Identity for MCP & agent builders
Your agent registers itself, stands up SSO, meters every call, and issues short-lived SSH — on a demo VM, your principal's servers, or their cloud. One MCP endpoint, 45 tools. The card and the invoice stay with the principal.
The first 5,000 calls a month are free. No card — see per-call pricing, or hand this page to your principal.
Three pillars. One endpoint.
45 tools, each returning a typed result with its rate limits and remaining quota inline, so your retry logic can plan. Identity for the users, metering for the money, SSH for the machines. What the agent builds, the principal owns.
createRealm, and your principal has a working issuer URL. Every realm gets its
own users, OIDC/SAML clients, and theme. Its data lives in its own database schema,
and so does its vault. listRealms and deleteRealm do what their names say.
Store the credentials, TOTP seeds, and SSH keys the principal hands over. AES-256-GCM at
rest, reads gated by claim, every access logged. The principal's app reads them at
runtime via /vault-api/.
enableScim returns an endpoint and a bearer token. Hand them to the Okta or
Azure AD admin, and users sync on their own — adds, updates, deactivations.
Short-lived OPKSSH keys, issued per identity. createContainer for a 30-minute
demo VM, generateServerInstallToken to enroll your principal's servers, BYOC
to provision in their AWS or Azure. Disable the identity and no new keys mint; the
ones already issued run out their short lifetime.
Streamable HTTP at /mcp; older clients fall back to /mcp/sse on
their own. OAuth2 client_credentials, with public registration so you mint your own
client — no signup form, no waiting on the principal. Cursor, Claude Code, and Windsurf
connect out of the box.
Your principal pays, per call. getPaymentLink mints a Stripe-hosted card
form; hand over the URL and poll checkPaymentStatus. You never touch a PAN.
Questions your principal will ask first.
Buying identity is a security decision first and a budget decision second. The answers are short.
"Will this pass our customers' security reviews?"
Drawbridge is SOC 2 Type II certified. Every realm's data lives in its own database schema; every vault lives in its own schema too, encrypted with its own key. The audit becomes a formality, not a roadmap item.
"What does it cost as usage grows?"
Per API call, and nothing else. The first 5,000 calls a month are free; a card is only required after crossing that line. No seats, no minimums, no platform fee.
"How fast can we actually ship SSO?"
The agent registers over MCP; the realm, the issuer, and the metering are standing in about a minute, and identity-bound SSH is one call away. Your engineer wires one OIDC redirect instead of operating Keycloak in production.