How to integrate WorkOS MCP with Atomic Agent

Connect Atomic Agent to WorkOS MCP. Sync new users from okta directory, create invitation links for pending users, and more using natural language, with authentication handled for you.

Get started for free Get a demo

WorkOS

Api Key

WorkOS is an enterprise identity and user management API for directory sync, connections, invitations, and users. Use it to centralize SSO, provisioning, and directory synchronization across providers.

29 Tools

Managed auth

Connect WorkOS without auth hassles

We manage OAuth, API keys, token refresh, and scopes — you just build.

Book a call

Explore the MCP Gateway

Introduction

Atomic Agent is an open-source AI agent that runs on your machine and supports local models through llama.cpp. Connect it to 1,500+ apps through Composio, including WorkOS.

This guide uses Atomic Agent's built-in Composio integration. You need Atomic Agent v0.5.6 or later, your own Composio API key, and a WorkOS account. See the Atomic Agent documentation for installation instructions.

Also integrate WorkOS with

ChatGPT Claude Cowork Hermes

How Atomic Agent connects to WorkOS

Atomic Agent connects to Composio's Tool Router over Streamable HTTP MCP. It discovers the tools needed for your request, and Composio handles account authentication.

Execution and account-connection tools follow Atomic Agent's configured approval policy. Review any approval prompt before allowing an action on your connected account.

Connect WorkOS to Atomic Agent

Sign up or sign in to the Composio dashboard. Copy your API key.
In Atomic Agent, open the Integrations tab and select Composio. Select API key, press e, paste the key, and press Enter. The tools become available immediately, without a restart.
Ask Atomic Agent to do something in WorkOS. It searches Composio for the right tool.
On first use, open the sign-in link returned in the chat. Connect your WorkOS account, then return to Atomic Agent to continue.

Headless setup

Add the following line to ~/.atomic-agent/.env, replacing YOUR_COMPOSIO_API_KEY with your key. Start Atomic Agent after saving the file.

bash

COMPOSIO_API_KEY=YOUR_COMPOSIO_API_KEY

What is the WorkOS MCP server, and what's possible with it?

The WorkOS MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your WorkOS account. It provides structured and secure access to your organizations, users, memberships, invitations, connections, and directories, so your agent can manage users, organize access, send invitations, review connections, and inspect directory data on your behalf.

Organization management: Have your agent create, review, update, list, or delete organizations based on your instructions.
User and membership administration: Let the agent create, find, update, or delete users, grant organization membership, change assigned roles, adjust membership status, or remove access.
Invitation management: Direct your agent to send invitations, check their status, list invitations by organization or recipient, resend pending invitations, or revoke them.
Directory Sync insights: Instruct your agent to review connected directories and retrieve directory users and groups, including user attributes, roles, and group details available in WorkOS.
Connection discovery: Have your agent find and review your SSO and OAuth connections by organization, domain, connection type, or name.

Use WorkOS from Atomic Agent

With your account connected, ask Atomic Agent to work with WorkOS in natural language. You can connect more apps through the same Composio integration as you need them.

Visit the Atomic Agent website or inspect the Atomic Agent source code.

Troubleshooting

Why is my API key rejected?

Copy the key directly from the Composio dashboard. Atomic Agent requires ASCII characters because it sends the key in an HTTP header. Remove any extra characters introduced when copying.

Why are Composio tools unavailable after saving a key?

Check that you use Atomic Agent v0.5.6 or later and that Composio is enabled in your configuration. A "composio": { "enabled": false } setting disables the integration while keeping the saved key on disk.

Does Composio have a free plan?

The Hobby plan includes 100,000 tool calls per month. Composio-managed OAuth apps have a lower included allowance. See Composio pricing for the current limits that apply to your connection.

TOOLS

Supported Tools

Every WorkOS action and event your agent gets out of the box.

Create Organization

Create a WorkOS organization in the connected environment.

Create Organization Membership

Grant an AuthKit user active membership in an organization.

Create User

Create a passwordless AuthKit user record in the connected WorkOS environment.

Delete Organization

Permanently delete a WorkOS organization.

Delete Organization Membership

Permanently remove an organization membership and its access.

Delete User

Permanently delete an AuthKit user.

Get Connection

Get one WorkOS connection by ID.

Get Directory

Get one WorkOS Directory Sync directory by ID.

Get Directory Group

Get one WorkOS Directory Sync group by its exact group ID.

Get Directory User

Get one WorkOS Directory Sync user by exact ID, including identity-provider attributes, roles, and any groups returned by WorkOS.

Get Invitation

Get WorkOS AuthKit invitation status and metadata by invitation ID without exposing acceptance credentials.

Get Organization

Get one WorkOS organization by its WorkOS ID or external ID.

Get Organization Membership

Get one WorkOS AuthKit organization membership by ID.

Get User

Get one WorkOS AuthKit user by WorkOS ID or external ID.

List Connections

List one page of WorkOS SSO and OAuth connections, optionally filtered by connection type, domain, organization, or name.

List Directories

List one page of WorkOS Directory Sync directories, optionally filtered by organization, directory name, or domain.

List Directory Groups

List one page of WorkOS Directory Sync groups for a directory, a directory user, or both.

List Directory Users

List one page of WorkOS Directory Sync users for a directory or group, optionally filtering a directory by exact identity-provider ID or primary email.

List Invitations

List one page of WorkOS AuthKit invitations by organization or exact recipient email without exposing acceptance credentials.

List Organization Memberships

List one page of WorkOS AuthKit organization memberships for a specific organization or user, optionally including inactive or pending memberships.

List Organizations

List one page of WorkOS organizations, optionally filtered by domain or organization name.

List Users

List one page of WorkOS AuthKit users, optionally filtered by organization or exact email address.

Resend Invitation

Send another real invitation email to the existing recipient of a pending WorkOS AuthKit invitation.

Revoke Invitation

Revoke a pending AuthKit invitation so it can no longer be accepted.

Send Invitation

Create an AuthKit invitation and immediately send a real invitation email to the recipient.

Set Organization Membership Status

Activate or deactivate a WorkOS organization membership without deleting it.

Update Organization

Update selected properties of an existing WorkOS organization.

Update Organization Membership Roles

Replace the role assignment on an existing WorkOS organization membership.

Update User

Update selected profile fields on an AuthKit user without invoking email delivery flows.

FRAMEWORKS

How to build WorkOS MCP Agent with another framework

ChatGPT

Use WorkOS MCP with ChatGPT

Claude Cowork

Use WorkOS MCP with Claude Cowork

Hermes

Use WorkOS MCP with Hermes

MORE TOOLKITS

Explore Other Toolkits

Toolkit marketplace

Supabase

Oauth2Api Key

Supabase is an open-source backend platform offering scalable Postgres databases, authentication, storage, and real-time APIs. It lets developers build modern apps without managing infrastructure.

Codeinterpreter

No Auth

Codeinterpreter is a Python-based coding environment with built-in data analysis and visualization. It lets you instantly run scripts, plot results, and prototype solutions inside supported platforms.

GitHub

Oauth2

GitHub is a code hosting platform for version control and collaborative software development. It streamlines project management, code review, and team workflows in one place.

1password

Api Key

1Password is a password manager and digital vault for storing logins, secrets, notes, and secure documents. It helps individuals and teams protect credentials, share access safely, and reduce password risk.

FAQ

Frequently asked questions

With a standalone WorkOS MCP server, the agents and LLMs can only access a fixed set of WorkOS tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from WorkOS and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Atomic Agent fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right WorkOS tools.

Yes, absolutely. You can configure which WorkOS scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your WorkOS data and credentials are handled as safely as possible.

Start with WorkOS.It takes 30 seconds.

Managed auth, hosted MCP servers, and every WorkOS tool your agent needs.Free to start.

Start building