Skip to main content
Casdoor is a deployed Go IAM service. You run it as a separate process alongside your app, and it handles SSO, LDAP, CAS, RADIUS, and a native MCP OAuth server. It’s designed for organizations that need a standalone identity provider, especially in Go environments. KavachOS is a library, not a service. You import it into your TypeScript app and it runs in-process. Same MCP OAuth 2.1 spec, very different deployment model. A migration guide from Casdoor is coming soon.

​
Feature matrix

​
Pick KavachOS if

  • You’re building a TypeScript or edge-native app and want auth in-process, not as a sidecar.
  • You need first-class agent primitives: delegation, ephemeral sessions, trust scoring, and cost attribution.
  • Your MCP OAuth story needs to know which agent made which call, not just which client.

​
Pick Casdoor if

  • You want a deployed IAM service that your whole organization can log into, including non-TypeScript services.
  • You need LDAP, CAS, or RADIUS compatibility for employee SSO.
  • You’re in a Go shop and want to own the full server.
The clearest signal: if you’re writing import { createKavach }, KavachOS. If you’re writing docker run casdoor, Casdoor.
Last modified on April 29, 2026