Products
In short: twelve products that address AI agent identity, described from their own public material. There are no scores. Each entry says when the product fits, when it is less suited and what pricing is published. Open a product for the full list of sourced facts.
NewCore
Fits when: You need a named person to approve risky agent actions before they run. You want per-call policy on MCP tool use, with tools an agent cannot use kept hidden. You want to replace standing credentials with short-lived, task-scoped access. You run more than one identity provider and need agents linked to the right person.
Less suited when: You need a workforce sign-in product; NewCore states your identity platform keeps that job. You need a published list price before a conversation.
NewCore describes one policy engine for people and agents. Its gateway identifies the agent and the person behind it on every tool call. Your current identity platform keeps handling employee sign-in.
Pricing: No list price published. Listed on AWS Marketplace. NewCore on AWS Marketplace, read 2026-11-03
Silverfort
Fits when: You run both Okta and Entra ID and want one view of agents across them. You want step up to a human at an MCP gateway. Your agents use static API keys and you want to remove standing privilege.
Less suited when: You need a published price or a self-serve free tier.
Silverfort extends its identity security platform to AI agents. Discovery runs through read-only APIs across Entra ID, Okta, clouds and SaaS. Enforcement happens at its MCP Gateway.
Pricing: Quote-based packages. Silverfort pricing, read 2026-11-03
Aembit
Fits when: You want to start free with a few agents. You want secretless credential exchange for MCP traffic. You need SPIFFE, OAuth 2.1 and XAA support in one place.
Less suited when: You need a named-person approval step; this was not found in the material reviewed.
Aembit focuses on workload and agent access without stored secrets. It describes a Blended Identity of agent and human. It states that it does not replace the workforce identity provider.
Pricing: Free Starter tier for three agents. AI Teams costs $20 per agent per month for 10 to 500 agents. Aembit pricing, read 2026-11-03
Descope
Fits when: You build MCP servers or apps and need MCP authorization, CIMD and PKCE handled. You want a free tier to start. You need Cross App Access with ID-JAG.
Less suited when: You need the governance suite on a free plan; it is Enterprise only.
Descope's Agentic Identity Hub covers agent authentication and authorization across standards. A governance suite adds approval, documented purpose and an accountable owner, on the Enterprise plan.
Pricing: Free Forever tier includes the hub. Governance suite is Enterprise only. Descope Agentic Identity Hub 3, read 2026-11-03
Idira
Fits when: You already run CyberArk or Palo Alto Networks and want agent access in the same estate. You want a broker to obtain and rotate MCP tokens.
Less suited when: You want a free tier or a published price.
Idira brings CyberArk identity security under Palo Alto Networks. For agents, the documented piece is the Identity Broker, which handles MCP tokens on the agent's behalf.
Pricing: Sold as add-on licences. Palo Alto Networks introduces Idira, read 2026-11-03
Astrix Security
Fits when: You do not know how many agents exist or who owns them. You need to find local agents and MCP servers on laptops.
Less suited when: You need a named-person approval step before an action; not found in the material reviewed.
Astrix grew from non-human identity security. Its discovery reaches Copilot, Bedrock, Vertex, OpenAI and Agentforce, plus local agents and MCP servers on endpoints.
Pricing: Not published in the material reviewed. No source: not found in public material.
Cyera Identity
Fits when: Auditors or regulators need evidence of why each agent action was allowed. You want identities that exist only for one task.
Less suited when: You need a free tier or a published price.
Cyera completed its Oasis Security acquisition in September 2026. The agentic access management approach centres on intent and purpose for each action.
Pricing: Not published in the material reviewed. No source: not found in public material.
Token Security
Fits when: Your agents run across on-premises, hybrid and cloud environments. Ownership is the first gap.
Less suited when: You need runtime approval by a person; not found in the material reviewed.
Token Security works from the non-human identity side. Its public material centres on discovery, ownership and least privilege driven by intent.
Pricing: Not published in the material reviewed. No source: not found in public material.
SailPoint Entro
Fits when: You already use SailPoint for access reviews. You need to see what coding agents do in prompt sessions.
Less suited when: You need a gateway that enforces each tool call; not found in the material reviewed.
SailPoint closed the Entro Security acquisition in June 2026. The product adds agent and secret inventory to SailPoint's identity governance.
Pricing: Not published in the material reviewed. No source: not found in public material.
Clutch Security
Fits when: You need to know who deployed each agent. You plan a migration away from stored secrets.
Less suited when: You need per-action human approval; not found in the material reviewed.
Clutch Security approaches agents as non-human identities with a deploying person behind each one.
Pricing: Not published in the material reviewed. No source: not found in public material.
Okta for AI Agents
Fits when: Most of your people sign in through Okta. You want agents to reach SaaS apps as the user without stored tokens.
Less suited when: You need per-action human approval today; Okta lists it as coming after GA.
Okta treats agents as first-class identities in the directory you already use for staff. Agent SSO, built on Cross App Access, is included in core Okta SSO.
Pricing: Agent SSO is included in core Okta SSO. Other pricing was not found in the material reviewed. Okta Agent SSO press release, read 2026-11-03
Microsoft Entra Agent ID
Fits when: Most of your people sign in through Entra ID. Your agents live mostly in Microsoft 365 and Copilot Studio.
Less suited when: You need a named person to approve individual agent actions; not found in Entra Agent ID material.
Entra Agent ID brings agents into the same directory and policy engine Microsoft customers use for staff. Agent 365 became generally available on 1 May 2026.
Pricing: Agent 365 costs $15 per user per month. Microsoft Agent 365 generally available, read 2026-11-03