Infrastructure & DevOps

casdoor

Source: casdoor/casdoor · ★ 13738 · Go

Last updated 2026-06-05 · benchmark checked 2026-09-08 · unchanged since 2026-08-08 — deterministic & reproducible

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

Are you the maker of casdoor? Claim this listing. It is free, takes a meta tag, a DNS record or GitHub admin rights, and never changes the score.

Launched something? Add your product, free.

To cite this score: legit.show/s/gh-casdoor-casdoor/2026-09-08. That address never changes; this page moves with every re-measure.

Legit.Show scored casdoor 54/100 on 2026-09-08, measured across 5 of 7 frames from its public surface. legit.show/s/gh-casdoor-casdoor/2026-09-08

Is casdoor production-ready?

Legit.Show scores casdoor 54 out of 100 — the simple average of its 5 measured frames. Legit.Show ran its deterministic 7-Frame production-readiness benchmark on casdoor (public-surface assessment), measured from the public surface with no LLM in the scoring path. Its strongest frame is Reliability; its weakest is Privacy. 5 of the seven frames returned a score; Performance and Accessibility were not measurable on this service and are recorded as null — not as zero. Every frame it averages is published with its evidence on the Legit.Show listing.

The 7 Frames

• Performance — not measurable on this service (null — not scored as 0)
• Accessibility — not measurable on this service (null — not scored as 0)
• Security — 25/100
  How this compares across the catalogue: The Web Security Baseline
• Privacy — 0/100
  How this compares across the catalogue: The Privacy Gap
• Reliability — 100/100
• Standards — 75/100
• Discoverability — 72/100

What we measured

• No Content-Security-Policy and no HSTS.
• Served over HTTPS with a valid certificate.
• Real Lighthouse performance run — 323 ms to first byte.
• Returns a proper 404 for unknown routes.
• 3 of 3 sampled routes reachable.
• No privacy policy found.
• Sets cookies / loads scripts with no consent prompt.
• Discoverable: sitemap, canonical URL.

Sources and updates

Description

Taken from casdoor.ai's own website on 2026-06-05.

Code

github.com/casdoor/casdoor.

Benchmark

Measured by Legit.Show from the live site, the way any visitor sees it — with no access to its code or accounts. Same method for every product, and no AI decides the score. Last checked 2026-09-08.

Put together from public information, without casdoor's involvement. If anything here is wrong, tell us and a person will check it.

Visit casdoor → · Alternatives to casdoor → · How this was measured →