Aembit MCP Identity GatewayAembit | Datasheet DS-002 | Rev 2026-11-03 |
| Total 7.40 / 10 | Ranks second of 14 | |
| Status: Generally available since 9 April 2026. | ||
In short: Aembit scores 7.40 out of 10 and ranks second of 14 in this guide. Its strongest areas are credential brokering and standards, and its weakest is human approval. Deployment is listed as Self-hosted VM. A free tier is available; AI Teams costs $20 per agent per month. Each score below has a reason and a dated source.
Features
- MCP Identity Gateway on a Linux VM in the customer environment
- Token validation and policy on every MCP request
- Credential exchange on the agent's behalf
- Managed MCP Authorization Server
- MCP tool filtering
- AI kill switch
- Blended Identity: agent and human evaluated together
- Access event logging with SIEM export
Specifications
| Parameter | Value | Source |
|---|---|---|
| Product type | MCP Identity Gateway | [ae-home] |
| Deployment | Linux VM in the customer environment | [ae-home] |
| Credential model | Exchanged on the agent's behalf | [ae-home] |
| Standards named | OAuth 2.1, OIDC, SAML, SPIFFE, XAA/ID-JAG, A2A, MCP | [ae-home] |
| Audit | Every access event; SIEM export | [ae-home] |
| GA date | 2026-04-09 | [ae-ga] |
| Free tier | Starter: 3 agents, 1 gateway, 5 MCP authorization policies | [ae-pricing] |
| Paid tier | AI Teams: $20 per agent per month, 10 to 500 agents | [ae-pricing] |
| Enterprise | Contact sales | [ae-pricing] |
How does Aembit score on each criterion?
| Criterion | Weight | Score | Reason | Source |
|---|---|---|---|---|
| G1 Identity-bound per-call authorization | 25 | 8 | The gateway validates tokens and enforces policy on every MCP request, and Blended Identity evaluates agent and human together. | [ae-home][ae-ga] |
| G2 Credential brokering | 20 | 10 | It exchanges credentials on the agent's behalf so the agent never holds direct credentials. | [ae-home] |
| G3 Human approval and escalation | 15 | 2 | No human approval step was found on the pages read. | [ae-home][ae-ga] |
| G4 Server registry and discovery | 10 | 4 | MCP tool filtering is documented; automatic discovery of unregistered servers was not found. | [ae-home] |
| G5 Audit evidence | 10 | 8 | Every access event is logged, with SIEM export. | [ae-home] |
| G6 Standards | 10 | 10 | Names OAuth 2.1 per the MCP spec, OIDC, SAML, SPIFFE and XAA/ID-JAG. | [ae-home][ae-ga] |
| G7 Deployment and buying clarity | 10 | 9 | Customer-hosted gateway VM, a free Starter tier and a published $20 per agent per month plan. | [ae-pricing] |
| Total | 100 | 7.40 | Sum of score times weight, divided by 100. | |
Typical deployment
Customer-hosted gateway VM with a managed MCP Authorization Server.
Pricing as published
Free Starter tier; AI Teams at $20 per agent per month for 10 to 500 agents; Enterprise by contact.
Works alongside your identity provider?
Yes. Aembit names OIDC, SAML and XAA/ID-JAG, so it federates with an existing identity provider. [ae-home]
Frequently asked questions
- Does Aembit work alongside my identity provider?
- Yes. Aembit names OIDC, SAML and XAA/ID-JAG, so it federates with an existing identity provider.
- How is Aembit deployed?
- Customer-hosted gateway VM with a managed MCP Authorization Server.
- What does Aembit cost?
- Free Starter tier; AI Teams at $20 per agent per month for 10 to 500 agents; Enterprise by contact.
How does it compare?
Revision history
| Rev | Change |
|---|---|
| 2026-11-03 | First issue of this datasheet. |
Sources
- Aembit home [ae-home] read 2026-11-03
- Aembit IAM for agentic AI GA [ae-ga] read 2026-11-03
- Aembit pricing [ae-pricing] read 2026-11-03
By The Datasheet desk · Published and reviewed 2026-11-03