Stytch: MCP vendor profile
Stytch Connected Apps turns an app into the OAuth authorization server for its remote MCP server, treating each MCP client as a Connected App that asks for consent through the authorization code grant, as documented by the vendor. Stytch pricing says 10,000 monthly active users and AI agents are "Always free" (stytch.com).
At a glance
| Listed as | Stytch (Connected Apps for MCP) |
|---|
| Type | Auth providers |
|---|
| Operator | Twilio |
|---|
| Home | stytch.com |
|---|
| Price | free tier then usage |
|---|
| Read | 5 November 2026 |
|---|
What it does for this layer
Stytch's own MCP server at https://mcp.stytch.dev/mcp answers an unauthenticated request with a resource_metadata pointer to /.well-known/oauth-protected-resource, and the guide uses it as the worked example (stytch.com). Stytch pricing states no hard caps: past the free 10,000 MAUs, 5 SSO or SCIM connections, 1,000 M2M tokens and 10,000 fingerprints, usage is billed per unit, for example 125 USD per connection and 0.005 USD per fingerprint (stytch.com). The Stytch home page says Stytch "has joined Twilio" (stytch.com).
The Stytch home page markets agent detection with the line "Detect and stop malicious and misbehaving agents" (stytch.com, vendor's own claim). Stytch's MCP guide says "MCP Clients are a type of Connected App" that request access to a member's account through the authorization_code grant (stytch.com). With Stytch, the app hosts a Stytch component for the OAuth consent step, either in its main frontend or in a standalone MCP server (stytch.com).
Products and plans
Stytch: products read on 5 November 2026, with the price where the page gave one| Product | What it does | Price |
|---|
| Connected Apps | OAuth authorization server and consent UI that lets MCP clients connect to an app's MCP server. | free tier then usage; from 0 USD; 10,000 MAUs and AI agents free (source, as of 5 November 2026) |
Standards
Stytch: what the vendor's pages state about the standards, by the part of each standard| Standard | Part of it | Status | What the page says | Source |
|---|
| MCP | protected resource metadata | Supports | The worked example serves /.well-known/oauth-protected-resource. | stytch.com |
| MCP | OAuth authorization code grant | Supports | MCP clients use the authorization_code grant as Connected Apps. | stytch.com |
Checks on its own domain
Stytch: the checks run on stytch.com| Check | Domain | Result | Scanned | Method |
|---|
| Ora cached score | stytch.com | 63 of 100, grade C | 31 August 2026 | how it was taken |
| Cloudflare agent-readiness scan | stytch.com | 20 of 100, L1 Basic Web Presence; 3 of 15 counted checks passed | 5 November 2026 | how it was taken |
What it does not do
- Stytch does not host the MCP server; the guide has the developer build it on Cloudflare, Vercel or another host (stytch.com).
- The Stytch MCP guide read here does not state Client ID Metadata Document support.