$HEADLESS SYSTEMS
03 / Scorecard / Auth & Identity

Ory

B
Headless Index
72/100
JAIRF
N/A
Verified
MAY 21, 2026
Methodology v1 · JAIRF v1.0.0

Powered by JAIRF v1.0.0 by Jentic · open methodology at /the-headless-index/methodology

Editorial verdict
Ory is solidly built for programmatic consumption. The Headless Index thesis-fit score of 72/100 lands it in the upper-middle of the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier ship most of the primitives agents need, with one or two surfaces still leaning on documentation rather than discovery, and the rest of this verdict explains where Ory lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Ory ships a portfolio of open-source identity primitives (Kratos for identity, Hydra for OAuth 2.0, Keto for authorisation, Oathkeeper for proxy) each with its own REST API and gRPC interface. SDKs are auto-generated across many languages from OpenAPI specs in the ory/ repositories. The open-source ethos is API-first by default.[1] Schema observability is the related test: can an agent introspect the contract from cold, or does it have to read prose documentation to do so? Each Ory product publishes its own OpenAPI specification in the corresponding GitHub repository. SDKs are generated from those specs. Agent introspection is reference-class for the open-source identity sub-category.[2] An agent can drive this product across most practical workflows, with a handful of edges where documentation reading still beats schema discovery. On headless operability: Each Ory product is operated entirely through its API and config files. ory-cli plus the Kubernetes operator give shell and IaC paths. Ory Network (the managed offering) wraps the same primitives under one control plane that is itself API-driven.[3] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: No first-party Ory MCP server has been published. The product is shaped around identity primitives rather than agent integration; downstream framework wrappers carry the MCP layer.[4] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Webhook support is documented for identity lifecycle events in Kratos and OAuth2 events in Hydra. Signing and replay vary slightly by product but the open-source codebase makes the wire contract verifiable. Net assessment: Ory can be operated by agents for the majority of practical workflows. The closest thing to a gap is MCP posture[5], which integrators should sanity-check against their own use case before committing. Strong fit for agent-driven use cases.
Verdict by Headless Index pipeline (auto)
// AI-drafted from the evidence layer. Editorial review pending.
Scores

Scorecard detail

Headless Index · 5 sub-criteria
API-first design intent18/20
scored

Ory ships a portfolio of open-source identity primitives (Kratos for identity, Hydra for OAuth 2.0, Keto for authorisation, Oathkeeper for proxy) each with its own REST API and gRPC interface. SDKs are auto-generated across many languages from OpenAPI specs in the ory/ repositories. The open-source ethos is API-first by default.

signals (6)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −OpenAPI specNot found across 17 probe paths
  • −GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
  • +SDKs maintained48 (dotnet, go, java, javascript, php, python, ruby, rust, typescript); top by stars: ory/fosite (2560 stars)
  • +SDK recency38 of 48 SDK repos pushed within 30 days (most recent SDK commit: 2026-05-19)
  • +npm weekly downloads1.2M across published packages; top: @ory/client @ 120.0k/week
cite (1)
  • github.sdks@2026-05-19
Headless operation18/20
scored

Each Ory product is operated entirely through its API and config files. ory-cli plus the Kubernetes operator give shell and IaC paths. Ory Network (the managed offering) wraps the same primitives under one control plane that is itself API-driven.

signals (9)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −API operations exposedNo OpenAPI spec; operations count unknown
  • ·Docs pages crawled0 pages (crawler: none)
  • ·Auth schemes documentedAuth documentation page not reached by crawler
  • ·Setup / quickstart docsNot reached by crawler
  • ·Billing docsNot reached by crawler
  • ·Teams / org docsNot reached by crawler
  • ·CLI docsNot reached by crawler
  • ·Schema / data model docsNot reached by crawler
cite (1)
  • github.sdks@2026-05-19
MCP & agent posture8/20
scored

No first-party Ory MCP server has been published. The product is shaped around identity primitives rather than agent integration; downstream framework wrappers carry the MCP layer.

signals (4)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • +Official MCP serverhttps://github.com/ory/mcp-sse (0 stars, last commit 210 days ago)
  • ·Community MCP servers2 community MCP repos; top by stars: https://github.com/ory/mcp (9 stars)
  • +Agent-friendly SDKs10 TS/JS SDKs available; top: @ory/client (120.0k/week downloads)
cite (1)
  • github.sdks@2026-05-19
Schema observability16/20
scored

Each Ory product publishes its own OpenAPI specification in the corresponding GitHub repository. SDKs are generated from those specs. Agent introspection is reference-class for the open-source identity sub-category.

signals (3)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −OpenAPINot discovered across 17 standard probe paths
  • −GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)
cite (1)
  • github.sdks@2026-05-19
Webhooks & events12/20
scored

Webhook support is documented for identity lifecycle events in Kratos and OAuth2 events in Hydra. Signing and replay vary slightly by product but the open-source codebase makes the wire contract verifiable.

signals (2)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • ·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.
cite (1)
  • github.sdks@2026-05-19
JAIRF · 6 dimensions
JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Powered by JAIRF v1.0.0 by Jentic

Band rationale:B band: JAIRF=N/A HeadlessIndex=72

04 / Embed

Show Ory's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Ory mini badge preview
Get embed code
Peers in Auth & Identity
ZITADELC
Headless Index 72/100
OktaB
Headless Index 72/100
Supabase AuthB
Headless Index 74/100
See full Auth & Identity ranking →