Pricing
The bouncer, the building, the cameras. One price.
ModGate sits between your AI agents and your MCP servers, handling auth, identity, and audit end to end — priced on what flows through the gate, not on how many pieces you use.
🪪
The Auth0 model — for MCP
Auth0 doesn't host your app. Stripe doesn't run your store. ModGate doesn't host your MCP server. We're the trust layer in the middle — priced on agent authentications, not server count.
🛡️
Security included, not gated
Continuous authorization, real-time webhooks, and cross-agent delegation (xAA) run on every plan — including Free. Live revocation isn't an upsell here.
🤖
Manage your account from ClaudeNew
Every plan, including Free, now includes Admin MCP — ModGate managing itself, exposed as an MCP server and protected by the exact same OAuth pipeline that secures everything else on ModGate. List agents, revoke access, and check your audit log by asking Claude, instead of clicking through a dashboard. See how it works →
Free
$0
forever
500 authentications / mo
For developers exploring MCP auth and building prototypes. Bring your own MCP server.
- Up to 3 MCP servers registered
- 500 agent authentications/mo
- OAuth 2.1 + PKCE enforced
- Admin MCP — manage your account from Claude
- Continuous authorization, webhooks & xAA — included
- Basic audit log — 7 days
- Community support
Pro
$99
per month
10,000 authentications / mo
For teams shipping production MCP integrations. Your server, our gate.
- Unlimited MCP servers registered
- 10,000 agent authentications/mo
- Full OAuth 2.1 proxy + PKCE
- Agent identity system
- Admin MCP — manage your account from Claude
- Continuous authorization, webhooks & xAA
- Audit log — 30 days
- Email support
- $0.008 per auth over limit
Most popular
Team
$499
per month
100,000 authentications / mo
For SaaS companies securing agents across multiple customers and environments.
- Unlimited MCP servers registered
- 100,000 agent authentications/mo
- Tool-level scope policies
- Admin MCP — manage your account from Claude
- Continuous authorization, webhooks & xAA
- SSO — Okta, Entra ID, Clerk
- Multi-tenant agent isolation
- Audit log — 1 year
- Slack + priority support
- $0.005 per auth over limit
Enterprise
Custom
per month active agents
Metered by MAA
For large organizations pricing by monthly active agents — the Auth0 model for MCP.
- Priced per monthly active agent
- Unlimited authentications
- Admin MCP — manage your account from Claude
- Continuous authorization, webhooks & xAA
- Dedicated Cloudflare zone
- EU data residency (GDPR)
- SOC 2 Type II reports
- SLA guarantees (99.99%)
- Custom audit retention
- Onboarding + implementation
What counts as an authentication?
✅Counts
- Authorization code exchanged for a token
- Cross-agent delegation (xAA) — each delegated sub-agent token
❌Doesn't count
- Token refresh — access tokens last 15 minutes; refreshing to stay authenticated is free
- Health checks and pings
- Cached token reuse — no call to ModGate at all
- Revocation or force-reauth — these invalidate tokens, not issue them
➕Free always
- Registering MCP servers
- Creating agent identities
- Viewing audit logs and webhook deliveries
Common questions
Do I need to host my MCP server with ModGate?
No. You host your MCP server wherever you want — Cloudflare Workers, Vercel, your own infra. Push it to ModGate with one command and OAuth 2.1 with PKCE is enforced automatically, no auth configuration required. Think Auth0 for MCP: we don't run your app, we secure it.
What is an agent authentication?
A new access token being issued — through the authorization code flow, or cross-agent delegation. Both are metered identically. Refreshing an existing token is not a new authentication and is not billed: access tokens last 15 minutes, so an actively-running agent refreshes often, and continuous authorization uses that refresh cycle to keep re-checking live agent state without costing you anything extra. Health checks and cached-token reuse never hit the token endpoint at all, so they're free by definition.
Does cross-agent delegation count against my authentication limit?
Yes. Each token an orchestrator mints for a sub-agent via /oauth/delegate is a billable authentication, metered the same as a direct token issuance. A deep delegation chain with several sub-agents refreshing independently will use more of your quota than a single agent — plan your maxDelegationDepth accordingly.
Is continuous authorization included on every plan?
Yes. Live revocation, reverification windows, and rate-anomaly detection run by default on every tier, including Free — and you can tune the policy per agent from any plan via the API. We don't put core security behind a paywall.
Do webhooks or the force-reauth kill switch cost anything extra?
No. Both are included at every tier, unlimited endpoints and events. Neither is a billable authentication — they invalidate or notify, they don't issue tokens.
What is a Monthly Active Agent (MAA)?
On Enterprise plans, you're priced by the number of unique agent identities that authenticate at least once per month — the same model Auth0 uses for monthly active users. Scales naturally with your business.
Can I connect my existing IdP?
Yes. ModGate's OAuth proxy connects to Okta, Microsoft Entra ID, Clerk, Auth0, or any OIDC-compatible provider. Your enterprise customers reuse their existing SSO — no new identity system required.
What happens if I go over my authentication limit?
Pro overages are $0.008 per authentication. Team overages are $0.005. We'll never cut off your traffic — we'll notify you and charge the overage. Enterprise plans have unlimited authentications.
Is there a free trial for paid plans?
Start free with 500 authentications/month — no credit card required. Upgrade to Pro or Team from your dashboard when you need more.
Questions about pricing? We answer personally.
[email protected] →