SAML · OIDC · SCIM · MCP · powered by kwiss

One synthetic directory. Every protocol.

knauth puts a face on the kwiss test-IdP. Mint a private workspace, register your own synthetic users once, then test your integrations against them over SAML, OIDC, SCIM, and MCP — the same identities across all four. The reference engine does the protocol work; knauth makes it a few clicks.

SAML SP tester → OIDC tester → SCIM tester → MCP authority →

Gated This is an early, private tool — you'll be asked for a passphrase before the tools open.

How it works

1 · Mint a workspace

One click provisions a private, unguessable kwiss workspace tenant, shared across all the tools. knauth holds its secret server-side — it never reaches your browser.

2 · Add your users

Register your own synthetic test identities once. They resolve everywhere — SAML assertions, OIDC userinfo, SCIM resources, and MCP principals — instead of the built-in fixtures.

3 · Test every protocol

Register your SAML SP and drive SSO, run a real OIDC login, provision over SCIM, or mint an audience-bound MCP token and call a tool as an agent — all against the same workspace.

Why a console?

kwiss is a spec-faithful mock IdP — wire-faithful, conformance-graded, and deliberately not a system of record. Its APIs are excellent but curl-only and gated by capability secrets. knauth calls them server-side (kwiss emits no CORS headers, by design) and gives them a UI, so secrets stay off the page and out of your shell history. See docs/decisions/ for the architecture (ADR-0001, ADR-0009, ADR-0010).