by WorkOS
Updated July 29, 2026 · Reviewed July 24, 2026
MCP100 verdict
No longer recommended. WorkOS MCP is a source-backed candidate, but MCP100 does not recommend it until the stated evidence gaps are resolved.
MCP100 Assessment
Editorial verdict
Reviewed 2026-07-24 · Next review 2026-09-24
Task Fit
Mapped
Developer workflows
Trust
Status warning
Candidate does not meet Selected or Watchlist requirements.
Maintenance
Date unavailable
No dated repository or package update is currently stored.
Popularity
Signals unavailable
No independently comparable adoption metric is currently stored.
Evidence scope
No MCP-specific repository metric is stored
No MCP-specific package metric is stored
Stars observation date unavailable · Downloads observation date unavailable
No public repository is mapped to the reviewed MCP.
No public package data is mapped to the reviewed MCP.
Publisher activity observed 2026-07-29T02:23:36.769Z
Current source snapshot
Source relationship: First-party MCP
Reviewed 2026-07-24 · Next review 2026-09-24
Evidence-backed setup
Choose your MCP client. A client connects to the MCP server; the language model is selected inside that client. Only stored, source-backed configurations are shown.
Transport not recorded
No sufficient client-specific setup evidence has been stored from the publisher or client documentation.
Publisher-documented setup is not the same as MCP100 execution testing. “MCP100 logic checked” means the stored configuration shape was reviewed, not that third-party MCP software was run.
Evidence checked 2026-07-24
Loading optional publisher installation details…
No complete evidence-backed client setup steps are currently stored. Optional publisher documentation may provide additional context below.
Capability
Connect compatible AI clients to WorkOS's documented MCP capabilities.
Not measured yet
Estimated token footprint of the MCP tool schemas exposed to the agent.
Reviewed access
Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.
Related reviewed MCPs
Retrieve current library and framework documentation for coding agents.
Choose this instead if
Choose Context7 MCP instead if current library and API documentation inside coding agents.
Retrieve current library and framework documentation for coding agents.
Discover and run MCP servers through Docker's MCP gateway.
Choose this instead if
Choose Docker MCP Gateway instead if running multiple MCP servers behind one stdio connection.
Discover and run MCP servers through Docker's MCP gateway.
Work with repositories, issues, pull requests, and GitHub workflows.
Choose this instead if
Choose GitHub MCP instead if repository, issue, pull-request, and code context.
Work with repositories, issues, pull requests, and GitHub workflows.
WorkOS is listed as First-party MCP in MCP100’s current evidence.
Current official resources:
From the publisher README
Original client setup and configuration retained from the publisher documentation.
Publisher-documented clients
These names appear in the publisher's installation documentation. MCP100-verified configurations are shown separately above when available.
If Codex reports MCP startup interrupted. The following servers were not initialized: workos, the server may be configured but not authenticated.
codex mcp get workos from the project where you expect the server to be available. If Codex cannot find it, check that you are in the intended repository and that Codex trusts the project, or use the user-global setup above.codex mcp login workos and complete the WorkOS consent flow in your browser.codex mcp list to verify the server endpoint and OAuth authentication type.Run browser, credential-store, and certificate-sensitive authentication commands from your normal host shell. An authentication failure that occurs only inside an isolated agent environment does not prove that the WorkOS MCP server is unavailable.
If authentication succeeds but WorkOS access remains disabled, ask a team admin to check the WorkOS MCP controls in the team authentication settings.
Original product, capability, tool, and usage documentation from the MCP publisher. Installation sections appear under Install & Agents.
Title: WorkOS MCP Server – WorkOS Docs
URL Source: https://workos.com/docs/mcp
Published Time: 2026-09-04
Markdown Content: Home
Manage your WorkOS workspace with AI agents. The WorkOS MCP server lets any Model Context Protocol client manage organizations, users, SSO connections, and more.
The WorkOS MCP server is a remote management Model Context Protocol server that lets MCP-compatible AI agents act on your WorkOS workspace. Once connected, your agent can read and change the same dashboard data you can (managing organizations, connections, users, branding, and more) by calling the WorkOS API on your behalf.
If you are instead building your own MCP server and want to secure it with OAuth, see AuthKit for MCP.
The MCP server acts as you: it inherits your dashboard role and can only do what your account is allowed to do. See Permissions for details.
Every client connects over streamable HTTP and authenticates with OAuth using WorkOS Connect. The first time you connect, your client opens a WorkOS consent screen where you sign in and approve access. After you approve, the agent is connected as your account.
Pick your client below for setup steps.
The MCP server never grants more access than you already have.
When you connect, the agent authenticates as your dashboard account and assumes your exact role and permissions. Every operation runs through the same access controls that govern the dashboard, so the agent can only read and change what you can. A member without admin rights can’t use the agent to perform admin-only actions, and a read-only role can’t make any changes at all.
The agent works against one environment at a time, so it can’t accidentally change the wrong one. It defaults to a sandbox environment and only operates on production when you direct it to. Switching to production never escalates your access. The agent can only reach environments you already have access to in the dashboard, and your team’s admins can block production entirely.
Irreversible operations, like deleting an organization, connection, or directory, aren’t executed on the first attempt. Instead, the agent receives a description of exactly what the operation will destroy and must explicitly confirm before it runs. This gives you a chance to review the consequences, so a single ambiguous prompt can’t wipe out data.
Values like API keys and client secrets are stripped from responses before they ever reach the agent, so they can’t leak into its context or be echoed back in a chat transcript. Stripping only applies to returned values, so the agent can still set a secret value you provide without being able to read existing ones back.
Team admins can restrict or completely disable MCP access for the whole team from the team authentication settings page. Three settings can be toggled independently, and all are enabled by default:
Enable: Allow this team to access the WorkOS dashboard over MCP. Turning this off disables MCP for the team entirely, which also disables the two settings below.
Allow production access: Allow agents to access production environments. When off, MCP can only reach sandbox environments. This never escalates anyone’s permissions: agents can still only reach production for members who already have production access in the dashboard.
Allow write access: Allow agents to perform write operations. When off, MCP is restricted to read-only operations.
Connect an agent and describe what you want in plain language. The agent discovers the right operations and runs them for you. Here are a few examples.
Brand your sign-in page from a screenshot
Debug a sign-in problem
Onboard a new customer
Understand your users
Manage a user
Audit your configuration
Stream audit logs
These are just starting points. Try to give agents tasks that you typically do in the dashboard.
Some dashboard capabilities are intentionally unavailable over MCP.
No impersonation. The dashboard’s user impersonation isn’t exposed to agents, and mutations are blocked on impersonated sessions. An agent always acts as you. It can’t act as one of your users.
Not every dashboard action. The agent works with the operations WorkOS has enabled for MCP (managing organizations, connections, users, branding, and more), but the most sensitive actions are intentionally left out. It can’t change the MCP access settings that govern its own access, mint or rotate credentials such as API keys, OAuth client secrets, and signing certificates, or delete your WorkOS team.
One team at a time. The agent is scoped to the team you authenticate with. It can’t read or change resources belonging to another team.