WorkOS
by WorkOS
Manage a WorkOS workspace from your AI assistant. Four tools, but one of them is a bare mutate verb onto an identity platform — 28 API resource groups and 240 documented operations, 29 of them deletes. WorkOS answers with sandbox-by-default, destructive confirmation and three admin kill switches.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect WorkOS via MCP
https://mcp.workos.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
WorkOS Tools & Capabilities (4)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- The tool count does not measure the surface. Four tools front 28 API resource groups and 240 documented leaf operations, counted from WorkOS's docs index on 2026-08-19. Review the API reference, not the tool list.
- The exact write allowlist is not published. WorkOS says the agent works with the operations it has enabled for MCP and that the most sensitive actions are left out, but does not enumerate the enabled set. We did not test which of the 240 operations
mutatedispatches. - The directory record has no permissions label. Anthropic's snapshot carries no permissions field at all for this connector, in front of a bare
mutateverb on an identity platform. - OAuth offers no least-privilege option.
scopes_supportedis an empty array on the descriptor; the authorization server offers onlyemail,profile,openidandoffline_access. The read/write split exists, but as a dashboard role and a team admin toggle, not a scope. - Production is reachable. The default is sandbox and WorkOS says production requires direction, but a connected account with production dashboard access can get there unless an admin has turned
- We could not verify tool behaviour ourselves. The endpoint returned HTTP 401 to an anonymous
initializeon 2026-08-19, so no schemas and no safety annotations were readable. WorkOS publishes no tool descriptions either, so the tool table's job column is inference from the names. - Prompts are unconfirmed. Anthropic's snapshot lists no prompt names, and the gated endpoint blocked our own
prompts/list, so we cannot say whether the server serves any. - Impersonation is blocked, deliberately. WorkOS states the dashboard's user impersonation is not exposed to agents and mutations are blocked on impersonated sessions. The agent always acts as you.
- Some actions are carved out entirely. WorkOS states the agent cannot change the MCP access settings governing itself, mint or rotate API keys, OAuth client secrets and signing certificates, or delete your WorkOS team. It is also scoped to one team.
- Rate limits are shared with the API. WorkOS documents 6,000 requests per 60 seconds per API key across all environments, with tighter per-path limits — 4 requests/second per directory on directory users, 50 per 60 seconds on organization deletes. A 429 is the signal.
Frequently asked questions
How many things can the WorkOS MCP server actually do?
Far more than its four tools suggest. One tool is a bare `mutate` verb and another is `query`, and WorkOS's own machine-readable docs index enumerates 28 API resource groups and 240 leaf operations behind them — organizations, users, SSO connections, directories, roles, MFA factors and audit logs. The tool count measures the dispatcher, not the surface it reaches.
Can the WorkOS connector delete users or SSO connections?
It can reach deletes, but not silently. WorkOS's API reference documents 29 delete, revoke or deactivate operations, including deleting a user, an SSO connection and a directory. WorkOS states that irreversible operations are not run on first attempt: the agent is handed a description of what would be destroyed and must confirm explicitly before execution.
Can the WorkOS MCP server reach my production environment?
Only if you direct it there, and only if an admin allows it. WorkOS documents that the agent works against one environment at a time and defaults to sandbox, operating on production only when told to. A team-level Allow production access toggle can restrict MCP to sandbox entirely, and switching environments never escalates the account's existing access.
What identity does the WorkOS MCP server act as?
Your dashboard account, not a workspace-wide machine credential. WorkOS documents that the agent authenticates as you and assumes your exact dashboard role, with every operation running through the same access controls as the dashboard. A read-only role cannot make changes through the agent, and a non-admin cannot perform admin-only actions.
What OAuth scopes does the WorkOS MCP server ask for?
None that narrow access. Its RFC 9728 descriptor publishes `scopes_supported` as an explicitly empty array, verified live on 2026-08-19. The authorization server at `signin.workos.com` supports only `email`, `profile`, `openid` and `offline_access` — identity and refresh scopes. Nothing in the grant distinguishes read from write; that split lives in dashboard roles and admin toggles instead.
What can the WorkOS agent not do?
WorkOS documents four carve-outs. It cannot impersonate your end users, and mutations are blocked on impersonated sessions. It cannot change the MCP access settings governing itself, mint or rotate API keys, OAuth client secrets and signing certificates, or delete your WorkOS team. It is scoped to one team, and existing secret values are stripped from responses.
Sources
- WorkOS MCP server documentation — https://workos.com/docs/mcp (fetched 2026-08-19 as Markdown via the
.mdsuffix; this is thedocumentationURL Anthropic's directory publishes. Source for role inheritance, environment scope, destructive confirmation, secret stripping, admin toggles, limitations and example prompts) · retrieved 2026-08-19 - WorkOS docs machine index — https://workos.com/docs/llms.txt (fetched 2026-08-19; the 28-resource-group, 240-leaf-operation and 29-delete counts are derived from its API Reference section) · retrieved 2026-08-19
- WorkOS dashboard authentication settings — https://workos.com/docs/dashboard/authentication (fetched 2026-08-19; independently confirms the three team-level MCP toggles, all enabled by default) · retrieved 2026-08-19
- WorkOS API rate limits — https://workos.com/docs/reference/rate-limits (fetched 2026-08-19; 6,000 requests/60s per API key across all environments, plus per-path exceptions) · retrieved 2026-08-19
workos.com/robots.txtis a bareAllow: /naming the sitemap, with noContent-Signalheader on any axis (fetched 2026-08-19) · retrieved 2026-08-19- Live RFC 9728 protected-resource descriptor — https://mcp.workos.com/.well-known/oauth-protected-resource and the path-append form
…/oauth-protected-resource/mcp(both fetched 2026-08-19, byte-identical at 155 bytes,scopes_supported: []; the path-insert form returns 404) · retrieved 2026-08-19 - Live RFC 8414 authorization-server metadata — https://mcp.workos.com/.well-known/oauth-authorization-server and https://signin.workos.com/.well-known/oauth-authorization-server (both fetched 2026-08-19, byte-identical; issuer
https://signin.workos.com) · retrieved 2026-08-19 - Live anonymous probe — 2026-08-19: an
initializePOST to the endpoint returns HTTP 401{"error":"unauthorized"}withwww-authenticate: Bearer … resource_metadata="…/oauth-protected-resource/mcp". We did not authenticate and called no tool · retrieved 2026-08-19 - Anthropic connector directory — https://claude.ai/directory/d3b03e81-aeaa-42bf-9c52-5270d5273b2d (snapshot 2026-08-16; four tool names, no
permissionsfield present, no prompt names listed) · retrieved 2026-08-16
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Productivity
- Developer
- WorkOS
- Tools
- 4
- Domain
- mcp.workos.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.