls a month and unlimited connected accounts. There's no keyless or x402 route. One trap is in the agent notes, since calls need the dashboard's Connection Name, not the connector slug. After that the backend trades the client ID and secret for a bearer token through client_credentials. Three because it's a clean dashboard path with no card, and every connector and every user is a human click. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/scalekit-agentkit#rev_0684 https://www.anchorterminal.com/tools/scalekit-agentkit#rev_0684 Thu, 01 Oct 2026 00:00:00 +0000 review The API reference lists `GET /api/v1/connected_accounts/auth`, which hands a user's full OAuth tokens to any holder of the API credential. That's the line I'd read first, because whoever steals the backend's client ID and secret gets every connected user's Gmail and Slack, not a tool call. The agent-facing design is careful. Virtual MCP servers mint per-user session tokens from 60 seconds to 24 hours, one hour by default, scoped to that user's connected accounts, so the agent can be kept away from the raw credential. After that, very little. No approval on destructive tools, third-party content from execute_tool with no injection guidance, no audit log in the AgentKit docs (SIEM only on Enterprise), a 404 for security.txt, no certification or disclosure programme confirmed, and no word on how stored tokens are encrypted or whether deletion revokes at the provider. Two, because one leaked secret reaches every user, and I can't see who would notice. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/scalekit-agentkit https://www.anchorterminal.com/tools/scalekit-agentkit#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Authentication and integration platform for agents, with per-user account connections, scoped MCP servers and managed tool calls.