Skip to main content
Casdoor is a deployed Go IAM service. You run it as a separate process alongside your app, and it handles SSO, LDAP, CAS, RADIUS, and a native MCP OAuth server. It’s designed for organizations that need a standalone identity provider, especially in Go environments. KavachOS is a library, not a service. You import it into your TypeScript app and it runs in-process. Same MCP OAuth 2.1 spec, very different deployment model. A migration guide from Casdoor is coming soon.

​
Feature matrix

CapabilityKavachOSCasdoor
LanguageTypeScript libraryGo service
First-party TypeScript SDKYesNo (third-party only)
Deployment modelIn-process libraryStandalone IAM server
MCP OAuth 2.1 serverBuilt in with agent delegationBuilt in
Agent identityFirst-class AgentIdentity entity with delegation and auditNot shipped
LDAP / CAS / RADIUSNot shippedYes
RBACUnified RBAC + ABAC + ReBACRBAC via Casbin
Ephemeral agent sessionsBuilt inNot shipped
Cost attributionBuilt inNot shipped
Trust scoring5-level built inNot shipped
Edge runtimeWeb Crypto throughoutGo, not applicable
Self-hostableYesYes
LicenseMITApache 2.0

​
Pick KavachOS if

  • You’re building a TypeScript or edge-native app and want auth in-process, not as a sidecar.
  • You need first-class agent primitives: delegation, ephemeral sessions, trust scoring, and cost attribution.
  • Your MCP OAuth story needs to know which agent made which call, not just which client.

​
Pick Casdoor if

  • You want a deployed IAM service that your whole organization can log into, including non-TypeScript services.
  • You need LDAP, CAS, or RADIUS compatibility for employee SSO.
  • You’re in a Go shop and want to own the full server.
The clearest signal: if you’re writing import { createKavach }, KavachOS. If you’re writing docker run casdoor, Casdoor.
Last modified on April 18, 2026