Open source · LGPL-3.0 · Integration-friendly
Menagerai is a self-hosted control plane for the internal apps your team ships: one SSO login, per-app access control, and usage analytics, all in one place.
Fragmented logins, inconsistent access controls, and no visibility into who uses what. Menagerai adds governance after deployment: put existing apps behind its gateway, connect your identity provider, and manage everything from one portal.
Single sign-on across every app behind the gateway, backed by the OIDC provider you already trust. Menagerai never stores credentials — it isn't an identity provider.
Per-app RBAC with role grants and per-user overrides, enforced by a ForwardAuth gateway that injects trusted identity headers into each allowed request.
Per-app and per-user adoption analytics — an activity heatmap, power users, and most-used apps — so you finally know if anyone opens what you built.
Menagerai isn't just for humans. Every admin action — users, roles, app grants, per-user overrides, audit — is a JSON API under /api/admin, secured by personal API keys with full audit attribution. It ships with generated OpenAPI docs and an agent-ready skills package, so AI agents, CI jobs, and internal automation can drive the whole portal without browser automation.
Menagerai sits between the identity provider you bring and the apps you deploy — owning the catalog, authorization, and usage visibility.
Bring your own OIDC provider (Logto supported today). Authentication is delegated — no credentials ever touch Menagerai.
Default-deny RBAC — status → user-deny → user-allow → role-allow — managed entirely in the admin UI.
A ForwardAuth gateway authorizes every request and forwards trusted identity headers. Simple apps need no login of their own.