Casdoor Identity Platform
A self-hosted IAM and MCP gateway for centralized authentication, SSO, and identity management.
Per-dimension scores and reasoning
Evidence shows security policy (SECURITY.md) and default credential warnings, but lacks specific implementation details for least privilege, user confirmation, data flow transparency. Sensitive data handling uses argon2id etc., but not detailed. Dependency security has many dependencies but no vulnerability scanning evidence. External effects include webhooks and integrations but no permission control details. Rollback not mentioned. Source attribution clear via license and copyright, but publisher unverified. Thus most criteria scored low.
CI workflow (build.yml) runs tests and builds, indicating some consistency. Dependency availability has many dependencies but no availability guarantees. Failure messages: CI has waiting and log output, but product error handling not detailed.
README clearly defines target audience (developers, enterprises) and multiple deployment scenarios (source, Docker, Helm). Capability boundaries via feature list and docs. Trigger precision not detailed for MCP/A2A. Environment fit supports multiple databases and deployment methods.
Information architecture clear with TOC and docs links. Install notes detailed covering multiple methods. Naming stable with version releases and semantic versioning. Examples and FAQ via docs and demos. Known limitations not explicitly listed. License Apache-2.0 complete. Versioning changelog auto-generated via semantic-release. Maintenance responsibility via contribution guide and community support.
Output usability: provides API, SDKs, Swagger UI for integration. Marginal value: unique as IAM/MCP gateway. Cost-benefit: open-source free, but deployment and maintenance costs not assessed.
Claims supported by docs and demos but no specific evidence. Cross-source corroboration: multiple doc links but not independently verified. Fact-inference separation: README distinguishes features and docs links but not explicit.
- Publisher identity unverified; assess supply chain risk carefully.
- Many dependencies without vulnerability scanning evidence; check dependency security yourself.
- Default credentials (admin/123) are public in docs; must change immediately in production.
- MCP/A2A functionality specifics and permission controls not detailed in provided files; further review needed.
What does this agent do, and when should you use it?
Casdoor is a frontend-backend-separated identity and access management platform that is also presented as an AI MCP gateway and authentication server. It combines a React web UI, a Go API server built with Beego, and configurable data storage to manage users, organizations, applications, and identity providers. The project documents support for MCP, A2A, OAuth 2.0/OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, and Face ID, alongside RESTful APIs, Swagger UI, and webhooks. It can run from source or be deployed through Docker, Docker Compose, or Kubernetes Helm; the documented local service endpoint is port 8000. Authorization policies can be expressed with Casbin models including ACL, RBAC, and ABAC.
Administrators manage users, organizations, applications, and providers through the web UI, then connect applications through identity interfaces such as OAuth 2.0/OIDC, SAML, CAS, LDAP, or SCIM. Casdoor exposes RESTful APIs, offers an interactive Swagger UI, and provides webhooks for event-driven integrations. For AI-oriented deployments, it documents MCP Gateway and A2A Protocol support. In the source workflow, operators configure driverName, dataSourceName, and dbName in conf/app.conf, run yarn install and yarn build in web/, then start the server from the repository root with go run main.go; the resulting service is available at http://localhost:8000.
- An enterprise administrator consolidating users, organizations, and login providers for several internal applications can use the web UI and organization support.
- An application team integrating OAuth 2.0/OIDC or SAML single sign-on can use Casdoor as a dedicated authentication server.
- An IT team that needs SCIM 2.0 user provisioning can use it in an identity lifecycle integration.
- A team building an AI application that requires MCP Gateway or A2A Protocol support can deploy it at the application's identity boundary.
- A self-hosted service team that wants WebAuthn/passkeys, TOTP, MFA, or Face ID login options can configure those documented authentication capabilities.
What are this agent's strengths and limitations?
- It documents a broad set of identity interfaces—OAuth 2.0/OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, and MFA—for environments with mixed protocols.
- It combines a React administration console with a Go RESTful API, Swagger UI, and webhooks rather than supplying only protocol endpoints.
- Alongside conventional IAM functions, the README explicitly lists MCP Gateway and A2A Protocol support.
- It has documented source, Docker, Docker Compose, and Kubernetes Helm deployment paths.
- The source deployment requires Go 1.25, Node.js LTS 20, Yarn 1.x, and a database, increasing the number of runtime components to operate.
- The documented fresh-install credential is built-in/admin / 123, which must be changed before production use.
- The Docker all-in-one path is described as an SQLite quick trial; production database selection and configuration remain an operator responsibility.
- The writable online demo resets data about every five minutes, so it cannot preserve test data.
How do you install or deploy this agent?
Source deployment requires Go 1.25, Node.js LTS 20, Yarn 1.x, and a supported database. Run: git clone https://github.com/casdoor/casdoor.git; cd casdoor; configure driverName, dataSourceName, and dbName in conf/app.conf (create the casdoor database first for MySQL); cd web; yarn install; yarn build; cd ..; go run main.go. For a Docker trial, run: docker run -p 8000:8000 casbin/casdoor-all-in-one. On a fresh installation, open http://localhost:8000 and sign in with built-in/admin / 123; change that password immediately in production.
How do you use this agent?
After startup, open http://localhost:8000 and use built-in/admin / 123 for the first login on a fresh instance. Configure users, organizations, applications, and providers in the web UI, then select the relevant interface for each integration, such as OAuth 2.0/OIDC, SAML, CAS, LDAP, SCIM, or MCP Gateway. For public API exploration, use the Swagger UI at https://door.casdoor.com/swagger; that global demo is read-only, so write operations fail. Use https://demo.casdoor.com for writable testing, with the caveat that its data is reset about every five minutes.