Auth providers
Vendors that sign agents and users in and issue the tokens a remote MCP server checks. 9 vendors typed here by main layer, each read on its own pages on 5 November 2026 and listed A to Z: Auth0, Better Auth, Clerk, Descope, Keycard, Logto, Scalekit, Stytch and WorkOS.
Of these, 9 state at least one standard on the pages read, and 9 publish a price for at least one product. Other layers they also cover: gateway or proxy (2) and connector platform (1).
Auth providers
| Vendor | What it does for this layer | Pricing | Ora score |
|---|---|---|---|
| Auth0 | Auth0's Auth for MCP acts as the OAuth 2.1 authorization server for remote MCP servers, with CIMD and DCR client registration, on-behalf-of token exchange and Token Vault for third-party APIs. | per monthly active user, AI Agents add-on as of 2026-11-05 | 74 (B) scanned 2026-11-05 |
| Better Auth | Better Auth is an open-source TypeScript authentication framework whose MCP plugin turns the app into an OAuth authorization server and protected resource for MCP clients, including the 2026-07-28 profile with CIMD. | open source as of 2026-11-05 | 66 (C) scanned 2026-09-16 |
| Clerk | Clerk runs an OAuth server inside the customer's app that MCP servers built on Next.js or Express can use, with CIMD, DCR fallback and consent screens, and ships its own MCP server, CLI and agent skills. | per retained user as of 2026-11-05 | 90 (A) scanned 2026-11-05 |
| Descope | Descope acts as the authorization server for MCP servers: it publishes discovery metadata, registers clients by CIMD or DCR, runs login and consent, issues tokens and stores downstream credentials in a Connections vault. | monthly base plus usage as of 2026-11-05 | 74 (B) scanned 2026-10-20 |
| Keycard | Keycard gives each agent its own identity and issues scoped, just-in-time credentials at runtime, and puts MCP servers behind a unified access gateway with per-tool policy and an audit log. | per transaction as of 2026-11-05 | 65 (C) scanned 2026-08-23 |
| Logto | Logto is an open-source identity platform whose MCP guide makes Logto the authorization server for an MCP server through the mcp-auth library and MCP SDK v2, with the server registered as an API resource. | monthly plus token usage as of 2026-11-05 | no cached score |
| Scalekit | Scalekit is an OAuth 2.1 authorization server for MCP servers with DCR and CIMD, and also sells AgentKit, an MCP gateway with 600+ connectors and virtual MCP servers scoped by agent role. | per tool call as of 2026-11-05 | 74 (B) scanned 2026-10-10 |
| Stytch | Stytch Connected Apps turns an app into the OAuth authorization server for its remote MCP server, treating each MCP client as a Connected App that asks for consent through the authorization code grant. | free tier then usage as of 2026-11-05 | 63 (C) scanned 2026-08-31 |
| WorkOS | WorkOS AuthKit is a spec-compatible OAuth authorization server for MCP servers, built on WorkOS Connect, with CIMD and optional DCR client registration and resource indicators. | per MAU above 1 million, per connection as of 2026-11-05 | 86 (A) scanned 2026-11-04 |
Typed elsewhere, also covering this layer
Auth providers