Idira AI agent Identity BrokerPalo Alto Networks (CyberArk) | Datasheet DS-004 | Rev 2026-11-03 |
| Total 6.40 / 10 | Ranks fourth of 14 | |
| Status: Launched 12 May 2026 by Palo Alto Networks. | ||
In short: Idira scores 6.40 out of 10 and ranks fourth of 14 in this guide. Its strongest area is credential brokering, and its weakest is human approval. Deployment is listed as Platform add-on. An add-on licence is required, with no public price. Each score below has a reason and a dated source.
Features
- Proxy and enforcement point between agent and tools
- Unique Identity Broker URL per registered MCP server
- Underlying MCP server URL hidden from the agent
- Token creation, rotation and renewal for agents
- Agent and user identity captured for every tool call in full mode
Specifications
| Parameter | Value | Source |
|---|---|---|
| Product type | AI agent Identity Broker (proxy) | [id-docs] |
| Vendor | Palo Alto Networks; CyberArk acquisition closed 2026-02-11 | [panw-close] |
| Launch | 2026-05-12 | [id-launch] |
| Credential model | Broker obtains and rotates MCP server tokens | [id-docs] |
| Standards named | MCP, OAuth 2.1, DCR | [id-docs] |
| Price as published | Add-on licence; no public price | [id-launch] |
How does Idira score on each criterion?
| Criterion | Weight | Score | Reason | Source |
|---|---|---|---|---|
| G1 Identity-bound per-call authorization | 25 | 8 | The Identity Broker is a proxy and the enforcement point between agent and tools, capturing agent and user identity per call in full mode. | [id-docs] |
| G2 Credential brokering | 20 | 9 | It obtains MCP server access tokens on the agent's behalf and manages rotation, and the server URL is not exposed to the agent. | [id-docs] |
| G3 Human approval and escalation | 15 | 2 | No human approval step was found on the pages read. | [id-docs] |
| G4 Server registry and discovery | 10 | 6 | Each registered MCP server gets its own broker URL, but registration is required and discovery was not found. | [id-docs] |
| G5 Audit evidence | 10 | 7 | Full audit visibility is described in managed mode. | [id-docs] |
| G6 Standards | 10 | 6 | Names MCP, OAuth 2.1 and DCR, which the 2026-07-28 spec deprecates in favour of CIMD. | [id-docs][mcp-0728] |
| G7 Deployment and buying clarity | 10 | 4 | Sold as an add-on licence with no public price. | [id-launch] |
| Total | 100 | 6.40 | Sum of score times weight, divided by 100. | |
Typical deployment
Broker proxy delivered with the Idira identity platform.
Pricing as published
Add-on licence; no public price.
Works alongside your identity provider?
Not stated on the pages read. The broker captures user identity per call, but federation with a third-party identity provider was not confirmed. [id-docs]
Frequently asked questions
- Does Idira work alongside my identity provider?
- Not stated on the pages read. The broker captures user identity per call, but federation with a third-party identity provider was not confirmed.
- How is Idira deployed?
- Broker proxy delivered with the Idira identity platform.
- What does Idira cost?
- Add-on licence; no public price.
How does it compare?
Revision history
| Rev | Change |
|---|---|
| 2026-11-03 | First issue of this datasheet. |
Sources
- CyberArk Secure AI architecture [id-docs] read 2026-11-03
- MCP blog: 2026-07-28 release [mcp-0728] read 2026-11-03
- Palo Alto Networks introduces Idira [id-launch] read 2026-11-03
- Palo Alto Networks completes CyberArk acquisition [panw-close] read 2026-11-03
By The Datasheet desk · Published and reviewed 2026-11-03