Connect the WorkOS MCP server to Unblocked to give AI agents live authentication and SSO context

Enterprise auth bugs rarely live in the code alone. Whether a customer’s SSO connection is active, how their directory syncs, and which roles their users hold all sit in the WorkOS dashboard, so an agent debugging a login failure can’t see the configuration it depends on. WorkOS’s MCP server exposes that workspace data to AI agents, and Unblocked connects to it once so every agent can ask about an organization without its own WorkOS setup.

This is a third-party MCP server: WorkOS hosts and maintains it, and Unblocked connects to it as a verified MCP server. Nothing is ingested or indexed — Unblocked calls the read-only tools you select at the moment a question needs them, so answers reflect each organization’s connections and users as WorkOS holds them now.

Wiring WorkOS’s MCP server straight into an agent lets it look up an organization. Unblocked’s Context Engine reasons across those results and your other sources — following a customer’s inactive SSO connection to the support ticket that reported it, the pull request that changed your callback handling, and the Slack thread about the rollout — and returns one cited answer.

Once connected, any MCP-compatible coding agent — Claude Code, Cursor, Devin, GitHub Copilot, Codex — reaches WorkOS context through a single Unblocked MCP server connection.

What you get

• Live organization and connection data — Agents read organizations, SSO connections, directories, users, and roles from WorkOS’s own MCP server, as they are configured right now.
• Secrets stay out of answers — WorkOS strips secret values such as API keys and client secrets from responses before they reach an agent, so auth context arrives without credentials.
• Read-only, query-only tool control — Only read-only tools are offered, so agents can query WorkOS but never mutate an organization, connection, or user. Choose which tools Unblocked may call from Settings → Data Sources.
• Context Engine reasoning — WorkOS results are reconciled with your code, pull requests, tickets, and conversations, so a customer’s auth problem leads to the change behind it — with citations.

Prerequisites

• An Unblocked account (free to start).
• A WorkOS team with MCP access enabled by a team admin, and a dashboard role that can read the environments, organizations, and users you want agents to query.
• An MCP-compatible coding agent (Claude Code, Cursor, Devin, etc.) to use the context in your editor.

Step 1: Connect WorkOS to Unblocked

1. In Unblocked, go to Settings → Data Sources → Connect another data source, and under Cloud Infrastructure select WorkOS.
2. The WorkOS MCP server URL is filled in for you. Choose OAuth, click Connect, and sign in to WorkOS to authorize Unblocked.
3. Once Unblocked discovers the server’s tools, select the read-only tools it may use and click Save Settings.

Step 2: Install the Unblocked MCP server

On macOS or Linux, one command auto-detects and configures the supported agents on your machine:

On Windows, or when you prefer remote MCP, add the server manually using the configuration below, or follow the manual install guide .

claude mcp add -s user --transport http unblocked https://getunblocked.com/api/mcpsse

{
  "mcpServers": {
    "unblocked": {
      "url": "https://getunblocked.com/api/mcpsse"
    }
  }
}

https://getunblocked.com/api/mcpsse

WorkOS hosts and maintains this MCP server. Unblocked calls only the read-only tools you select, at the moment a question needs them:

• whoamiReturns the WorkOS account and team the connection is acting as.
• list_operationsReturns the WorkOS API operations available to the connection, so a query targets the right operation.
• queryRuns a read operation against your WorkOS workspace — such as organizations, SSO connections, directories, users, or audit logs — and returns the result.

To give Claude Code, Cursor, GitHub Copilot, Codex, or another MCP-compatible AI coding agent access to WorkOS context, connect WorkOS to Unblocked and add the single Unblocked MCP server to your agent.

Unblocked acts as the MCP context layer for your WorkOS data, searching organizations and users alongside your other connected sources and returning cited results through these tools:

• context_researchResearches a question across your connected sources and calls the WorkOS tools you selected when organizations, SSO connections, directories, or users are relevant, returning a synthesized answer with citations.
• context_get_urlsFetches the full content behind URLs your agent encounters across connected sources — Jira, Linear, Notion, Confluence, Slack, GitHub, and more.

Questions you (or your agent) can ask Unblocked about your WorkOS data:

• Is this customer’s SSO connection active in WorkOS, and is there a support ticket about their login failures?
• Which organizations use Directory Sync, and which pull request last changed how we handle directory events?
• What roles does this user hold in WorkOS, and does our permission check in code match them?
• Why did we move this organization to a new SSO connection, and was there a Slack thread about it?