WorkOS MCP: orgs, users and SSO from your AI app

Wire WorkOS into Claude, ChatGPT or Cursor

1. 1Click Connect WorkOS free and sign in with your WorkOS account.
2. 2Deleting a user, an organization or a membership is permanent and cuts off access. Switch those tools off and keep lookups; decide separately whether your AI app should create users and memberships.
3. 3Add ContextGate to your AI app as a connector or MCP server. The steps for each app are on the Works with page.
4. 4Ask your AI app which SSO connections a customer organization has set up, then open Activity to see the call.

Identity work from Claude or Cursor

• Create an organization and add AuthKit users to it.
• List SSO and OAuth connections by type, domain or organization.
• Look up Directory Sync directories, users and groups, including identity-provider attributes.
• Check an AuthKit invitation's status without exposing acceptance credentials.

Access changes stay deliberate

• Switch off user, organization and membership deletion; the tools are hidden and refused if called.
• Policies check every call and can hide users' personal data such as email addresses.
• Activity records every organization and user change made through your AI apps.

What you get with WorkOS and ContextGate

• Your AI apps can use WorkOSClaude, Cursor, ChatGPT and other AI apps reach WorkOS through the one ContextGate connection you add to them.
• You choose which tools they can useSwitch off any WorkOS tool you don't want used. It's hidden from your AI apps and refused if called.
• Every call is checked and recordedYour policies check each call (for example, personal data is hidden and secrets are blocked), and Activity keeps a record of it.

ContextGate sees only the tool calls that go through it, not your AI app's built-in tools or your chats.

WorkOS tools

Examples of what your AI apps can do in WorkOS. You'll see the exact list of tools after you connect it.

• Create OrganizationCreate a WorkOS organization in the connected environment.
• Create Organization MembershipGrant an AuthKit user active membership in an organization. An existing inactive membership for the same user and organization is reactivated.
• Create UserCreate a passwordless AuthKit user record in the connected WorkOS environment. This tool does not accept plaintext or hashed passwords.
• Delete OrganizationPermanently delete a WorkOS organization. This cannot be undone and should only target a confirmed organization ID.
• Delete Organization MembershipPermanently remove an organization membership and its access. Prefer deactivation when access may need to be restored.
• Delete UserPermanently delete an AuthKit user. This cannot be undone and may remove the user's access.
• Get ConnectionGet one WorkOS connection by ID.
• Get DirectoryGet one WorkOS Directory Sync directory by ID.
• Get Directory GroupGet one WorkOS Directory Sync group by its exact group ID.
• Get Directory UserGet one WorkOS Directory Sync user by exact ID, including identity-provider attributes, roles, and any groups returned by WorkOS. For complete group memberships, use List Directory Groups filtered by
• Get InvitationGet WorkOS AuthKit invitation status and metadata by invitation ID without exposing acceptance credentials.
• Get OrganizationGet one WorkOS organization by its WorkOS ID or external ID.
• Get Organization MembershipGet one WorkOS AuthKit organization membership by ID.
• Get UserGet one WorkOS AuthKit user by WorkOS ID or external ID.
• List ConnectionsList one page of WorkOS SSO and OAuth connections, optionally filtered by connection type, domain, organization, or name.
• List DirectoriesList one page of WorkOS Directory Sync directories, optionally filtered by organization, directory name, or domain.
• List Directory GroupsList one page of WorkOS Directory Sync groups for a directory, a directory user, or both.
• List Directory UsersList one page of WorkOS Directory Sync users for a directory or group, optionally filtering a directory by exact identity-provider ID or primary email. WorkOS limits this endpoint to 4 requests per se
• List InvitationsList one page of WorkOS AuthKit invitations by organization or exact recipient email without exposing acceptance credentials.
• List Organization MembershipsList one page of WorkOS AuthKit organization memberships for a specific organization or user, optionally including inactive or pending memberships.