{"data":[{"slug":"cerbos","name":"Cerbos","tagline":"Apache-2.0 authZ PDP: YAML policies, run anywhere","category":"nextjs","url":"https://cerbos.dev","github":"https://github.com/cerbos/cerbos","pricing":"open-source","hook":"Cerbos is the YAML policy decision point when your IdP should not also be your authorization brain.","whatsGood":"Apache-2.0. Free forever Run anywhere — verified on cerbos.dev/pricing. YAML policies, PDP you embed or sidecars. Decouples authZ from whatever issues the tokens.","theCatch":"authZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP. Check current Hub prices on the vendor site; self-host PDP is the free path. Distinct from authentik, Keycloak, and Better Auth.","verdict":"Apache-2.0 authorization PDP. Free to run; not an IdP.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"AuthZ","subcategory":"AuthZ","tags":["self-host","permissive","auth","active"],"capabilities":["authz","policies","auth"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":4626,"starsPerWeek":16,"access":"free","archived":false,"repo":{"createdAt":"2021-03-21","pushedAt":"2026-10-19","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/cerbos","html":"/gems/cerbos","markdown":"/gems/cerbos.md"}},{"slug":"openfga","name":"OpenFGA","tagline":"Apache-2.0 Zanzibar-style ReBAC with a Check API","category":"nextjs","url":"https://openfga.dev","github":"https://github.com/openfga/openfga","pricing":"open-source","hook":"OpenFGA is Google Zanzibar-shaped authorization when YAML ABAC is the wrong model.","whatsGood":"Apache-2.0. Relationship-based access control, Check API, modeling language. Self-host the authorization service. CNCF-flavored ReBAC without inventing your own graph.","theCatch":"Zanzibar-style ReBAC + Check API — not Cerbos YAML ABAC. Vs SpiceDB: CNCF/Okta OpenFGA modeling + Check API lane; SpiceDB is AuthZed production Zanzibar + ZedTokens/Cloud. Distinct from Cerbos.","verdict":"Apache-2.0 ReBAC. Self-host free. Not Cerbos YAML.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"AuthZ","subcategory":"AuthZ","tags":["api","self-host","permissive","auth","active"],"capabilities":["authz","rebac","api"],"surfaces":["API","Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Apache-2.0","githubStars":5999,"starsPerWeek":26,"access":"free","archived":false,"repo":{"createdAt":"2022-06-08","pushedAt":"2026-10-18","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/openfga","html":"/gems/openfga","markdown":"/gems/openfga.md"}},{"slug":"topaz","name":"Topaz","tagline":"Apache-2.0 authZ: OPA Rego + embedded Zanzibar in one container","category":"nextjs","url":"https://www.topaz.sh","github":"https://github.com/aserto-dev/topaz","pricing":"open-source","hook":"Topaz is authorization in one container when you refuse to pick only ABAC or only ReBAC.","whatsGood":"Apache-2.0. OPA Rego policies plus an embedded Zanzibar-style directory in a single binary/container. ABAC and ReBAC without stitching Cerbos to OpenFGA yourself. Self-host is the free path.","theCatch":"One container = OPA Rego + embedded Zanzibar directory (ABAC+ReBAC) — not Cerbos YAML-only PDP and not OpenFGA ReBAC-only Check API. Distinct from Cerbos and OpenFGA.","verdict":"Apache-2.0 combined authZ. Self-host free; not a single-model PDP.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"AuthZ","subcategory":"AuthZ","tags":["self-host","permissive","auth","containers","active"],"capabilities":["authz","rego","rebac"],"surfaces":["Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Apache-2.0","githubStars":1365,"starsPerWeek":7,"access":"free","archived":false,"repo":{"createdAt":"2022-10-23","pushedAt":"2026-10-14","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/topaz","html":"/gems/topaz","markdown":"/gems/topaz.md"}},{"slug":"spicedb","name":"SpiceDB","tagline":"Apache-2.0 Google Zanzibar permissions DB; AuthZed Cloud optional","category":"nextjs","url":"https://authzed.com/spicedb/","github":"https://github.com/authzed/spicedb","pricing":"freemium","hook":"SpiceDB is the AuthZed Zanzibar permissions database when OpenFGA is the CNCF twin and Cerbos is YAML ABAC.","whatsGood":"Apache-2.0. Relationship-based authZ graph faithful to Google Zanzibar. Schema language, ZedTokens for consistency, Postgres/Cockroach/Spanner/MySQL stores. Self-host free; AuthZed Cloud is usage-based when you do not want to operate it.","theCatch":"Vs OpenFGA/Cerbos/Topaz: AuthZed production Zanzibar + ZedTokens/Cloud — not OpenFGA CNCF Check API twin, not Cerbos YAML PDP, not Topaz Rego+ReBAC bundle. Free path is self-host; Cloud is paid usage.","verdict":"Apache-2.0 Zanzibar permissions DB. Self-host free; AuthZed Cloud optional.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"AuthZ","subcategory":"AuthZ","tags":["self-host","free-tier","permissive","auth","active"],"capabilities":["authz","rebac","zanzibar"],"surfaces":["Self-host","Hosted"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Freemium","githubStars":7154,"starsPerWeek":26,"access":"free","archived":false,"repo":{"createdAt":"2021-08-16","pushedAt":"2026-10-18","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/spicedb","html":"/gems/spicedb","markdown":"/gems/spicedb.md"}}],"meta":{"total":4,"count":4,"offset":0,"limit":null,"sort":"curated","sorts":["curated","catalog","new","stars","trending","name"],"filters":{"subcategory":"authz"},"next":null,"categories":["agents","nextjs","python","shopify","databases","devops","design","observability","rust","payments","comms","notifications","libraries"],"tags":["mcp","cli","tui","api","sdk","desktop-app","web-ui","editor-plugin","self-host","local-first","free-tier","paid-only","paid-led","permissive","copyleft","source-available","license-unclear","coding-agents","local-llm","rag","memory","evals","browser-automation","scraping","sandbox","skills","voice","security","auth","payments","realtime","postgres","vector","kubernetes","containers","observability","testing","workflows","graphics-3d","git","active","stale","archived","young-repo","fast-stars"]}}