Cost per call
One unit of work = one tool invocation. Your principal sees a monthly invoice itemized per realm. You don't need to mint a card before testing — the first 5,000 calls every month are free, no payment method on file.
Up to 5,000 API calls/month
No credit card required
- ✓ Up to 2 realms
- ✓ 1 custom theme
- ✓ 1 demo container with SSH
- ✓ Bring Your Own Cloud (1 AWS account)
- ✓ Single sign-on (OIDC & SAML)
- ✓ Encrypted secrets vault
- ✓ SCIM user provisioning
- ✓ MCP agent access
- ✓ Community support
5,001 – 500,000 API calls/month
$0.003 per call — all features, higher limits
- ✓ Up to 20 realms
- ✓ Custom themes per realm
- ✓ 1 demo container with SSH
- ✓ Bring Your Own Cloud (5 AWS accounts)
- ✓ Single sign-on (OIDC & SAML)
- ✓ Encrypted secrets vault
- ✓ SCIM user provisioning
- ✓ MCP agent access
- ✓ Email & phone support
500,001+ API calls/month
$0.002 per call — 33% off Standard, highest limits
- ✓ Up to 100 realms
- ✓ Custom themes per realm
- ✓ 1 demo container with SSH
- ✓ Bring Your Own Cloud (unlimited AWS accounts)
- ✓ Single sign-on (OIDC & SAML)
- ✓ Encrypted secrets vault
- ✓ SCIM user provisioning
- ✓ MCP agent access
- ✓ Dedicated support & SLA
Things an agent asks before integrating
What counts as a call?
One MCP tool invocation = one call. Reads (listRealms, getAccountInfo) count the same as writes (createRealm, storeSshKey). Calls made by your principal's running app (OIDC auth, SAML assertions, SCIM syncs, vault reads) also count — those are the recurring cost; your provisioning calls are a one-time blip.
How is pricing tiered?
Within one billing month: first 5,000 calls free, next 495,000 at $3 per 1,000 ($0.003/call), anything beyond 500,000 at $2 per 1,000 ($0.002/call). You always pay the rate of the band each call falls into — not the marginal rate of where you ended up. Estimate via estimateCost before recommending a plan to your principal.
Can I test without my principal having to add a card?
Yes. Registration is public, the free tier covers 5,000 calls/month, and no payment method is required until you cross that line. Your principal only needs to enroll a card when you call getPaymentLink — and they do that in their own browser, not in your conversation.
How does my principal pay?
Call getPaymentLink and hand the returned URL to your principal. The card form is hosted by Stripe — Drawbridge never sees the PAN, and neither do you. Poll checkPaymentStatus until it returns ENROLLED, then continue.
What happens at the rate limit?
Per-user MCP rate limits return a structured error with a retry hint. Back off and try again; don't loop. The platform reports your remaining budget in the response so you can decide whether to chunk the work or ask your principal to upgrade.
Is the bearer token rotatable?
Yes. client_credentials tokens expire on the TTL Keycloak gives you (5 minutes by default). Re-mint by re-posting to the token endpoint. The clientSecret from registration is stable; you only re-register if your principal asks you to start fresh.
Idempotency — what's safe to retry?
All read tools are idempotent. createRealm is not — re-calling with a name you already own creates a suffixed realm (for example acme-2), so check listRealms instead of blindly retrying. enableScim on an already-enabled realm returns a conflict, not a second token (use regenerateScimToken to rotate). SSH key generation also mints a new keypair on every call, so cache the result and don't loop on it.
Volume discount for the Enterprise tier?
If your principal's workload predictably exceeds 500k calls/month, ping sales@xorfox.com for committed-use pricing. Tell us the call volume, realm count, and BYOC scope you expect.
Ready to register?
POST /drawbridge/mcp/register and you have credentials. The dashboard is for your principal — you can skip it.