# Connect the WorkOS MCP server to Unblocked to give AI agents live authentication and SSO context URL: https://getunblocked.com/integrations/workos/ Unblocked connects to WorkOS’s MCP server so AI coding agents can query your organizations, SSO connections, directories, and users live — then its Context Engine reconciles what they find with the code, pull requests, and conversations behind your auth setup. --- ## WorkOS integration details - **Category:** Cloud Infrastructure - **Live-queried data:** organizations, users - **Supported products:** AuthKit · SSO · Directory Sync · Audit Logs - **Works with:** Claude Code, Cursor, Devin, GitHub Copilot, Codex, OpenCode, VS Code — via one MCP server connection - **Maintained by:** WorkOS · verified by Unblocked - **Content reviewed:** October 20, 2026 - **Website:** ## What the WorkOS integration adds Enterprise auth bugs rarely live in the code alone. Whether a customer’s SSO connection is active, how their directory syncs, and which roles their users hold all sit in the WorkOS dashboard, so an agent debugging a login failure can’t see the configuration it depends on. WorkOS’s MCP server exposes that workspace data to AI agents, and Unblocked connects to it once so every agent can ask about an organization without its own WorkOS setup. This is a third-party MCP server: WorkOS hosts and maintains it, and Unblocked connects to it as a verified MCP server. Nothing is ingested or indexed — Unblocked calls the read-only tools you select at the moment a question needs them, so answers reflect each organization’s connections and users as WorkOS holds them now. Wiring WorkOS’s MCP server straight into an agent lets it look up an organization. Unblocked’s Context Engine reasons across those results and your other sources — following a customer’s inactive SSO connection to the support ticket that reported it, the pull request that changed your callback handling, and the Slack thread about the rollout — and returns one cited answer. Once connected, any MCP-compatible coding agent — Claude Code, Cursor, Devin, GitHub Copilot, Codex — reaches WorkOS context through a single Unblocked MCP server connection. ### What you get - **Live organization and connection data** — Agents read organizations, SSO connections, directories, users, and roles from WorkOS’s own MCP server, as they are configured right now. - **Secrets stay out of answers** — WorkOS strips secret values such as API keys and client secrets from responses before they reach an agent, so auth context arrives without credentials. - **Read-only, query-only tool control** — Only read-only tools are offered, so agents can query WorkOS but never mutate an organization, connection, or user. Choose which tools Unblocked may call from Settings → Data Sources. - **Context Engine reasoning** — WorkOS results are reconciled with your code, pull requests, tickets, and conversations, so a customer’s auth problem leads to the change behind it — with citations. ## How to connect WorkOS to Unblocked Prerequisites: - An Unblocked account (free to start). - A WorkOS team with MCP access enabled by a team admin, and a dashboard role that can read the environments, organizations, and users you want agents to query. - An MCP-compatible coding agent (Claude Code, Cursor, Devin, etc.) to use the context in your editor. ### Step 1: Connect WorkOS to Unblocked 1. In Unblocked, go to Settings → Data Sources → Connect another data source, and under Cloud Infrastructure select WorkOS. 2. The WorkOS MCP server URL is filled in for you. Choose OAuth, click Connect, and sign in to WorkOS to authorize Unblocked. 3. Once Unblocked discovers the server’s tools, select the read-only tools it may use and click Save Settings. ### Step 2: Install the Unblocked MCP server On macOS or Linux, one command auto-detects and configures the supported agents on your machine: ```bash curl -fsSL https://getunblocked.com/install-mcp.sh | bash ``` On Windows, or when you prefer remote MCP, add the server manually using the configuration below or follow the manual install guide: Claude Code — add the remote server, then run /mcp in Claude Code, select unblocked, and log in via OAuth: ```bash claude mcp add -s user --transport http unblocked https://getunblocked.com/api/mcpsse ``` Cursor — open View: Open MCP Settings → Add Custom MCP, add the server, then click Connect to authenticate via OAuth: ```json { "mcpServers": { "unblocked": { "url": "https://getunblocked.com/api/mcpsse" } } } ``` Any MCP-compatible client (Devin, Codex, VS Code, Claude Desktop, and others) can connect to the remote server with OAuth: `https://getunblocked.com/api/mcpsse` ## WorkOS MCP server tools WorkOS hosts and maintains this MCP server. Unblocked calls only the read-only tools you select, at the moment a question needs them: - **`whoami`** — Returns the WorkOS account and team the connection is acting as. - **`list_operations`** — Returns the WorkOS API operations available to the connection, so a query targets the right operation. - **`query`** — Runs a read operation against your WorkOS workspace — such as organizations, SSO connections, directories, users, or audit logs — and returns the result. ## Connect WorkOS to Claude Code, Cursor, and other AI agents To give Claude Code, Cursor, GitHub Copilot, Codex, or another MCP-compatible AI coding agent access to WorkOS context, connect WorkOS to Unblocked and add the single Unblocked MCP server to your agent. Unblocked acts as the MCP context layer for your WorkOS data, searching organizations and users alongside your other connected sources and returning cited results through these tools: - **`context_research`** — Researches a question across your connected sources and calls the WorkOS tools you selected when organizations, SSO connections, directories, or users are relevant, returning a synthesized answer with citations. - **`context_get_urls`** — Fetches the full content behind URLs your agent encounters across connected sources — Jira, Linear, Notion, Confluence, Slack, GitHub, and more. ## Questions to ask an AI agent about WorkOS Questions you (or your agent) can ask Unblocked about your WorkOS data: - "Is this customer’s SSO connection active in WorkOS, and is there a support ticket about their login failures?" - "Which organizations use Directory Sync, and which pull request last changed how we handle directory events?" - "What roles does this user hold in WorkOS, and does our permission check in code match them?" - "Why did we move this organization to a new SSO connection, and was there a Slack thread about it?" ## WorkOS integration FAQ ### What is the WorkOS MCP server? The WorkOS MCP server is a remote Model Context Protocol server, hosted and maintained by WorkOS, that lets AI agents work with your WorkOS workspace — organizations, SSO connections, Directory Sync, AuthKit users, roles, and audit logs — acting with the connected user’s dashboard permissions. Unblocked connects to it as a verified MCP server, so every agent reaches it through one Unblocked connection. ### Can Unblocked change my WorkOS organizations or SSO connections? No. WorkOS’s server includes a tool for write operations, but Unblocked only offers read-only tools for selection and excludes any tool that might modify data. Agents can query organizations, connections, and users, never change them. ### Which WorkOS data can agents query? Through the read-only query tool, agents can read the operations WorkOS exposes — including organizations, SSO connections, Directory Sync, users and sessions, roles and permissions, and audit logs — within what the connected user’s dashboard role allows. WorkOS redacts secret values from responses. ### Can WorkOS admins limit what the MCP server reaches? Yes. WorkOS team admins can turn MCP access off for the team, restrict it to sandbox environments by disabling production access, and make it read-only by disabling write access. Unblocked works within whatever those settings allow. ### Does Unblocked store my WorkOS user and organization data? No. Nothing from WorkOS is ingested or indexed. Unblocked calls WorkOS’s tools while it answers a question, so results reflect your organizations and users at that moment. ## Related integrations - [Stripe](https://getunblocked.com/integrations/stripe/) — Payments and billing context from Stripe’s verified MCP server, queried live while Unblocked answers — nothing is ingested or indexed. - [Vanta](https://getunblocked.com/integrations/vanta/) — Compliance and security context from Vanta’s verified MCP server, queried live while Unblocked answers — nothing is ingested or indexed. - [Zendesk](https://getunblocked.com/integrations/zendesk/) — Support tickets from the Zendesk brands you select, indexed and linked back to the original ticket so answers stay grounded in real customer issues. - [GitHub](https://getunblocked.com/integrations/github/) — Repositories, pull requests, issues, discussions, and full code history — indexed, kept in sync on every push, and cited in answers. ## Get started with Unblocked - Start a free trial: - Pricing: - All integrations: