Is Casdoor worth it for platform teams running AI agents?

If your agents need scoped access to identity data, yes — this is the strongest reason to pick Casdoor over a generic SSO platform. The built-in MCP server with Streamable HTTP lets Claude Desktop, Cursor, Windsurf, and VS Code with GitHub Copilot manage users, applications, and permissions, and every MCP tool call is authorized against fine-grained, scope-based permissions rather than a shared admin token. Pair that with OpenClaw's OTLP ingestion and you get a runtime record of what each agent did. Worth it if you can operate the stack; skip it if you have no MCP clients.

Does Casdoor integrate with Claude Desktop and Cursor?

Yes. Casdoor documents connecting MCP clients to its /api/mcp endpoint via Streamable HTTP; the published example puts the URL and a bearer Authorization header into claude_desktop_config.json. The homepage lists Claude Desktop, Cursor, Windsurf, and VS Code with GitHub Copilot as supported AI tools, and notes any MCP-compatible client works. Setup instructions and secure token management are covered in Casdoor's MCP documentation.

How does Casdoor compare to Keycloak?

Casdoor publishes its own comparison document at Casdoor vs. Keycloak. Functionally, both cover OIDC, SAML, LDAP, and MFA, and Casdoor ships a Keycloak syncer for migrating users across. The clearest differences are Casdoor's built-in MCP server with per-tool agent permissions, OpenClaw OTLP ingestion into Entries, a bundled SaaS billing module (plans, tiers, payment providers, subscriptions), and Casbin-based ACL/RBAC/ABAC authorization. If you don't need the agent layer or billing, Keycloak's longer track record may suit you better.

Is Casdoor free to use?

Casdoor is free and open source — the homepage states it plainly and thanks sponsors who keep it that way. The real cost is infrastructure and engineering time: you run your own MySQL, PostgreSQL, or SQL Server database and deploy the service via Docker, Helm, or Kubernetes. There is no per-user or per-agent license to pay, which is the main economic argument against managed IAM for teams that already operate their own stack.

What are Casdoor's biggest limitations?

Three things surface from the documentation. First, it's self-hosted, so you own deployment, database operations, upgrades, and migration. Second, the AI-agent features — the MCP server, OAuth 2.1 for agents, and per-tool scope-based permissions — are recent additions to a mature IAM codebase, so test them on your own traffic. Third, the scraped docs describe capabilities in depth but don't publish throughput ceilings or scaling specifics beyond "horizontal scalability." Complex auth workflows are configured through the console and Casbin models, not a no-code builder.

Can Casdoor replace Auth0 or Okta?

For authentication and authorization, yes — Casdoor covers OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, and 100+ identity providers, and publishes Casdoor vs. Auth0 and Casdoor vs. Okta comparisons. What changes is responsibility: you deploy and operate the servers and database rather than consuming a managed API. Casdoor also has syncers for Okta and Azure AD to bring directory data in, which eases a cutover. It's a fair swap for teams with ops capacity; it's not a drop-in for teams without.

How long does Casdoor take to set up?

The docs offer several installation paths: server installation, Try with Docker, and Try with Helm. For an engineer with container experience, getting an instance running against MySQL or PostgreSQL and pointed at your app via the standard OIDC client or Casdoor SDK is a short afternoon. Adding the MCP server to Claude Desktop or Cursor is a config block and a token. The longer work is modeling Casbin permissions and configuring directory syncers from Azure AD, Okta, or SCIM sources.

How do I migrate from Keycloak to Casdoor?

Casdoor provides a Keycloak syncer listed in its docs, which pulls identity data from Keycloak into Casdoor. After the sync, re-point your applications' OIDC and SAML clients at Casdoor's endpoints — the docs cover standard OIDC client and Casdoor SDK connection paths. Before committing, read Casdoor's own Casdoor vs. Keycloak comparison page, since the two systems model authorization differently: Casdoor uses Casbin policies (ACL, RBAC, ABAC) rather than Keycloak's role model, so expect to rebuild permission structures.

Is Casdoor good for auditing what LLM agents actually did?

That's the specific problem OpenClaw addresses. You point an OTLP/HTTP exporter — the docs show an openclaw.yaml with an otlphttp endpoint — at your Casdoor instance, and OpenTelemetry traces, metrics, and logs from your LLM applications arrive as structured Entries. Each tool call, agent-to-agent interaction, and LLM invocation becomes inspectable, and the UI renders span trees so you can follow a single agent run. Because the audit data lands in Casdoor itself, you don't need a separate observability vendor to correlate agent activity with identity.

Does Casdoor support SAML, LDAP, and SCIM?

Yes, all three, and the docs list them explicitly alongside OAuth 2.0, OIDC, CAS, RADIUS, WebAuthn, TOTP, MFA, and Kerberos/SPNEGO. Casdoor can act as a CAS server and as an OIDC or SAML identity provider, and it ships LDAP configuration and sync plus an LDAP server mode. For directory provisioning, SCIM 2.0 appears as both a syncer and an integration path, alongside dedicated syncers for Azure AD, Active Directory, Google Workspace, Okta, Keycloak, AWS IAM, WeCom, DingTalk, and Lark.

Is Casdoor still active in 2026?

Yes — Casdoor is active in 2026, with a liveness score of 75/100 (healthy) as of October 4, 2026. It most recently shipped an update on October 7, 2026: “Running Casdoor on Kubernetes: Official Helm Chart and Configuration as Code”.

Security & Privacy

Casdoor

Open-source IAM and SSO platform with a built-in MCP server for AI agent identity and access management.

75/100Safe BetFree · from from $29/moFreemium

If your stack has agents talking to identity data, the MCP server plus per-tool scope-based permissions and OpenClaw OTLP ingestion is the reason to look here, and it is genuinely rare in open-source IAM. If you want zero ops or a decade of community plugins, go managed or go Keycloak. Everything else (SSO, SAML, MFA, directory sync) is competent table stakes you could get elsewhere.

Verified 4d ago · liveness 75/100 · cite: rightaichoice.com/tools/casdoor

Best for

Platform teams whose internal or customer-facing agents need scoped, auditable access to identity data
SaaS builders who want authentication and subscription billing in one self-hosted console
Security teams that need a runtime record of what LLM agents actually did
Enterprises standardizing SSO across 100+ social and enterprise identity providers

Not ideal for

Teams that want fully managed IAM with no servers or database to operate
Products with no AI agents or MCP clients in the stack, where the agent layer adds nothing
Buyers who need complex auth workflows configured entirely through a no-code visual builder

Visit Website

IntermediateFor an engineer comfortable with Docker or Helm: a running Casdoor instance on MySQL or PostgreSQL is a short afternoon, and pointing an existing app at it via the standard OIDC client or Casdoor SDK is a few more hours. Adding the MCP server for Claude Desktop or Cursor is a config block and a token. Wiring OpenClaw's OTLP exporter is similarly quick, but building out Casbin permission policiesWeb · APIAPI availableVerified 4d ago

Pricing

Free · from from $29/mo

FreemiumFree tier2 plans4 hidden costs

Learning curve

Intermediate

For an engineer comfortable with Docker or Helm: a running Casdoor instance on MySQL or PostgreSQL is a short afternoon, and pointing an existing app at it via the standard OIDC client or Casdoor SDK is a few more hours. Adding the MCP server for Claude Desktop or Cursor is a config block and a token. Wiring OpenClaw's OTLP exporter is similarly quick, but building out Casbin permission policies

Runs on

WebAPI

API available · 15 integrations

Who it's for

Platform engineer running internal AI agentsSecurity lead who needs an agent audit trailSaaS builder shipping a subscription product

Live sentiment

Is Casdoor actually worth it?

We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.

Honest verdict, not marketing
Real pros & cons from real users
Attributed quotes with receipts

Run a free scan

3 free scans · no card needed

Skip it if

Skip Casdoor if your team has no appetite for operating identity servers and databases, or if nothing in your stack speaks MCP or emits LLM telemetry — in either case the agent-governance layer you'd be paying attention to goes unused.

The 30-second take

Biggest gripe

Self-hosting means you own the database, backups, upgrade windows, and on-call rotation for the identity service — budget engineering time, not just a subscription line.

Price reality

Casdoor is free and open source — the cost is the infrastructure and engineering time to run it. Compared with managed IAM (Okta, Auth0), that trade favors teams who already operate their own database and Kubernetes and who want to keep identity data in-house and avoid per-agent or per-MAU licensing. Compared with other open source (Keycloak, Authentik, Logto), Casdoor competes on the native MCP server, per-tool agent scoping, OpenClaw OTLP ingestion, and the bundled SaaS billing module rather

In short

Casdoor — Open-source IAM and SSO platform with a built-in MCP server for AI agent identity and access management. Best for Platform teams whose internal or customer-facing agents need scoped, auditable access to identity data, SaaS builders who want authentication and subscription billing in one self-hosted console, Security teams that need a runtime record of what LLM agents actually did. Free to start; paid plans from $29/mo.

Compared withvs Audioeye vs Temporal Ai vs Push Security

What's new in Casdoor

Checked 4 days ago

Across the latest 2 updates: 1 feature update and 1 news mention.

FeatureBlog·11 days agoNewest

Running Casdoor on Kubernetes: Official Helm Chart and Configuration as Code

Casdoor ships an official Helm chart in manifests/casdoor, published to GHCR per release and listed on Artifact Hub. From v4.18.0 the chart supports declarative orgs, apps, users and providers applied via helm upgrade without restarts.

NewsBlog·Feb 22

Casdoor Joins CNCF Cloud Native Landscape

Casdoor listed in the CNCF Cloud Native Landscape under Security & Compliance in Provisioning.

What people actually say about Casdoor — is it worth it?

We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.

23 mentions across 4 sources (Hacker News, YouTube, GitHub, Lemmy) · researched Aug 12, 2026.

50% positive50% critical

Average across the 4 sources that answered — each source counts once, not each post.

Recurring strengths

+Built-in MCP server enables AI agents to manage identity via natural language, a unique feature.
+Fine-grained, scope-based authorization per tool call for AI agents.
+Agent-to-agent authentication with OAuth 2.1 and Dynamic Client Registration.
+Supports 100+ identity providers and protocols like OAuth, OIDC, SAML, LDAP.
+Includes OpenClaw observability for LLM applications, providing audit trails.

Recurring frustrations

−Community data shows limited real-world feedback; most discussions are about competitors.
−A security advisory lists multiple authentication bypass vulnerabilities, a major concern.
−Competes with more established tools like Keycloak and Authentik that have larger communities.
−The agent-first focus may be overkill for traditional IAM use cases.
−Learning curve is intermediate; users may need to understand MCP and OAuth 2.1 nuances.

Patterns worth knowing

Security vulnerabilities raise concerns about reliability

Seen on Lemmy

Comparison to established IAM tools (Keycloak, Authentik, Authelia) dominates discussions

Seen on YouTube, Hacker News

Agent-first IAM concept is intriguing but under-validated

Seen on GitHub, Hacker News

Learning curve

intermediateProductive in ~A few hours

Hidden costs people mention

• Self-hosting requires infrastructure and maintenance time.
• Cloud pricing is not clearly documented, may be costly at scale.
• No enterprise support tier mentioned in community data.

Viability Score

75/100

Safe Bet

How well maintained and how widely used is Casdoor? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this

Recent activity

Traction

100

Site health

User sentiment

What the vendor publishes

Last calculated: October 2026

How we score →

Key Features

Built-in MCP server over Streamable HTTP for natural-language management of users, apps, and permissions
Per-tool, scope-based authorization on every MCP tool call
OAuth 2.1 with Dynamic Client Registration for AI agent authentication
Secure agent-to-agent authentication
OpenClaw agent ingests OpenTelemetry traces, metrics, and logs over OTLP
Runtime audit trail of agent activity as structured Entries with span trees
Single sign-on and single sign-out with RP-initiated logout
OAuth 2.0, OIDC, SAML, CAS, LDAP, WebAuthn, and MFA support
Authorization via Casbin: ACL, RBAC, ABAC, and RESTful access control
100+ identity providers including GitHub, Google, QQ, and WeChat
Directory syncers for Azure AD, Active Directory, Google Workspace, Keycloak, Okta, AWS IAM, WeCom, DingTalk, Lark
Direct user registration with email verification codes and password recovery by email or SMS
SaaS billing: products, product store, shopping cart, plans, pricing tiers, payment providers, orders, subscriptions,
Golang frontend-backend separation with horizontal scalability
SDK for identity authentication, user management, and resource uploads

About Casdoor

FreemiumIntermediateAPI availableWeb · API

Casdoor is an open-source identity and access management (IAM) and single sign-on (SSO) platform built for engineer-led teams that want to run identity themselves. The identity core covers OAuth 2.0, OIDC, SAML, CAS, LDAP, WebAuthn, and MFA, and it federates with 100+ social and enterprise providers including GitHub, Google, WeChat, QQ, Azure AD, Keycloak, Okta, and AWS IAM. Authorization runs on Casbin, so ACL, RBAC, ABAC, and RESTful policies are all modelable, and directory syncers pull users from Active Directory, Google Workspace, WeCom, DingTalk, and Lark. A SaaS management module lives in the same console: products, plans, pricing tiers, payment providers, orders, subscriptions, transactions, and coupons. What sets Casdoor apart from older open-source IAM projects is the AI agent layer. A built-in MCP server over Streamable HTTP lets agents manage users, applications, and permissions in natural language from Claude Desktop, Cursor, Windsurf, VS Code with GitHub Copilot, or any MCP client. Every MCP tool call is authenticated and authorized against fine-grained, scope-based permissions, and OAuth 2.1 with Dynamic Client Registration handles agent-to-agent authentication. OpenClaw collects OpenTelemetry traces, metrics, and logs from your LLM apps over OTLP and pushes them into Casdoor, where each tool call, agent-to-agent interaction, and LLM invocation lands as a structured Entry you can inspect as a span tree. Architecturally it is a Golang backend with a separated frontend, horizontal scaling for high concurrency, localization in 10+ languages, and storage in MySQL, PostgreSQL, or SQL Server. An SDK covers identity authentication, user management, and resource uploads, with integrations for Go, Java, JavaScript, Python, PHP, C#, C++, Ruby, Lua, and Haskell. Casdoor sits in the CNCF Cloud Native Landscape under Security & Compliance. Position it against Keycloak or Authentik if you need a mature community, and against Okta or Auth0 if you want zero ops.

Behind the Verdict

The honest framing: most of Casdoor is a competent open-source IAM that competes with Keycloak, Authentik, and Logto on roughly the same feature list. The reason to pick it specifically is the agent layer. In practice, that means an MCP server over Streamable HTTP, OAuth 2.1 with Dynamic Client Registration for agent-to-agent auth, and scope-based permissions enforced on every tool call. We would reach for this when the question you cannot answer today is 'what did our agents actually do.' OpenClaw pushing OTLP traces, metrics, and logs into Casdoor and rendering each tool call and LLM invocation as a span tree in Entries is a concrete answer to that. When to pick it: platform or security teams running their own infrastructure, SaaS builders who want authentication and subscription billing in one console instead of stitching Stripe to a separate IdP, and orgs with China-facing products that need WeCom, DingTalk, QQ, and Lark identity support next to Western providers. The CNCF Landscape listing under Security & Compliance (added early 2026) helps internal review conversations. When to pass: if you have no AI agents or MCP clients in the stack, the headline feature is dead weight and you are choosing Casdoor purely as an IAM, where the more mature alternatives are easier calls. If you cannot operate servers and a database, this is the wrong shape of product. If you need complex auth workflows built entirely in a no-code visual editor, look elsewhere. Caveats we would flag before you commit. Self-hosting means you own upgrades, backups, and the database. The MCP and OpenClaw surface is new and moving, so budget time to read the current docs rather than trusting a six-month-old tutorial. Casdoor Cloud exists if you want someone else to run it, priced from $29/month

Researching Casdoor? Get your full AI stack in 60 seconds.

Free, no signup — tell us your goal and get tools matched to your budget & existing stack.

Real-world workflow fit

Concrete scenarios for the personas Casdoor actually fits — and what changes day-one when you adopt it.

Platform engineer running internal AI agents

You deploy Casdoor with Docker or Helm, set it up as your OIDC provider, then add the /api/mcp endpoint to your team's Claude Desktop and Cursor configs with a bearer token. Scope-based permissions decide which MCP tools each agent can call.

Outcome: Agents can create users, adjust applications, and read permissions in natural language, while every call is authorized against a per-tool policy instead of a shared admin key.

Security lead who needs an agent audit trail

You point an openclaw.yaml OTLP/HTTP exporter at your Casdoor instance so traces, metrics, and logs from your LLM applications flow in as structured Entries.

Outcome: Every tool call, agent-to-agent interaction, and LLM invocation shows up as a span tree in the Casdoor UI, giving you one place to answer what an agent did at runtime.

SaaS builder shipping a subscription product

You configure Casdoor's SaaS module — products, product store, shopping cart, plans, pricing tiers, payment providers, orders, subscriptions, and coupons — next to the same console where users sign in.

Outcome: Authentication and billing live in one self-hosted system, so you don't wire a separate subscription vendor into your identity provider.

Use Cases

Deploy Casdoor as your central IAM for web applications with SSO, MFA, and 100+ identity providers.
Connect Claude Desktop or Cursor to Casdoor's MCP endpoint to manage users, applications, and permissions in natural language.
Point OpenClaw's OTLP exporter at Casdoor so every LLM tool call and agent-to-agent interaction lands as an auditable Entry.
Set up SaaS billing with Casdoor's product store, plans, pricing tiers, payment providers, and subscriptions.
Sync users from Azure AD, Active Directory, Google Workspace, Okta, Keycloak, or SCIM 2.0 sources into Casdoor.
Replace a Casbin-based authorization layer with Casdoor's ACL/RBAC/ABAC permission model in the same console.
Run Casdoor as an OIDC or SAML identity provider for a Vue, Next.js, or Nuxt application using the official SDKs.
Enable WebAuthn, TOTP, and MFA sign-in across multiple applications from one login page.

Limitations

Casdoor is open-source and self-hosted, so you deploy it yourself (Docker, Helm, and Kubernetes paths are documented), run your own database, and handle upgrades and schema migration.
The AI-agent capabilities — the built-in MCP server, OAuth 2.1 with Dynamic Client Registration, and per-tool scope-based permissions — are recent additions layered onto a mature IAM codebase, so validate them against your own agent traffic.
The scraped documentation describes authentication, MCP, OpenClaw ingestion, and SaaS billing in detail but does not publish operational limits, throughput ceilings, or scaling specifics beyond "high concurrency" and "horizontal scalability."

as of 2026-10-04

Verification history

We have re-verified Casdoor 10 times since Jul 3, 2026. Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.

Oct 13, 2026 — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Sep 24, 2026 — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Sep 1, 2026 — re-checked, vendor evidence unchanged
Aug 27, 2026 — re-checked, vendor evidence unchanged
Aug 18, 2026 — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Aug 12, 2026 — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it

Showing the 6 most recent of 10 verification passes.

Free to cite with attribution — this page re-verifies continuously.

12-month cost

Project the real annual outlay, including the implied monthly cost when only an annual tier is published.

Plan

Annual total

Free

Over 12 months

Effective monthly

—

Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.

Hidden costs & gotchas

What the public pricing page doesn't put in bold. Captured from pricing-page footnotes, contract terms, and recurring complaints.

Self-hosting means you own the database, backups, upgrade windows, and on-call rotation for the identity service — budget engineering time, not just a subscription line.
Running the OpenClaw/OTLP pipeline stores traces, metrics, and logs as Entries in your own database, so LLM observability data volume grows your storage bill directly.
Directory syncers that pull from Azure AD, Active Directory, Google Workspace, Okta, or SCIM sources need a service account and API quota on the source system, which is often a separate paid add-on there.
Payment providers inside the SaaS module carry their own per-transaction processing fees, which sit on top of whatever you pay to run Casdoor.

Where the pricing makes sense

The company stage and team size where Casdoor's pricing actually pencils out — and where peers do it cheaper.

Setup time & first value

How long it actually takes to get something useful out of Casdoor — broken out by persona, not the marketing-page minute.

Switching to or from Casdoor

How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.

Migrating in

→From Keycloak: use Casdoor's Keycloak syncer to pull users across, then check the published Casdoor vs. Keycloak comparison before cutting over.
→From Okta: the Okta syncer imports directory data; re-point OIDC and SAML clients at Casdoor's application endpoints.
→From Auth0: the Casdoor SDK and standard OIDC client replace Auth0's login flow; see the Casdoor vs. Auth0 comparison doc for the differences.
→From Azure AD or Active Directory: the dedicated Azure AD and Active Directory syncers bring users and groups into Casdoor.
→From an existing database-backed user table: Casdoor's database syncer moves users over and the docs cover the transition path.

Migrating out

↗To Keycloak: export users and clients through Casdoor's public API and rebuild Casbin permission models as Keycloak roles.
↗To Auth0 or Okta: move users via their bulk-import tooling, then recreate OIDC and SAML applications on the managed side.
↗To Authentik or Logto: reconfigure OIDC clients against the new provider and re-implement permissions outside Casbin.
↗To a SCIM-consuming directory: expose Casdoor data as SCIM 2.0 payloads to feed the destination system.

Integrations

Claude DesktopCursor WindsurfVS Code with GitHub CopilotOpenClawGoogle WorkspaceAzure ADActive DirectoryKeycloakOktaAWS IAMWeComDingTalkLarkDiscord

Resources & Guides

Tutorials & Learning

YouTube returned 6 videos for “Casdoor”, and we withheld 6: 6 could not be judged, because “Casdoor” is a single word that other videos use for other things. We are showing none, because we could not prove any of them are about Casdoor.

Official links

Official Website

Featured Head-to-Head Comparisons

Casdoor vs Audioeye

Choose Casdoor if you need an open-source, AI-native IAM with agent authentication and minimal cost. Choose AudioEye if your priority is web accessibility compliance with automated scanning and legal support. They serve completely different needs, so the decision hinges on your core requirement: identity/security vs. accessibility/legal risk.

Casdoor vs Temporal Ai

Choose Temporal AI if you need durable execution for AI agents and critical workflows with automatic retries and state recovery. Choose Casdoor if you need an open-source IAM platform with native MCP support for AI agent authentication and SaaS management. They solve different problems — orchestration vs identity — so pick based on your primary need.

Casdoor vs Push Security

If your immediate need is preventing browser-based attacks (AiTM, session hijacking) and controlling AI tool data leakage, Push Security is the more specialized, agentic solution. If you are an enterprise building AI-agent workflows and need an open-source IAM with native MCP support and agent authentication, Casdoor is the stronger, extensible platform. Choose based on whether your priority is browser threat defense or identity management for AI agents.

Popular in Security & Privacy

Frequently Asked Questions

Best-of guides

Best AI Tools for Compliance & GRC

Topics

Automation Agent API Open Source

Used Casdoor? Help shape our editorial sentiment research.