WorkOS MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

The newly documented multi-agent install flow and broad workspace mutations merit an early check of access controls and product changes.

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Use WorkOS dashboard operations from a team-scoped remote MCP with separate production/write controls.

What we know

Official WorkOS dashboard MCP server authenticates via browser OAuth and acts as the signed-in dashboard user for one team at a time. Authorized tools help inspect and manage user organizations, authentication connections, branding and audit-log integrations, with administrator toggles for MCP access, production access and write permissions.

Maintenance / activity evidence

Publisher CLI/MCP setup article released 2026-09-30.

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Read/write eligible organization, user, connection, branding and stream settings. Writes: Create/change organizations and user invitations; Modify supported identity connections and branding; Configure supported audit-log streams.
Dashboard OAuth user context, restricted by team and independent admin MCP production/write toggles.
Sensitive access: Users and email addresses, SSO/directory configurations, Authentication and audit events

Identity-management changes can affect real users and production access; restrict write and production access.
No impersonation, credential rotation or team deletion via MCP.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Have team defaults, destructive confirmation and supported workspace operations changed after the CLI onboarding release?

The assessed publisher sources describe inherited dashboard roles, sandbox default, destructive confirmation and team controls; no material tracking blocker identified.

Identity-management changes can affect real users and production access; restrict write and production access.
No impersonation, credential rotation or team deletion via MCP.
Read/write eligible organization, user, connection, branding and stream settings.
Dashboard OAuth user context, restricted by team and independent admin MCP production/write toggles.
Sensitive identity, organization and sign-in event data can be accessed by an authorized agent/client.
Reviewed write actions: Create/change organizations and user invitations; Modify supported identity connections and branding; Configure supported audit-log streams
Sensitive access: Users and email addresses, SSO/directory configurations, Authentication and audit events
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Production and write access are enabled at team level by default; configuration and runtime authorization were not tested.
MCP operation-specific field-level permission inventory
specific retained conversation/telemetry policy
Team administrators can independently disable MCP, production access or writes; all three controls are enabled by default.
Agent cannot impersonate end-users or act on another team.
MCP cannot mint or rotate API keys, OAuth secrets or signing certificates, delete the WorkOS team, or change its own MCP access settings.
Dashboard member permission controls still apply; do not treat team OAuth as unrestricted access.
WorkOS team admin access gates and excluded sensitive actions must remain visible.

Original activity observations

Publisher CLI/MCP setup article released 2026-09-30.

Technical identity

public:workos

Exact implementation source: https://workos.com/docs/mcp ↗
Reviewed resource type: MCP Server
Service endpoint: https://mcp.workos.com/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Evidence source ↗
workos.com/docs/mcp
Source material retained for this review.
Evidence source ↗
workos.com/blog/workos-mcp-cli-install
Source material retained for this review.
Evidence source ↗
workos.com/docs/dashboard/authentication
Source material retained for this review.
Evidence source ↗
mcp.workos.com/mcp
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher-documented package/connection route; replace placeholders and verify host-specific syntax.
Publisher setup example · Publisher instructions
workos mcp install
Configure / authenticate
MCP100 setup guide
Official endpoint https://mcp.workos.com/mcp. Install optional WorkOS CLI (`brew install workos/tap/workos` or `npm install -g workos`), run workos mcp install; then client-specific OAuth via Claude /mcp or `codex mcp login workos`.
Use correct transport and published host config. Never paste secrets in chat; server registration is separate from software installation.
Previously reviewed configuration / prerequisites: Choose intended team; set production/write policies in Dashboard before connecting.
Previously reviewed configuration / prerequisites: WorkOS dashboard account
Previously reviewed configuration / prerequisites: Team admin must permit MCP access
Check connection
Suggested check
workos mcp status checks registration only; confirm OAuth and tools separately.
Remove / uninstall / revoke
MCP100 setup guide
Remove the client-specific `workos` MCP registration (e.g. `claude mcp remove workos` or `codex mcp remove workos`). `workos mcp status` checks configuration but not OAuth; no publisher CLI uninstall command confirmed here.
Conditional host / package cleanup · Claude Code only · MCP100 composed guide
claude mcp remove workos

Official Documentation & Sources

What it does

Official WorkOS dashboard MCP server authenticates via browser OAuth and acts as the signed-in dashboard user for one team at a time. Authorized tools help inspect and manage user organizations, authentication connections, branding and audit-log integrations, with administrator toggles for MCP access, production access and write permissions.

Capability: Security & Testing
Resource type: MCP Server
Best fit: Use WorkOS dashboard operations from a team-scoped remote MCP with separate production/write controls.

Representative uses

Investigate SSO and organization setup issues
Inspect sign-in attempts and directory sync state
Create organizations or invite users when write access is enabled
Adjust AuthKit branding and configure audit-log stream operations where permitted

Limitations

Team administrators can independently disable MCP, production access or writes; all three controls are enabled by default.
Agent cannot impersonate end-users or act on another team.
MCP cannot mint or rotate API keys, OAuth secrets or signing certificates, delete the WorkOS team, or change its own MCP access settings.
Dashboard member permission controls still apply; do not treat team OAuth as unrestricted access.
WorkOS team admin access gates and excluded sensitive actions must remain visible.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Dashboard OAuth user context, restricted by team and independent admin MCP production/write toggles.
Permissions: Read/write eligible organization, user, connection, branding and stream settings.
Data handling: Sensitive identity, organization and sign-in event data can be accessed by an authorized agent/client.
Cost: plan_based
Risk and cautions: Identity-management changes can affect real users and production access; restrict write and production access.

Access scope and cautions

Write actions: Create/change organizations and user invitations Modify supported identity connections and branding Configure supported audit-log streams
Sensitive access: Users and email addresses SSO/directory configurations Authentication and audit events
Risk level: high
Security notes: No impersonation, credential rotation or team deletion via MCP.

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Investigate SSO and organization setup issues; Inspect sign-in attempts and directory sync state; Create organizations or invite users when write access is enabled; Adjust AuthKit branding and configure audit-log stream operations where permitted.

What setup and authentication are documented?

Recorded endpoint: https://mcp.workos.com/mcp. Recorded transport: streamable_http. Prerequisites: WorkOS dashboard account; Team admin must permit MCP access; Remote MCP-compatible client. Client notes: Choose intended team; set production/write policies in Dashboard before connecting. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Browser-based OAuth, acting as signed-in WorkOS Dashboard user.

Can it modify data or perform write operations?

Documented write actions include: Create/change organizations and user invitations; Modify supported identity connections and branding; Configure supported audit-log streams. Recorded permission boundary: Read/write eligible organization, user, connection, branding and stream settings.

What data-handling boundary should I consider?

Sensitive identity, organization and sign-in event data can be accessed by an authorized agent/client. Recorded sensitive-access context: Users and email addresses; SSO/directory configurations; Authentication and audit events.

What limitations and risks should I check before use?

Identity-management changes can affect real users and production access; restrict write and production access. Team administrators can independently disable MCP, production access or writes; all three controls are enabled by default. Agent cannot impersonate end-users or act on another team. MCP cannot mint or rotate API keys, OAuth secrets or signing certificates, delete the WorkOS team, or change its own MCP access settings. Dashboard member permission controls still apply; do not treat team OAuth as unrestricted access. WorkOS team admin access gates and excluded sensitive actions are important operational boundaries. No impersonation, credential rotation or team deletion via MCP. Production and write access are enabled at team level by default; configuration and runtime authorization were not tested.

What cost model is recorded?

The reviewed cost model is plan based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.