Odudu release candidate brings self-hosted identity and agent support

On October 26, 2026, Wisdom Praise published a release candidate for Odudu, an open-source identity and access management platform. This new software allows teams to host their own sign-in infrastructure, supporting OpenID Connect and OAuth 2.0 standards while offering specific features for AI agents and multi-tenant environments.

What happened

The project, hosted on GitHub under the repository wizzywit/odudu, is positioned as a solution for organizations that want to keep user authentication data on their own servers. Unlike many existing identity providers that are either fully managed services or complex enterprise suites, Odudu aims to run in a single container alongside a PostgreSQL database. The release is marked as version 0.1.0-rc.3, indicating it is pre-version 1.0 and still in active development.

The core value proposition centers on ownership and control. By self-hosting the identity layer, teams can avoid vendor lock-in and maintain direct oversight of user credentials and session data. The platform supports multiple tenants within a single instance, keeping them isolated at the database level. This architecture is designed to simplify operations for service providers or large organizations managing distinct user groups without deploying separate infrastructure for each.

A notable addition in this release is the focus on machine and agent identity. As artificial intelligence agents become more common in software workflows, they require secure ways to authenticate and act on behalf of users or systems. Odudu includes built-in support for token exchange and client credentials, along with a Model Context Protocol (MCP) server. This allows AI agents to use the admin API as tools, subject to the same permission constraints as human administrators.

Key details

• Release status: The software is a release candidate (v0.1.0-rc.3) and has not yet undergone an independent security review.
• Deployment: It runs in one container with PostgreSQL and can be started using Docker Compose v2 and curl.
• Security features: Includes passkeys, recovery codes, rotating refresh tokens, and authorization code flow with PKCE always required.
• Multi-tenancy: Supports many tenants in one container, with isolation enforced by the database structure.
• Agent support: Features an MCP server that exposes the admin API to AI agents, enabling automated management tasks.
• Licensing: The server, console, and tools are licensed under AGPL-3.0-only, while guides and examples use Apache-2.0.

Background

Identity and access management (IAM) is the framework that ensures the right people and systems have appropriate access to technology resources. OpenID Connect (OIDC) and OAuth 2.0 are industry-standard protocols for handling authentication and authorization. Most companies either build these systems from scratch, which is error-prone and resource-intensive, or subscribe to third-party identity providers. Self-hosting an IAM solution offers a middle ground, providing control over data residency and compliance without the burden of building the cryptographic primitives from zero.

The rise of AI agents introduces new complexities to identity management. Traditional flows are designed for human users interacting with browsers or mobile apps. Agents, however, operate autonomously and need machine-to-machine authentication methods like client credentials. The Model Context Protocol (MCP) is an emerging standard that helps AI models interact with external data and tools securely. By integrating an MCP server, Odudu allows agents to perform administrative actions programmatically while respecting the defined access controls.

Why it matters

For teams running their own software, controlling the identity layer is critical for data sovereignty and compliance. When you host your own identity provider, you retain full ownership of user data, including login histories and personal information. This is particularly relevant for industries with strict regulatory requirements or for companies that wish to offer white-labeled services to their own clients. The multi-tenant capability means a single deployment can serve multiple customers or departments, each with their own branding and isolated data, reducing operational overhead.

The inclusion of agent-specific features addresses a growing gap in current self-hosted solutions. As developers integrate AI assistants into their internal tools and customer-facing applications, those agents need secure, auditable ways to authenticate. Odudu’s approach of exposing the admin API via MCP with strict permission guards ensures that automated processes do not bypass security policies. This allows for safer automation of user management, such as provisioning accounts or adjusting roles based on external triggers.

However, the pre-1.0 status and lack of independent security review mean this tool is not yet ready for critical production environments handling sensitive data. The developers explicitly advise users to start small and report issues. For engineering leads, this presents an opportunity to evaluate the architecture and contribute to its development, but it requires a cautious approach to deployment. The AGPL license also implies that any modifications distributed to others must be shared, which may affect how some companies integrate it into proprietary products.

What you can do

• Test the release candidate in a non-production environment using the provided Docker Compose quick start guide.
• Review the documentation on signing in from web apps, single-page apps, and APIs to assess compatibility with your stack.
• Evaluate the multi-tenant isolation model to determine if it meets your data separation requirements.
• Experiment with the MCP server integration to understand how AI agents can interact with the admin API securely.
• Read the CONTRIBUTING.md and SECURITY.md files before submitting changes or reporting vulnerabilities.
• Monitor the roadmap and release notes for updates on the planned hosted service and future feature additions.