Depot vs Auth0
Side-by-side trajectory, velocity, and editorial themes.
Depot is rounding out Depot CI into a credible GitHub Actions alternative, and just shipped nested virtualization.
Eight of the last ten changelog entries are Depot CI updates: a new workflow summary page, environment-aware secret and variable variants, CLI commands for metrics, JSON status output, live log streaming, workflow listing and inspection, run cancel/rerun/retry/dispatch, and a DEPOT_JOB_URL env var in every job. Registry got pull-through cache improvements with provider presets. The dominant theme is filling in the feature surface a serious CI platform needs.
Depot is methodically closing the gap between its CI product and the incumbents. The recent run reads like a checklist: workflow UX, secrets, metrics, log streaming, scriptable CLI surface — the table-stakes ergonomics teams expect before migrating off GitHub Actions or CircleCI. The May 20 nested virtualization release expands what kinds of workloads Depot CI can host at all, not just how nicely it hosts them, which is a different and more aggressive move.
Expect more workload-expansion moves following the nested virtualization release — likely Android-specific tooling, deeper matrix/sharding UX (the workflow page already groups matrix failures), and continued CLI parity work. The secrets-and-variables variant model looks set up to grow into broader policy-as-code for CI configuration.
Auth0 ships Auth for MCP GA and starts unbundling the rest of identity for AI agents.
Auth0 just made Auth for MCP generally available — a bundle of CIMD client registration, On-Behalf-Of token exchange, and OAuth resource-parameter compatibility purpose-built for AI agents talking to MCP servers. Around it, the team is reworking core identity primitives: non-unique emails reached GA, online refresh tokens entered beta with session binding, and the Account API now supports step-up auth for sensitive scopes. Smaller polish items (CMD+K palette, Resend GA, signing algorithm coverage) round out the release stream.
Auth0 is repositioning from a B2C/B2B login provider to an authorization layer for agent ecosystems. The MCP work is the centerpiece, but the supporting moves — session-bound refresh tokens, step-up auth on the Account API, non-unique emails — all point at use cases where users, agents, and resources have more complex relationships than classic OIDC was designed for. Outbound event streams to AWS EventBridge and Okta Workflows extend the same direction outward.
Expect Auth for MCP to gain a managed catalog of pre-vetted MCP clients and deeper Actions-based policy hooks for OBO token exchange, plus online refresh tokens reaching GA within a quarter.
See more alternatives to Depot →
See more alternatives to Auth0 →