Scalekit MCP: What It Offers, Pricing and Alternatives

Scalekit sells authentication for business software and AI agents, and it has two MCP products. MCP Auth adds OAuth 2.1 sign-in to an MCP server you build and host. AgentKit gives your own agents tools in other apps, served through what Scalekit calls Virtual MCP servers.

Checked against: Scalekit's MCP Auth page on 28 October 2026. eSEOspace did not test Scalekit's products.

At a glance

What Scalekit offers for MCP

MCP Auth

Scalekit's MCP Auth intro describes Scalekit as the OAuth 2.1 authorization server and your MCP server as the resource server. The flow follows the MCP authorization spec:

1. The client hits your server and gets a 401 pointing to Scalekit.
2. The client reads your /.well-known/oauth-protected-resource file. Scalekit gives you the JSON to paste in from its dashboard.
3. The client registers, the user signs in and consents, and Scalekit issues a scoped token.
4. Your server validates the token and enforces scopes.

When you add a server in the dashboard, you can turn on DCR and CIMD. Scalekit's MCP Auth quickstart says that for public clients such as Claude, Cursor or VS Code, "it is recommended to keep both DCR and CIMD enabled." Clients that support CIMD use it, and others fall back to DCR. Note that the current spec now prefers CIMD over DCR, and parts of Scalekit's text still describe DCR as a SHOULD.

The MCP Auth product page lists more:

• Bring your own auth. Login goes to your existing system, and "Scalekit is the OAuth layer."
• Cross-App Access for enterprise identity providers, listed under the Enterprise plan.
• A client registry and per-request event timeline, with log streaming to tools like Datadog or Splunk.
• One-click revocation of grants.

Quickstarts cover Express, FastAPI with FastMCP, and FastMCP alone.

AgentKit

AgentKit is the other direction: your agent calls other apps as a user. Scalekit's docs index says it runs each user's OAuth flow, stores tokens in a vault, and executes tool calls across 614 connectors. A Virtual MCP server exposes only the tools you choose, for one user at a time. You can also mint a read-only session token, so the agent sees only tools that don't change anything. That is a direct fix for excessive permissions.

Who it's for

MCP Auth fits a SaaS company that wants its MCP server listed in AI app directories without writing OAuth code. AgentKit fits teams building agents that act in users' Gmail, CRM or ticketing tools.

Pricing

Scalekit's Auth for SaaS pricing shows, as of October 2026:

• SaaSKit Free: $0, 25,000 MAUs, 25 organizations, 1 SSO and 1 SCIM connection.
• SaaSKit Growth: $99 per month, 100,000 MAUs, then $0.05 per extra user. It includes "MCP Auth with your branding."
• BYOA Growth: $99 per month, plus a $99 per month MCP auth add-on.
• Enterprise: custom.

The MCP Auth page says "Free plan available." The pricing page does not say how much MCP Auth the Free plan includes, so confirm with Scalekit.

AgentKit is priced separately on the main pricing page. Free includes 10,000 tool calls per month, though the comparison table there says 5,000. Growth is $99 per month for 100,000 calls.

Security and trust

Scalekit's trust center says it is "SOC 2 Type 2 and ISO 27001 certified" and GDPR and CCPA compliant. It says it runs annual third-party penetration tests and encrypts data at rest with AES-256. It also says HIPAA BAAs are available, and the homepage puts them on Enterprise.

Alternatives

• WorkOS offers AuthKit as an OAuth server for MCP.
• Stytch offers Connected Apps for MCP clients.
• Descope offers an Agentic Identity Hub with a credential vault.

Next step

Plan scopes before you pick a vendor. Our least-privilege lesson shows how. Then compare vendors in our MCP companies hub, or ask us about MCP development.

Frequently asked questions