Obot

What it is

Obot is a control plane you host yourself, sitting between your AI clients and everything they reach — MCP servers, the credentials those servers need, and now the models themselves. It is written in Go, MIT-licensed at github.com/obot-platform/obot, and carries 983 GitHub stars. Three pieces do the work: an MCP Catalog that admins curate and staff browse, a gateway that brokers OAuth to every downstream server, and an audit log that records each tool call with the user, agent, server, arguments and outcome.

The auth model is the reason to look. Obot puts one identity layer in front of every MCP server, brokering tokens against Google, GitHub, Okta, Auth0, JumpCloud or Entra, and handling scope enforcement and rotation. Obot’s stated guarantee is that tokens never leave the gateway. Access is per tool, not per server: you define which users, groups and agents can call which tools on which servers, as policy in code.

Obot AI raised a $35M seed announced 23 September 2025, co-led by Mayfield and Nexus Venture Partners. The founding team built Rancher Labs, acquired by SUSE, and Cloud.com, acquired by Citrix; Sheng Liang is CEO. The MCP Gateway launched in August 2025, and the company also publishes Nanobot, an Apache-2.0 agent framework.

The fork it resolves

The question this page exists to answer is “a gateway we host, or managed tool-auth.” Composio and Arcade both hold your OAuth tokens on their infrastructure and hand you a catalogue in return. Composio disclosed on 21 May 2026 that attackers exfiltrated roughly 5,241 API keys and 5,001 GitHub OAuth tokens from exactly that kind of store. Obot inverts the trade: nothing to exfiltrate from a vendor, because there is no vendor in the credential path — and no pre-built catalogue of a thousand integrations either. Obot governs the MCP servers you bring; it does not supply them.

Version 0.23.0, released 18 June 2026, added the piece that separates Obot from both: an LLM gateway. Obot now presents an OpenAI- and Anthropic-compatible model endpoint, so Claude Code authenticates with an Obot token, calls models by native name, and sees only the models that user is authorized to use. Composio and Arcade govern tool calls. Obot governs tool calls and model calls through one policy and one audit trail, which is the artifact a compliance reviewer actually asks for.

The same release moved shared MCP servers into Git-backed catalog entries, so a new server lands through code review and references externally managed secrets instead of storing them in Obot. It also collapsed the editions into one build: the open-source image plus a licence key turns on enterprise features, so you upgrade in place rather than redeploying a different image.

Pricing reality

Obot Community is free and self-hosted under MIT. Obot Cloud is hosted and free to try. Obot Enterprise is a licence key that adds Okta and Microsoft Entra identity integration, advanced governance and commercial support. There is no published price for it — obot.ai/pricing returns a 404 and the enterprise path is a demo request.

Read the free licence correctly. Production, per Obot’s own installation guide, wants PostgreSQL 17 or newer, a production-grade Kubernetes cluster with capacity for Obot and every MCP server it runs, S3-compatible object storage, TLS certificates, a cloud KMS key (AWS, Google or Azure) and a backup strategy. Our estimate from those documented requirements: a modest AWS footprint — managed Kubernetes, RDS for PostgreSQL, a bucket and a KMS key — lands near $400-700 a month before the MCP servers themselves. The licence is $0; the platform engineer who owns the upgrade path is not.

Best for

The platform or IT engineer at a company that already runs Kubernetes and whose security review has blocked managed tool-auth. The scoped case where Obot wins outright: 40 people on Claude Code and Cursor reaching Salesforce and Slack MCP servers, where legal needs a per-tool audit trail naming the human behind each write, and where the same policy has to cover which models those people can call.

Not for

A team of five with no Kubernetes practice. The single-container Docker image is an evaluation path, not a deployment, and running it in production means mounting the host Docker socket into your agent control plane. Obot is also the wrong pick if what you want is breadth on day one — if the goal is authenticated writes into a thousand SaaS apps this week, Composio ships that and Obot does not.

Versus the alternatives

• Docker MCP Gateway — the widest distribution in the category, open source and shipped inside Docker Desktop’s MCP Toolkit, general availability in late 2025. It runs each MCP server as a container with restricted privileges and network access. Pick it when the requirement is safe local execution for developers and you have no central governance mandate. It does not answer “which human authorized this, across the whole company.”
• Composio — the largest managed catalogue at roughly 1,000 integrations, and the cheapest per authenticated tool call in the segment at $0.0003. Pick it when speed to a working write beats credential custody, and when nobody is asking you to hold the tokens.
• Arcade — the fastest-growing entrant, $60M Series A in June 2026 and the acquisition of Smithery on 5 August 2026. It authorizes per user at call time against your existing IdP. Pick it when you want per-user OAuth without running the infrastructure, and can accept a third party in the credential path.

If none fit, run the MCP servers your agents need as plain containers behind your existing API gateway and write the audit events to the SIEM you already pay for. Under about five servers and one team, a control plane is overhead.

Watch-outs

• The licence is free and the deployment is not. The production requirements list a Kubernetes cluster, PostgreSQL 17+, object storage, KMS and backups, and the cluster has to be sized for Obot plus every MCP server it hosts. Guard: budget the platform engineer before the pilot, and keep the single-container Docker image — which mounts /var/run/docker.sock — on evaluation hardware only. That container drifting into production is the realistic failure here, not a Kubernetes bill.
• Enterprise SSO sits behind the licence key. Okta and Microsoft Entra integration ship in Enterprise; the open-source build covers Google, GitHub, Auth0 and JumpCloud. Guard: confirm which IdP your security review mandates before week 1 of the pilot, and get the enterprise quote then — discovering the requirement after the pilot proves out means you negotiate the renewal from the weaker side of the table.
• No public price on the tier you will end up buying. Guard: get a written quote naming the metering basis — seats, servers or tool calls — and a renewal cap in the first contract, before Obot becomes the chokepoint for every agent in the company.
• Pre-1.0 software moving fast. v0.23.0 reorganized the UI, changed how shared servers are defined and added a model endpoint, all in one release on 18 June 2026. Guard: pin an image digest rather than :latest, read release notes before every upgrade, and rehearse a PostgreSQL restore — because a gateway that fronts both tools and models takes every agent in the company down with it.