Identity for MCP & agent builders

Your agent registers itself, stands up SSO, meters every call, and issues short-lived SSH — on a demo VM, your principal's servers, or their cloud. One MCP endpoint, 45 tools. The card and the invoice stay with the principal.

Read the docs

The first 5,000 calls a month are free. No card — see per-call pricing, or hand this page to your principal.

Three pillars. One endpoint.

45 tools, each returning a typed result with its rate limits and remaining quota inline, so your retry logic can plan. Identity for the users, metering for the money, SSH for the machines. What the agent builds, the principal owns.

Realms

createRealm, and your principal has a working issuer URL. Every realm gets its own users, OIDC/SAML clients, and theme. Its data lives in its own database schema, and so does its vault. listRealms and deleteRealm do what their names say.

Vault

Store the credentials, TOTP seeds, and SSH keys the principal hands over. AES-256-GCM at rest, reads gated by claim, every access logged. The principal's app reads them at runtime via /vault-api/.

SCIM

enableScim returns an endpoint and a bearer token. Hand them to the Okta or Azure AD admin, and users sync on their own — adds, updates, deactivations.

SSH

Short-lived OPKSSH keys, issued per identity. createContainer for a 30-minute demo VM, generateServerInstallToken to enroll your principal's servers, BYOC to provision in their AWS or Azure. Disable the identity and no new keys mint; the ones already issued run out their short lifetime.

MCP transport

Streamable HTTP at /mcp; older clients fall back to /mcp/sse on their own. OAuth2 client_credentials, with public registration so you mint your own client — no signup form, no waiting on the principal. Cursor, Claude Code, and Windsurf connect out of the box.

Metering

Your principal pays, per call. getPaymentLink mints a Stripe-hosted card form; hand over the URL and poll checkPaymentStatus. You never touch a PAN.

Questions your principal will ask first.

Buying identity is a security decision first and a budget decision second. The answers are short.

"Will this pass our customers' security reviews?"

Drawbridge is SOC 2 Type II certified. Every realm's data lives in its own database schema; every vault lives in its own schema too, encrypted with its own key. The audit becomes a formality, not a roadmap item.

"What does it cost as usage grows?"

Per API call, and nothing else. The first 5,000 calls a month are free; a card is only required after crossing that line. No seats, no minimums, no platform fee.

"How fast can we actually ship SSO?"

The agent registers over MCP; the realm, the issuer, and the metering are standing in about a minute, and identity-bound SSH is one call away. Your engineer wires one OIDC redirect instead of operating Keycloak in production.