Secure authentication for humans and AI agents. Biscuit-based credential delegation, Token Vault, fine-grained authorization — self-hosted, open protocol.
// Protect any MCP tool in 3 lines
import { BulwarkMCP } from "@bulwark/mcp-auth";
const bulwark = new BulwarkMCP();
server.tool("query", bulwark.protect(handler));Built ground-up for agentic workloads, with human auth as a natural extension.
AI agents as first-class principals with trust levels, capabilities, and scoped credentials.
Cryptographic delegation chains. Agents create narrower tokens for sub-agents — no server call needed.
Managed OAuth tokens for 30+ APIs. Automatic refresh. Agents never see the raw credentials.
CIBA async authorization. Agents request approval, humans decide — with full audit trail.
Document-level access control for RAG. Only retrieve what the user is allowed to see.
You own the entire trust chain. No vendor lock-in. No per-MAU pricing surprises.
Start a scoped session for any agent task. Access APIs through the credential proxy — Bulwark handles token refresh, audit logging, and rate limits automatically.
Need to hand off to a sub-agent? Delegate a narrower token with fewer permissions and a shorter TTL — cryptographically enforced, no server round-trip required.
1 // Create a scoped session for an agent task
2 const session = await bulwark.startSession({
3 task: "Analyze Q1 sales data",
4 ttl: "15m",
5 maxUses: 100,
6 });
7 // Access APIs through the credential proxy
8 const data = await session.fetch("sales_db", {
9 path: "/",
10 operations: ["read"],
11 });
12 // Delegate narrower access to a sub-agent
13 const subToken = session.delegate({
14 permissions: ["read"],
15 services: ["sales_db"],
16 ttl: "5m",
17 maxUses: 10,
18 });The only identity platform designed for AI agents from day one.
| Feature | Bulwark | Auth0 | Clerk | Keycloak |
|---|---|---|---|---|
| Agent Identity | ||||
| Delegation Chains | ||||
| Offline Verification | ||||
| Self-Hosted | ||||
| Open Protocol | ||||
| Token Vault | ||||
| Per-MAU Pricing |
Self-hosted. Open protocol. No per-MAU pricing. Deploy in minutes.