Is Cisco Duo agent-ready?

Cisco Duo scores Band C on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.

Does Cisco Duo publish an OpenAPI spec?

No published OpenAPI specification was found when Cisco Duo was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.

What is Cisco Duo's Headless Index score?

Cisco Duo scores 46/100 on the Headless Index thesis-fit rubric and sits in Band C in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Auth & Identity

Cisco Duo

Headless Index

46/100

JAIRF

N/A

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

Cisco Duo earns Band C in the Auth & Identity category of The Headless Index, with a thesis-fit score of 46/100. Its strongest dimension is API-first design intent (12/20); its weakest scored dimension is MCP and agent posture (6/20). No public OpenAPI specification was found when Cisco Duo was scored, which limits how far an agent can go without human integration work.

Editorial verdict

Cisco Duo is partially headless and partly UI-led. The Headless Index thesis-fit score of 46/100 puts it mid-table on the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier are partly machine-consumable: the core flows are reachable through code but several adjacent surfaces still expect a human at a dashboard, and the rest of this verdict explains where Cisco Duo lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Duo's Admin API is real and long-lived, spanning three generations of paths under one host (/admin/v1, /admin/v2 and /admin/v3), with client libraries in duosecurity/duo_client_python, duo_api_golang, duo_php and duo_nodejs. But the API sits beneath the Admin Panel rather than defining the product, and the bespoke request signing raises the cost of every first call. An agent can drive parts of this product, but not all of it: integrators should plan for human-in-the-loop checkpoints where the headless surface stops short. On headless operability: Users, phones, tokens, groups and integrations are all manageable over the Admin API, so provisioning scripts work. Everything above that stays in the console: policies, SSO configuration and application settings have no declarative path, and HashiCorp's registry offers only a community provider with 307 downloads (emanuelbesliu/duo). No official CLI ships either.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: Nothing exists. The duosecurity org holds forty-odd integration repositories and not one mentions MCP, the public registry has no Duo entry, and duo.com/docs has no agent page. Cisco has shipped agent tooling elsewhere, which makes the silence around a product that gates every login (duo.com/docs/adminapi) look like a deliberate deferral rather than an accident.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Duo pushes nothing. Observability is pull-only through the log endpoints (/admin/v2/logs/activity, /logs/authentication and /logs/telephony), paginated with mintime and an offset cursor, which an agent must poll on a timer. Request signing uses HMAC-SHA1 for the Admin API and HMAC-SHA512 for Auth, so there is no inbound signature to verify at all. Net assessment: integrators can build agent flows against Cisco Duo, but the rough edge to plan around is MCP posture^[3]. Expect to wrap missing pieces in bespoke glue or accept human-in-the-loop checkpoints. Workable but requires scaffolding.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent12/20

scored

Duo's Admin API is real and long-lived, spanning three generations of paths under one host (/admin/v1, /admin/v2 and /admin/v3), with client libraries in duosecurity/duo_client_python, duo_api_golang, duo_php and duo_nodejs. But the API sits beneath the Admin Panel rather than defining the product, and the bespoke request signing raises the cost of every first call.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPI specNot found across 17 probe paths
·GraphQL endpointDiscovered at https://duo.com/graphql, introspection disabled or scoped
−SDKs maintainedNone detected in vendor org

cite (1)

github.sdks@2026-08-19

Headless operation10/20

scored

Users, phones, tokens, groups and integrations are all manageable over the Admin API, so provisioning scripts work. Everything above that stays in the console: policies, SSO configuration and application settings have no declarative path, and HashiCorp's registry offers only a community provider with 307 downloads (emanuelbesliu/duo). No official CLI ships either.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
−API operations exposedNo OpenAPI spec; operations count unknown
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

ai_review_browser.topics_found@2026-08-19

MCP & agent posture6/20

scored

Nothing exists. The duosecurity org holds forty-odd integration repositories and not one mentions MCP, the public registry has no Duo entry, and duo.com/docs has no agent page. Cisco has shipped agent tooling elsewhere, which makes the silence around a product that gates every login (duo.com/docs/adminapi) look like a deliberate deferral rather than an accident.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
−Official MCP serverNone found in vendor's GitHub org or the official MCP registry
−Community MCP serversNone found
−Agent-friendly SDKsNo TypeScript/JavaScript SDK published (agents commonly run in TS/JS)

cite (1)

ai_review_browser.mcp@2026-08-19

Schema observability8/20

scored

No spec is published anywhere. Duo documents endpoints as HTML tables on a single very large page (duo.com/docs/adminapi, over 1MB of markup), and the org has no spec repository. An agent building a client has to parse prose, then reimplement a canonical-request signature scheme by hand before the first successful request.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPINot discovered across 17 standard probe paths
·GraphQL introspectionGraphQL endpoint at https://duo.com/graphql but introspection is disabled, scoped, or behind authentication

cite (1)

ai_review_browser.schema@2026-08-19

Webhooks & events10/20

scored

Duo pushes nothing. Observability is pull-only through the log endpoints (/admin/v2/logs/activity, /logs/authentication and /logs/telephony), paginated with mintime and an offset cursor, which an agent must poll on a timer. Request signing uses HMAC-SHA1 for the Admin API and HMAC-SHA512 for Auth, so there is no inbound signature to verify at all.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

github.sdks@2026-08-19

JAIRF · 6 dimensions

JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Band rationale:C band: scores 40-75 range

04 / Embed

Show Cisco Duo's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Peers in Auth & Identity

Auth0C

Headless Index 48/100

Firebase AuthenticationC

Headless Index 49/100

AuthZedC

Headless Index 43/100

See full Auth & Identity ranking →

FAQ

Cisco Duo and agent readiness

Is Cisco Duo agent-ready?: Cisco Duo scores Band C on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.
Does Cisco Duo publish an OpenAPI spec?: No published OpenAPI specification was found when Cisco Duo was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.
What is Cisco Duo's Headless Index score?: Cisco Duo scores 46/100 on the Headless Index thesis-fit rubric and sits in Band C in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.