Skip to content
actionlake
Start free

Connectors · Identity & security

WorkOS MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to WorkOS and the rest of your systems. It gives your agent 259 WorkOS actions (107 reads, 98 writes and 54 that wait for a confirmation) and holds the WorkOS credential itself, so the agent never does. It paces WorkOS's limits and records every call.

Connect WorkOS freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "workos.users.list",  intent: "check which WorkOS account is connected"}# List users · read · 1 upstream call
  • 259actionsin one signed file
  • 107readlook, never change
  • 98writecreate and update
  • 54wait for a yesdestructive, confirmed first

Set up

Connect WorkOS in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect WorkOS.

    Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • api_keyWorkOS secret API key (starts with sk_)
    account { op: "connections.requirements", service: "workos" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "workos.users.list" }# list users · read · 1 upstream callcheck { action: "workos.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

WorkOS at a glance

Sign-in
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
api_key
Limits we pace to
6,000 calls a minute, per connection
API covered
WorkOS API (OpenAPI 3.1.1, workos/openapi-spec)api.workos.com
Built from
WorkOS's documentation, read 23 October 2026OpenAPI spec (GitHub)workos.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
86 of 107 reads, for up to 5 minutes; a write clears what it affects
Shared entities
4, so ask can line WorkOS up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in WorkOS.

259 actions in 75 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 107readlook, never change
  • 98writecreate and update
  • 54destructivewait for a confirmation

  1. Data integrations

    15

    3 read · 10 write · 2 destructive

    Create a data integration · Create another API key connected account · Create another client credentials connected account · Get authorization URL

  2. Users

    14

    5 read · 7 write · 2 destructive

    List users · Create a user · Get a user · Update a user

  3. Authorization resources

    10

    5 read · 3 write · 2 destructive

    Create an authorization resource · List resources · List organization memberships for resource · List memberships for a resource by external ID

  4. Vault objects

    8

    5 read · 2 write · 1 destructive

    List objects · Create an object · Read an object by ID · Update an object

  5. Agent blueprints

    7

    3 read · 3 write · 1 destructive

    Create an agent blueprint · List agent blueprints · Mint an agent token · Validate an agent token

  6. Invitations

    7

    3 read · 3 write · 1 destructive

    Send an invitation · List invitations · Get an invitation · Resend an invitation

  7. Organization memberships

    7

    2 read · 3 write · 2 destructive

    Create an organization membership · List organization memberships · Get an organization membership · Reactivate an organization membership

  8. Organizations

    7

    4 read · 2 write · 1 destructive

    List Organizations · Create an Organization · Get an Organization · Update an Organization

67 more areas · 184 actions
  • Authorization group role assignments 6
  • Authorization role assignments 6
  • Applications 5
  • Authorization organization roles 5
  • Authorization permissions 5
  • Connections 5
  • Groups 5
  • It contacts 5
  • Organization connected accounts 5
  • User connected accounts 5
  • Agents 4
  • Auth factors 4
  • Authorization 4
  • Authorization roles 4
  • Directories 4
  • Feature flags 4
  • Organization domains 4
  • Radar 4
  • Waitlists 4
  • Webhook endpoints 4
  • Agent instance sessions 3
  • Agent instances 3
  • API keys 3
  • Application credentials 3
  • Authkit oauth resources 3
  • Authorization organization role permissions 3
  • Group memberships 3
  • Redirect uris 3
  • Saml idp signing certificates 3
  • Saml SP encryption certificates 3
  • Saml SP signing certificates 3
  • Vault keys 3
  • Waitlist entries 3
  • Audit log exports 2
  • Audit log schemas 2
  • Audit logs retention 2
  • Authorization role permissions 2
  • Authorized applications 2
  • Cors origins 2
  • Directory groups 2
  • Directory users 2
  • Flag targets 2
  • JWT templates 2
  • Magic auth 2
  • Organization API keys 2
  • Organization data integration configurations 2
  • Portal sessions 2
  • Radar challenges 2
  • SSO 2
  • Teams 2
  • User API keys 2
  • User auth factors 2
  • Audit log actions 1
  • Audit log events 1
  • Auth challenges 1
  • Authkit 1
  • Authkit external auth 1
  • Client API tokens 1
  • Events 1
  • Organization authorized applications 1
  • Organization feature flags 1
  • Organization membership groups 1
  • Sessions 1
  • User feature flags 1
  • User identities 1
  • User sessions 1
  • Widgets 1

Top actions

The WorkOS API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 53 of WorkOS's 53 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
workos.users.listList usersList users.readidentity.user.list474 connectors
workos.groups.listList groupsList groups.readidentity.group.list262 connectors
workos.authorization_roles.listList environment rolesList environment roles.readidentity.role.list184 connectors
workos.users.createCreate a userCreate a user.writeidentity.user.create262 connectors
workos.groups.createCreate a groupCreate a group.writeidentity.group.create205 connectors
workos.authorization_roles.createCreate an environment roleCreate an environment role.writeidentity.role.create105 connectors
workos.organizations.listList OrganizationsList Organizations.readcrm.company.list162 connectors
workos.users.deleteDelete a userDelete a user.destructiveidentity.user.delete253 connectors
workos.group_memberships.list_membersList Group membersList Group members.readidentity.group_member.list103 connectors
workos.organization_api_keys.createCreate an API key for an organizationCreate an API key for an organization.writeidentity.api_key.create100 connectors
workos.organizations.createCreate an OrganizationCreate an Organization.writecrm.company.create142 connectors
workos.invitations.createSend an invitationSend an invitation.writeidentity.invitation.create41 connectors

Try it

Prompts to paste into Claude.

Each one names the WorkOS actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    List the companies in WorkOS and flag likely duplicates by name or domain.

    callsworkos.organizations.list

  2. Writewrite

    Create a user in WorkOS. Show me exactly what you will send before you save it.

    callsworkos.users.create

  3. Across systemsread

    Which WorkOS companies have invoices in ConnectWise PSA, and how many each?

    callsworkos.organizations.listconnectwise_manage.invoices.list

Across your systems

WorkOS, joined to the rest of your business.

One ask fetches from WorkOS and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

  • Which WorkOS companies have invoices in ConnectWise PSA, and how many each?

    workos.organizations.list + connectwise_manage.invoices.list, on crm.company · ConnectWise PSA

  • Which WorkOS companies have invoices in NetSuite, and how many each?

    workos.organizations.list + netsuite.views.invoices, on crm.company · NetSuite

Also mapped by other connectorsidentity.user 517identity.group 239crm.company 227identity.role 107
ask
ask {  intent: "which WorkOS companies have invoices in ConnectWise PSA, and how many each",  steps: [    { action: "workos.organizations.list", as: "co", input: {}, limit: 100, max_pages: 5 },    { action: "connectwise_manage.invoices.list", as: "inv", input: {}, limit: 100, max_pages: 5 },    { join: {        left: "co",        right: "inv",        on: "crm.company",        group_by: "co.name",        select: ["co.name", "count(inv.id) as invoices"]    } }  ]}
Example. Run it through check first: it validates the steps and prices them, and it is free.

Governance for WorkOS

Destructive actions wait for a yes.

54 WorkOS actions are destructive. The first 10:

  • Delete a userworkos.users.delete
  • Delete a groupworkos.groups.delete
  • Delete an API keyworkos.api_keys.delete
  • Delete an Organizationworkos.organizations.delete
  • Delete a Connect Applicationworkos.applications.delete
  • Delete an Organization Domainworkos.organization_domains.delete
  • Delete an objectworkos.vault_objects.delete
  • Delete a Webhook Endpointworkos.webhook_endpoints.delete
  • Expire an API keyworkos.api_keys.expire
  • Revoke Sessionworkos.sessions.revoke

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

doworkos.users.deleteconfirm_policy: human

Delete a user?

intent: the user asked me to delete a user

run suspended · waiting for a named person · key workos-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "workos-agent",  allowed_actions: ["workos.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "workos.users.delete", approver: "[email protected]" },    { match: "workos.groups.delete", approver: "[email protected]" },    { match: "workos.api_keys.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to WorkOS only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What WorkOS costs on actionlake.

Every WorkOS action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call WorkOS refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 259 WorkOS actions
  • 259actions pageeach page of a long list is one call
  • 86reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every WorkOS action.

259 actions by area: the id your agent calls, what it does, and its effect.

Data integrations15
  • workos.data_integrations.createCreate a data integrationwrite
  • workos.data_integrations.create_api_key_connectionCreate another API key connected accountwrite
  • workos.data_integrations.create_client_credentials_connectionCreate another client credentials connected accountwrite
  • workos.data_integrations.deleteDelete a data integrationdestructive
  • workos.data_integrations.delete_organizationDelete an organization-owned data integrationdestructive
  • workos.data_integrations.getGet a data integrationread
  • workos.data_integrations.get_authorize_urlGet authorization URLwrite
  • workos.data_integrations.get_organizationGet an organization-owned data integrationread
  • workos.data_integrations.get_user_tokenGet an access token for a connected accountwrite
  • workos.data_integrations.listList data integrationsread
  • workos.data_integrations.updateUpdate a data integrationwrite
  • workos.data_integrations.update_organizationUpdate an organization-owned data integrationwrite
  • workos.data_integrations.upsert_api_key_connectionUpsert an API key for a connected accountwrite
  • workos.data_integrations.upsert_client_credentials_connectionUpsert client credentials for a connected accountwrite
  • workos.data_integrations.vend_credentialsVend credentials for a connected accountwrite
Users14
  • workos.users.confirm_email_changeConfirm email changewrite
  • workos.users.createCreate a userwrite
  • workos.users.create_password_resetCreate a password reset tokenwrite
  • workos.users.deleteDelete a userdestructive
  • workos.users.getGet a userread
  • workos.users.get_by_external_idGet a user by external IDread
  • workos.users.get_email_verificationGet an email verification coderead
  • workos.users.get_password_resetGet a password reset tokenread
  • workos.users.listList usersread
  • workos.users.reset_passwordReset the passworddestructive
  • workos.users.send_email_changeSend email change codewrite
  • workos.users.send_verification_emailSend verification emailwrite
  • workos.users.updateUpdate a userwrite
  • workos.users.verify_emailVerify emailwrite
Authorization resources10
  • workos.authorization_resources.createCreate an authorization resourcewrite
  • workos.authorization_resources.deleteDelete an authorization resourcedestructive
  • workos.authorization_resources.delete_by_external_idDelete an authorization resource by external IDdestructive
  • workos.authorization_resources.getGet a resourceread
  • workos.authorization_resources.get_by_external_idGet a resource by external IDread
  • workos.authorization_resources.listList resourcesread
  • workos.authorization_resources.list_organization_membershipsList organization memberships for resourceread
  • workos.authorization_resources.list_organization_memberships_by_external_idList memberships for a resource by external IDread
  • workos.authorization_resources.updateUpdate a resourcewrite
  • workos.authorization_resources.update_by_external_idUpdate a resource by external IDwrite
Vault objects8
  • workos.vault_objects.createCreate an objectwrite
  • workos.vault_objects.deleteDelete an objectdestructive
  • workos.vault_objects.getRead an object by IDread
  • workos.vault_objects.get_by_nameRead an object by nameread
  • workos.vault_objects.get_metadataDescribe an objectread
  • workos.vault_objects.listList objectsread
  • workos.vault_objects.list_versionsList object versionsread
  • workos.vault_objects.updateUpdate an objectwrite
Agent blueprints7
  • workos.agent_blueprints.createCreate an agent blueprintwrite
  • workos.agent_blueprints.deleteDelete an agent blueprintdestructive
  • workos.agent_blueprints.getGet an agent blueprintread
  • workos.agent_blueprints.listList agent blueprintsread
  • workos.agent_blueprints.mint_tokenMint an agent tokenwrite
  • workos.agent_blueprints.updateUpdate an agent blueprintwrite
  • workos.agent_blueprints.validate_tokenValidate an agent tokenread
Invitations7
  • workos.invitations.acceptAccept an invitationwrite
  • workos.invitations.createSend an invitationwrite
  • workos.invitations.getGet an invitationread
  • workos.invitations.get_by_tokenFind an invitation by tokenread
  • workos.invitations.listList invitationsread
  • workos.invitations.resendResend an invitationwrite
  • workos.invitations.revokeRevoke an invitationdestructive
Organization memberships7
  • workos.organization_memberships.createCreate an organization membershipwrite
  • workos.organization_memberships.deactivateDeactivate an organization membershipdestructive
  • workos.organization_memberships.deleteDelete an organization membershipdestructive
  • workos.organization_memberships.getGet an organization membershipread
  • workos.organization_memberships.listList organization membershipsread
  • workos.organization_memberships.reactivateReactivate an organization membershipwrite
  • workos.organization_memberships.updateUpdate an organization membershipwrite
Organizations7
  • workos.organizations.createCreate an Organizationwrite
  • workos.organizations.deleteDelete an Organizationdestructive
  • workos.organizations.getGet an Organizationread
  • workos.organizations.get_audit_log_configurationGet Audit Log Configurationread
  • workos.organizations.get_by_external_idGet an Organization by External IDread
  • workos.organizations.listList Organizationsread
  • workos.organizations.updateUpdate an Organizationwrite
Authorization group role assignments6
  • workos.authorization_group_role_assignments.createAssign a role to a groupdestructive
  • workos.authorization_group_role_assignments.getGet a group role assignmentread
  • workos.authorization_group_role_assignments.listList role assignments for a groupread
  • workos.authorization_group_role_assignments.removeRemove a group role assignmentdestructive
  • workos.authorization_group_role_assignments.remove_by_criteriaRemove group role assignments by criteriadestructive
  • workos.authorization_group_role_assignments.replaceReplace all role assignments for a groupwrite
Authorization role assignments6
  • workos.authorization_role_assignments.assignAssign a roledestructive
  • workos.authorization_role_assignments.listList role assignmentsread
  • workos.authorization_role_assignments.list_for_resourceList role assignments for a resourceread
  • workos.authorization_role_assignments.list_for_resource_by_external_idList role assignments for a resource by external IDread
  • workos.authorization_role_assignments.removeRemove a role assignment by IDdestructive
  • workos.authorization_role_assignments.remove_by_criteriaRemove a role assignmentdestructive
Applications5
  • workos.applications.createCreate a Connect Applicationwrite
  • workos.applications.deleteDelete a Connect Applicationdestructive
  • workos.applications.getGet a Connect Applicationread
  • workos.applications.listList Connect Applicationsread
  • workos.applications.updateUpdate a Connect Applicationwrite
Authorization organization roles5
  • workos.authorization_organization_roles.createCreate a custom rolewrite
  • workos.authorization_organization_roles.deleteDelete a custom roledestructive
  • workos.authorization_organization_roles.getGet a custom roleread
  • workos.authorization_organization_roles.listList custom rolesread
  • workos.authorization_organization_roles.updateUpdate a custom rolewrite
Authorization permissions5
  • workos.authorization_permissions.createCreate a permissionwrite
  • workos.authorization_permissions.deleteDelete a permissiondestructive
  • workos.authorization_permissions.getGet a permissionread
  • workos.authorization_permissions.listList permissionsread
  • workos.authorization_permissions.updateUpdate a permissionwrite
Connections5
  • workos.connections.createCreate a Connectionwrite
  • workos.connections.deleteDelete a Connectiondestructive
  • workos.connections.getGet a Connectionread
  • workos.connections.listList Connectionsread
  • workos.connections.updateUpdate a Connectionwrite
Groups5
  • workos.groups.createCreate a groupwrite
  • workos.groups.deleteDelete a groupdestructive
  • workos.groups.getGet a groupread
  • workos.groups.listList groupsread
  • workos.groups.updateUpdate a groupwrite
It contacts5
  • workos.it_contacts.createCreate an IT contactwrite
  • workos.it_contacts.deleteDelete an IT contactdestructive
  • workos.it_contacts.inviteInvite an IT contactwrite
  • workos.it_contacts.listList IT contactsread
  • workos.it_contacts.revokeRevoke an IT contact's invitationdestructive
Organization connected accounts5
  • workos.organization_connected_accounts.createImport an organization connected accountwrite
  • workos.organization_connected_accounts.deleteDelete an organization connected accountdestructive
  • workos.organization_connected_accounts.getGet an organization connected accountread
  • workos.organization_connected_accounts.list_providersList providers for an organizationread
  • workos.organization_connected_accounts.updateUpdate an organization connected accountwrite
User connected accounts5
  • workos.user_connected_accounts.createImport a connected accountwrite
  • workos.user_connected_accounts.deleteDelete a connected accountdestructive
  • workos.user_connected_accounts.getGet a connected accountread
  • workos.user_connected_accounts.list_providersList providers for a userread
  • workos.user_connected_accounts.updateUpdate a connected accountwrite
Agents4
  • workos.agents.get_registrationGet an agent registrationread
  • workos.agents.link_claim_attemptLink a claim attempt to an external userwrite
  • workos.agents.revoke_registrationRevoke an agent registrationdestructive
  • workos.agents.validate_credentialValidate an agent credentialread
Auth factors4
  • workos.auth_factors.challengeChallenge Factorwrite
  • workos.auth_factors.createEnroll Factorwrite
  • workos.auth_factors.deleteDelete Factordestructive
  • workos.auth_factors.getGet Factorread
Authorization4
  • workos.authorization.checkCheck authorizationread
  • workos.authorization.list_effective_permissionsList effective permissions for an organization membership on a resourceread
  • workos.authorization.list_effective_permissions_by_external_idList effective permissions for an organization membership on a resource by external IDread
  • workos.authorization.list_resources_for_membershipList resources for organization membershipread
Authorization roles4
  • workos.authorization_roles.createCreate an environment rolewrite
  • workos.authorization_roles.getGet an environment roleread
  • workos.authorization_roles.listList environment rolesread
  • workos.authorization_roles.updateUpdate an environment rolewrite
Directories4
  • workos.directories.deleteDelete a Directorydestructive
  • workos.directories.getGet a Directoryread
  • workos.directories.listList Directoriesread
  • workos.directories.syncSync a Directorywrite
Feature flags4
  • workos.feature_flags.disableDisable a feature flagwrite
  • workos.feature_flags.enableEnable a feature flagwrite
  • workos.feature_flags.getGet a feature flagread
  • workos.feature_flags.listList feature flagsread
Organization domains4
  • workos.organization_domains.createCreate an Organization Domainwrite
  • workos.organization_domains.deleteDelete an Organization Domaindestructive
  • workos.organization_domains.getGet an Organization Domainread
  • workos.organization_domains.verifyVerify an Organization Domainwrite
Radar4
  • workos.radar.add_list_entryAdd an entry to a Radar listwrite
  • workos.radar.assessCreate an attemptwrite
  • workos.radar.remove_list_entryRemove an entry from a Radar listdestructive
  • workos.radar.update_attemptUpdate a Radar attemptwrite
Waitlists4
  • workos.waitlists.create_entryCreate a waitlist entrywrite
  • workos.waitlists.getGet a waitlistread
  • workos.waitlists.listList waitlistsread
  • workos.waitlists.list_entriesList waitlist entriesread
Webhook endpoints4
  • workos.webhook_endpoints.createCreate a Webhook Endpointwrite
  • workos.webhook_endpoints.deleteDelete a Webhook Endpointdestructive
  • workos.webhook_endpoints.listList Webhook Endpointsread
  • workos.webhook_endpoints.updateUpdate a Webhook Endpointwrite
Agent instance sessions3
  • workos.agent_instance_sessions.getGet an agent instance sessionread
  • workos.agent_instance_sessions.listList agent instance sessionsread
  • workos.agent_instance_sessions.revokeRevoke an agent instance sessiondestructive
Agent instances3
  • workos.agent_instances.deleteDelete an agent instancedestructive
  • workos.agent_instances.getGet an agent instanceread
  • workos.agent_instances.listList agent instancesread
API keys3
  • workos.api_keys.deleteDelete an API keydestructive
  • workos.api_keys.expireExpire an API keydestructive
  • workos.api_keys.validateValidate API keyread
Application credentials3
  • workos.application_credentials.createCreate a new client secret for a Connect Applicationwrite
  • workos.application_credentials.deleteDelete a Client Secretdestructive
  • workos.application_credentials.listList Client Secrets for a Connect Applicationread
Authkit oauth resources3
  • workos.authkit_oauth_resources.createCreate an MCP resource indicatorwrite
  • workos.authkit_oauth_resources.deleteDelete an MCP resource indicatordestructive
  • workos.authkit_oauth_resources.listList MCP resource indicatorsread
Authorization organization role permissions3
  • workos.authorization_organization_role_permissions.add_permissionAdd a permission to a custom roledestructive
  • workos.authorization_organization_role_permissions.remove_permissionRemove a permission from a custom roledestructive
  • workos.authorization_organization_role_permissions.set_permissionsSet permissions for a custom roledestructive
Group memberships3
  • workos.group_memberships.add_memberAdd a member to a Groupwrite
  • workos.group_memberships.list_membersList Group membersread
  • workos.group_memberships.remove_memberRemove a member from a Groupdestructive
Redirect uris3
  • workos.redirect_uris.createCreate a redirect URIwrite
  • workos.redirect_uris.deleteDelete a redirect URIdestructive
  • workos.redirect_uris.listList redirect URIsread
Saml idp signing certificates3
  • workos.saml_idp_signing_certificates.createCreate an IdP signing certificatewrite
  • workos.saml_idp_signing_certificates.deleteDelete an IdP signing certificatedestructive
  • workos.saml_idp_signing_certificates.listList IdP signing certificatesread
Saml SP encryption certificates3
  • workos.saml_sp_encryption_certificates.createCreate an SP encryption certificatewrite
  • workos.saml_sp_encryption_certificates.deleteDelete an SP encryption certificatedestructive
  • workos.saml_sp_encryption_certificates.listList SP encryption certificatesread
Saml SP signing certificates3
  • workos.saml_sp_signing_certificates.createCreate an SP signing certificatewrite
  • workos.saml_sp_signing_certificates.deleteDelete the SP signing certificatedestructive
  • workos.saml_sp_signing_certificates.getGet the SP signing certificateread
Vault keys3
  • workos.vault_keys.create_data_keyCreate a data keywrite
  • workos.vault_keys.decryptDecrypt a data keyread
  • workos.vault_keys.rekeyRe-encrypt a data keywrite
Waitlist entries3
  • workos.waitlist_entries.approveApprove a waitlist entrywrite
  • workos.waitlist_entries.deleteDelete a waitlist entrydestructive
  • workos.waitlist_entries.denyDeny a waitlist entrywrite
Audit log exports2
  • workos.audit_log_exports.createCreate Exportwrite
  • workos.audit_log_exports.getGet Exportread
Audit log schemas2
  • workos.audit_log_schemas.createCreate Schemawrite
  • workos.audit_log_schemas.listList Schemasread
Audit logs retention2
  • workos.audit_logs_retention.getGet Retentionread
  • workos.audit_logs_retention.updateSet Retentionwrite
Authorization role permissions2
  • workos.authorization_role_permissions.add_permissionAdd a permission to an environment roledestructive
  • workos.authorization_role_permissions.set_permissionsSet permissions for an environment roledestructive
Authorized applications2
  • workos.authorized_applications.deleteDelete an authorized applicationdestructive
  • workos.authorized_applications.listList authorized applicationsread
Cors origins2
  • workos.cors_origins.createCreate a CORS originwrite
  • workos.cors_origins.listList CORS originsread
Directory groups2
  • workos.directory_groups.getGet a Directory Groupread
  • workos.directory_groups.listList Directory Groupsread
Directory users2
  • workos.directory_users.getGet a Directory Userread
  • workos.directory_users.listList Directory Usersread
Flag targets2
  • workos.flag_targets.createAdd a feature flag targetwrite
  • workos.flag_targets.deleteRemove a feature flag targetdestructive
JWT templates2
  • workos.jwt_templates.getGet JWT templateread
  • workos.jwt_templates.updateUpdate JWT templatewrite
Magic auth2
  • workos.magic_auth.createCreate a Magic Auth codewrite
  • workos.magic_auth.getGet Magic Auth code detailsread
Organization API keys2
  • workos.organization_api_keys.createCreate an API key for an organizationwrite
  • workos.organization_api_keys.listList API keys for an organizationread
Organization data integration configurations2
  • workos.organization_data_integration_configurations.listList providers for an organizationread
  • workos.organization_data_integration_configurations.updateConfigure a provider for an organizationwrite
Portal sessions2
  • workos.portal_sessions.createGenerate a Portal Linkwrite
  • workos.portal_sessions.revoke_linkRevoke a Portal Linkdestructive
Radar challenges2
  • workos.radar_challenges.createSend a Radar SMS challengewrite
  • workos.radar_challenges.getGet Radar Challenge detailsread
SSO2
  • workos.sso.get_jwksGet JWKSread
  • workos.sso.logout_authorizeLogout Authorizewrite
Teams2
  • workos.teams.createCreate a teamwrite
  • workos.teams.getGet a teamread
User API keys2
  • workos.user_api_keys.createCreate an API key for a userwrite
  • workos.user_api_keys.listList API keys for a userread
User auth factors2
  • workos.user_auth_factors.createEnroll an authentication factorwrite
  • workos.user_auth_factors.listList authentication factorsread
Audit log actions1
  • workos.audit_log_actions.listList Actionsread
Audit log events1
  • workos.audit_log_events.createCreate Eventwrite
Auth challenges1
  • workos.auth_challenges.verifyVerify Challengewrite
Authkit1
  • workos.authkit.authorize_deviceGet device authorization URLwrite
Authkit external auth1
  • workos.authkit_external_auth.complete_loginComplete external authenticationwrite
Client API tokens1
  • workos.client_api_tokens.create_tokenGenerate a Client API tokenwrite
Events1
  • workos.events.listList eventsread
Organization authorized applications1
  • workos.organization_authorized_applications.listList authorized applicationsread
Organization feature flags1
  • workos.organization_feature_flags.listList enabled feature flags for an organizationread
Organization membership groups1
  • workos.organization_membership_groups.listList groupsread
Sessions1
  • workos.sessions.revokeRevoke Sessiondestructive
User feature flags1
  • workos.user_feature_flags.listList enabled feature flags for a userread
User identities1
  • workos.user_identities.listGet user identitiesread
User sessions1
  • workos.user_sessions.listList sessionsread
Widgets1
  • workos.widgets.create_tokenGenerate a widget tokenwrite

Questions

The WorkOS MCP server, answered.

Is there a WorkOS MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 259 WorkOS actions across data integrations, users, authorization resources and vault objects, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by WorkOS.

What do I need to connect WorkOS?

WorkOS secret API key (starts with sk_). The free call account { op: "connections.requirements", service: "workos" } lists exactly what to paste.

Can an AI agent delete or change things in WorkOS?

Only if its key allows it, and only with an explicit confirmation. 54 WorkOS actions are destructive, including delete a user, delete a group and delete an API key. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my WorkOS API limit?

actionlake paces every call to the limits in the WorkOS service file: 6,000 calls a minute per connection. Repeated reads are answered from cache (86 WorkOS actions can be), which never reaches WorkOS.

What does a WorkOS action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (259 WorkOS actions page). Cache hits, searches, dry runs and calls WorkOS refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which WorkOS API does it cover?

The WorkOS API (OpenAPI 3.1.1, workos/openapi-spec) at api.workos.com. It is built from WorkOS's documentation as read on 23 October 2026. 259 actions in 75 areas, each one in the signed service file (version 1.0.0).

Can I combine WorkOS with my other systems?

Yes. ask joins WorkOS to ConnectWise PSA or NetSuite on the same customer and returns the answer rather than every row. WorkOS maps crm.company, which 227 other connectors also map.

Does actionlake keep my WorkOS data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your WorkOS credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like WorkOS

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by WorkOS; the name is the vendor's own. Counts are from the WorkOS service file, version 1.0.0.

Give your agent WorkOS today.

Connect WorkOS freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.