Is Scalekit agent-ready?

Scalekit scores Band A on The Headless Index and rates AI-Ready on JAIRF (89.4/100). Its strongest area for agent use is MCP and agent posture; its weakest is headless operation.

Does Scalekit publish an OpenAPI spec?

Yes. Scalekit publishes an OpenAPI specification, scored under JAIRF v1.0.0. A published spec is what makes an API discoverable and callable by agents rather than only by developers reading docs.

What is Scalekit's Headless Index score?

Scalekit scores 88/100 on the Headless Index thesis-fit rubric and sits in Band A in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Auth & Identity

Scalekit

Headless Index

88/100

JAIRF

89.4/100

AI-Ready

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

Scalekit earns Band A in the Auth & Identity category of The Headless Index, with a thesis-fit score of 88/100 and a JAIRF rating of 89.4/100 (AI-Ready). Its strongest dimension is MCP and agent posture (20/20); its weakest scored dimension is headless operation (14/20). Scalekit publishes a machine-readable OpenAPI specification, which is what lets an agent discover and operate it without human glue code.

Editorial verdict

Scalekit is reference-class for machine consumption. The Headless Index thesis-fit score of 88/100 places it in the top tier of the index, and JAIRF v1.0.0 puts it at 89.4/100 (Level 3, AI-Ready). In practice, vendors at this tier publish enough machine-readable surface that agents can discover, authenticate, operate, and react to events without bespoke scaffolding, and the rest of this verdict explains where Scalekit lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Three separate OpenAPI documents are served for one product, split by surface (scalekit.scalar.json, saaskit.scalar.json and agentkit.scalar.json), and the SDK matrix runs Node, Python, Go, Java, .NET, Swift plus React, Vue and Expo wrappers. @scalekit-sdk/node clears 3,800 weekly npm downloads, and every SDK repo carries agent-auth and tool-calling topics, which matches what the endpoints actually do. An agent can drive this product end to end, and the published evidence supports that without unusual scaffolding. On headless operability: Organizations, directories, connections, sessions, roles and users are all API-addressable, and the SDKs mirror the endpoints closely. Infrastructure tooling is the hole: HashiCorp's registry has no Scalekit provider at all, and the quickstarts still route SSO connection setup through the dashboard (docs.scalekit.com/agentkit/connections). No CLI ships either, so bootstrapping a tenant is imperative code.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: Nobody in auth is further ahead. There is a first-party server (github.com/scalekit-inc/scalekit-mcp-server), an OAuth 2.1 and dynamic client registration story for securing other people's MCP servers, and a docs site built for machines: llms.txt routes agents to per-topic bundles and framework pages for LangChain, Anthropic, OpenAI Agents, Google ADK and Mastra.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. The envelope is well shaped: spec_version, environment_id, occurred_at, organization_id, type and data, with types like organization.directory.user_created. Verification helpers ship in every SDK (scalekit.webhooks.verifySignature and its Python, Go and Java equivalents), and delivery retries use exponential backoff. What is missing is a single page enumerating every event type a subscriber can receive, and a named signing algorithm. Net assessment: Scalekit is among the cleanest agent-targets in its category. The lightest of the criteria in this run is headless operability^[3], and even there the surface area is workable for automated integration. Treat this scorecard as a green light for unattended use. Strong fit for agent-driven use cases.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent18/20

scored

Three separate OpenAPI documents are served for one product, split by surface (scalekit.scalar.json, saaskit.scalar.json and agentkit.scalar.json), and the SDK matrix runs Node, Python, Go, Java, .NET, Swift plus React, Vue and Expo wrappers. @scalekit-sdk/node clears 3,800 weekly npm downloads, and every SDK repo carries agent-auth and tool-calling topics, which matches what the endpoints actually do.

signals (6)

+AI review appliedReviewer: Editorial review on 2026-08-19
+OpenAPI specPublished, 108 operations
·GraphQL endpointDiscovered at https://www.scalekit.com/graphql, introspection disabled or scoped
+SDKs maintained10 (dotnet, go, java, javascript, python, swift, typescript); top by stars: scalekit-inc/scalekit-sdk-python (15 stars)
+SDK recency4 of 10 SDK repos pushed within 30 days (most recent SDK commit: 2026-08-19)
·npm weekly downloads3.9k across published packages; top: @scalekit-sdk/node @ 3.9k/week

cite (1)

github.sdks@2026-08-19

Headless operation14/20

scored

Organizations, directories, connections, sessions, roles and users are all API-addressable, and the SDKs mirror the endpoints closely. Infrastructure tooling is the hole: HashiCorp's registry has no Scalekit provider at all, and the quickstarts still route SSO connection setup through the dashboard (docs.scalekit.com/agentkit/connections). No CLI ships either, so bootstrapping a tenant is imperative code.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
+API operations exposed108 operations in OpenAPI spec
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

ai_review_browser.topics_found@2026-08-19

MCP & agent posture20/20

scored

Nobody in auth is further ahead. There is a first-party server (github.com/scalekit-inc/scalekit-mcp-server), an OAuth 2.1 and dynamic client registration story for securing other people's MCP servers, and a docs site built for machines: llms.txt routes agents to per-topic bundles and framework pages for LangChain, Anthropic, OpenAI Agents, Google ADK and Mastra.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
+Official MCP serverhttps://github.com/scalekit-inc/scalekit-sdk-node (8 stars, last commit 1 days ago)
·Community MCP servers18 community MCP repos; top by stars: https://github.com/scalekit-inc/scalekit-sdk-go (2 stars)
+Agent-friendly SDKs4 TS/JS SDKs available; top: @scalekit-sdk/node (3.9k/week downloads)

cite (1)

ai_review_browser.mcp@2026-08-19

Schema observability20/20

scored

An agent needs one fetch and gets a machine-readable contract three ways: the scalar JSON specs, a Markdown rendering of every endpoint (docs.scalekit.com/apis.md), and topic bundles under /_llms-txt for narrower context. Cold client generation works without reading a single prose page. This is what schema publishing looks like when agents are the intended reader.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
+OpenAPIPublished at https://docs.scalekit.com/openapi.json (OpenAPI 3.1.1, 108 operations)
·GraphQL introspectionGraphQL endpoint at https://www.scalekit.com/graphql but introspection is disabled, scoped, or behind authentication

cite (1)

ai_review_browser.schema@2026-08-19

Webhooks & events16/20

scored

The envelope is well shaped: spec_version, environment_id, occurred_at, organization_id, type and data, with types like organization.directory.user_created. Verification helpers ship in every SDK (scalekit.webhooks.verifySignature and its Python, Go and Java equivalents), and delivery retries use exponential backoff. What is missing is a single page enumerating every event type a subscriber can receive, and a named signing algorithm.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

ai_review_browser.pages_fetched@2026-08-19

JAIRF · 6 dimensions

FCFoundational Compliance

100/100

Structural validity, standards conformance, and parsability of the OpenAPI specification.

DXJDeveloper Experience & Tooling Compatibility

84.6/100

Documentation clarity, example coverage, response completeness, and ingestion health.

ARAXAI-Readiness & Agent Experience

73.7/100

Semantic clarity, intent expression, datatype specificity, and error standardization.

AUAgent Usability

100/100

Operational composability, complexity comfort, navigation affordances, and safety patterns.

SECSecurity

80/100

Authentication strength, transport security, secret hygiene, and OWASP risk posture.

AIDAI Discoverability

100/100

Descriptive richness, intent phrasing, workflow context, and registry signals.

Band rationale:A band: JAIRF=89.4 HeadlessIndex=88

04 / Embed

Show Scalekit's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Calibration

How THI compares to external scorers

Source	Score	Measures	Last checked
Fern Agent Score	not found	Documentation completeness and SDK shape (~22 checks)	—
CLIRank Agent Friendliness	not found	CLI readiness, docs quality, and overall agent affordances	—
Cloudflare Is It Agent Ready?	blocked	Cloudflare's manual agent-readiness heuristic per vendor URL	—
Jentic Scorecard	—	JAIRF-based scorecard requiring a public OpenAPI specification	—

THI 88 vs external median 0

No external scores available to calibrate against.

Peers in Auth & Identity

WorkOSB

Headless Index 82/100

Microsoft Entra IDB

Headless Index 82/100

Supabase AuthB

Headless Index 74/100

See full Auth & Identity ranking →

FAQ

Scalekit and agent readiness

Is Scalekit agent-ready?: Scalekit scores Band A on The Headless Index and rates AI-Ready on JAIRF (89.4/100). Its strongest area for agent use is MCP and agent posture; its weakest is headless operation.
Does Scalekit publish an OpenAPI spec?: Yes. Scalekit publishes an OpenAPI specification, scored under JAIRF v1.0.0. A published spec is what makes an API discoverable and callable by agents rather than only by developers reading docs.
What is Scalekit's Headless Index score?: Scalekit scores 88/100 on the Headless Index thesis-fit rubric and sits in Band A in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.