Keycard: MCP vendor profile
Keycard gives each agent its own identity and issues scoped, just-in-time credentials at runtime, and puts MCP servers behind a unified access gateway with per-tool policy and an audit log, as documented by the vendor. Keycard's MCP SDK ships as keycardai-mcp and keycardai-fastmcp on PyPI and @keycardai/mcp on npm, with @keycardai/cloudflare for Cloudflare Workers (docs.keycard.ai).
At a glance
| Type | Auth providers |
|---|---|
| Also covers | gateway or proxy |
| Home | www.keycard.ai |
| Price | per transaction |
| Read | 5 November 2026 |
What it does for this layer
Keycard's guide puts Keycard in front of an MCP server or API "so every request carries a verified user, explicit scopes, and an audit record" (docs.keycard.ai). A Keycard unified access gateway "aggregates the tools from multiple upstream MCP servers behind a single MCP endpoint", and the admin chooses which tools it serves and who may call them (docs.keycard.ai). The Keycard MCP package verifies bearer tokens, serves OAuth metadata endpoints and provides grant decorators for delegated access to external APIs (docs.keycard.ai).
Keycard docs include guides to run workloads on Render, Fly.io and Vercel without secrets and to authenticate Entra Agent ID agents (docs.keycard.ai). Keycard pricing lists a Free tier with 5,000 transactions a month as a hard cap and a 500 USD a month tier with 100,000 transactions, then 1 USD per 1,000 (www.keycard.ai). Keycard says all plans include OAuth 2.1, Token Exchange, SPIFFE, WIMSE, MCP, A2A, API and CLI protocols (www.keycard.ai).
Keycard's about page states "$38M raised" (www.keycard.ai, vendor's own claim).
Products and plans
| Product | What it does | Price |
|---|---|---|
| Keycard platform | Agent identity, runtime authorization, unified MCP access gateway and audit log. | per transaction; from 0 USD; Free 5,000 transactions a month (hard cap); 500 USD a month for 100,000 (source, as of 5 November 2026) |
Standards
| Standard | Part of it | Status | What the page says | Source |
|---|---|---|---|---|
| MCP | OAuth metadata endpoints | Supports | The MCP SDK serves OAuth metadata endpoints and verifies bearer tokens. | docs.keycard.ai |
| A2A | A2A in all plans | Supports | Pricing lists A2A among supported protocols. | www.keycard.ai |
Checks on its own domain
| Check | Domain | Result | Scanned | Method |
|---|---|---|---|---|
| Ora cached score | keycard.ai | 65 of 100, grade C | 23 August 2026 | how it was taken |
| Cloudflare agent-readiness scan | keycard.ai | 20 of 100, L1 Basic Web Presence; 3 of 15 counted checks passed | 5 November 2026 | how it was taken |
What it does not do
- Keycard does not host MCP server code; it sits in front of servers the customer runs or installs from its catalog.