# How to integrate WorkOS MCP with Atomic Agent

```json
{
  "title": "How to integrate WorkOS MCP with Atomic Agent",
  "toolkit": "WorkOS",
  "toolkit_slug": "workos",
  "framework": "Atomic Agent",
  "framework_slug": "atomic-agent",
  "url": "https://composio.dev/toolkits/workos/framework/atomic-agent",
  "markdown_url": "https://composio.dev/toolkits/workos/framework/atomic-agent.md",
  "updated_at": "2026-10-12T12:48:37.666Z"
}
```

## Introduction

Atomic Agent is an open-source AI agent that runs on your machine and supports local models through llama.cpp. Connect it to 1,500+ apps through Composio, including WorkOS.
This guide uses Atomic Agent's built-in Composio integration. You need Atomic Agent v0.5.6 or later, your own Composio API key, and a WorkOS account. See the [Atomic Agent documentation](https://atomicagent.io/docs/?cta_placement=atomic-agent-docs) for installation instructions.

## Also integrate WorkOS with

- [ChatGPT](https://composio.dev/toolkits/workos/framework/chatgpt)
- [Claude Cowork](https://composio.dev/toolkits/workos/framework/claude-cowork)
- [Hermes](https://composio.dev/toolkits/workos/framework/hermes-agent)

## TL;DR

### How Atomic Agent connects to WorkOS
Atomic Agent connects to Composio's Tool Router over Streamable HTTP MCP. It discovers the tools needed for your request, and Composio handles account authentication.
Execution and account-connection tools follow Atomic Agent's configured approval policy. Review any approval prompt before allowing an action on your connected account.

## Connect WorkOS to Atomic Agent

### Connect WorkOS to Atomic Agent
- Sign up or sign in to the [Composio dashboard](https://dashboard.composio.dev/?cta_placement=atomic-agent-api-key). Copy your API key.
- In Atomic Agent, open the Integrations tab and select Composio. Select API key, press e, paste the key, and press Enter. The tools become available immediately, without a restart.
- Ask Atomic Agent to do something in WorkOS. It searches Composio for the right tool.
- On first use, open the sign-in link returned in the chat. Connect your WorkOS account, then return to Atomic Agent to continue.
### Headless setup
Add the following line to ~/.atomic-agent/.env, replacing YOUR_COMPOSIO_API_KEY with your key. Start Atomic Agent after saving the file.

```bash
COMPOSIO_API_KEY=YOUR_COMPOSIO_API_KEY
```

## What is the WorkOS MCP server, and what's possible with it?

The WorkOS MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your WorkOS account. It provides structured and secure access to your organizations, users, memberships, invitations, connections, and directories, so your agent can manage users, organize access, send invitations, review connections, and inspect directory data on your behalf.
- Organization management: Have your agent create, review, update, list, or delete organizations based on your instructions.
- User and membership administration: Let the agent create, find, update, or delete users, grant organization membership, change assigned roles, adjust membership status, or remove access.
- Invitation management: Direct your agent to send invitations, check their status, list invitations by organization or recipient, resend pending invitations, or revoke them.
- Directory Sync insights: Instruct your agent to review connected directories and retrieve directory users and groups, including user attributes, roles, and group details available in WorkOS.
- Connection discovery: Have your agent find and review your SSO and OAuth connections by organization, domain, connection type, or name.

## Supported Tools

| Tool slug | Name | Description |
|---|---|---|
| `WORKOS_CREATE_ORGANIZATION` | Create Organization | Create a WorkOS organization in the connected environment. |
| `WORKOS_CREATE_ORGANIZATION_MEMBERSHIP` | Create Organization Membership | Grant an AuthKit user active membership in an organization. An existing inactive membership for the same user and organization is reactivated. |
| `WORKOS_CREATE_USER` | Create User | Create a passwordless AuthKit user record in the connected WorkOS environment. This tool does not accept plaintext or hashed passwords. |
| `WORKOS_DELETE_ORGANIZATION` | Delete Organization | Permanently delete a WorkOS organization. This cannot be undone and should only target a confirmed organization ID. |
| `WORKOS_DELETE_ORGANIZATION_MEMBERSHIP` | Delete Organization Membership | Permanently remove an organization membership and its access. Prefer deactivation when access may need to be restored. |
| `WORKOS_DELETE_USER` | Delete User | Permanently delete an AuthKit user. This cannot be undone and may remove the user's access. |
| `WORKOS_GET_CONNECTION` | Get Connection | Get one WorkOS connection by ID. |
| `WORKOS_GET_DIRECTORY` | Get Directory | Get one WorkOS Directory Sync directory by ID. |
| `WORKOS_GET_DIRECTORY_GROUP` | Get Directory Group | Get one WorkOS Directory Sync group by its exact group ID. |
| `WORKOS_GET_DIRECTORY_USER` | Get Directory User | Get one WorkOS Directory Sync user by exact ID, including identity-provider attributes, roles, and any groups returned by WorkOS. For complete group memberships, use List Directory Groups filtered by this directory user ID. |
| `WORKOS_GET_INVITATION` | Get Invitation | Get WorkOS AuthKit invitation status and metadata by invitation ID without exposing acceptance credentials. |
| `WORKOS_GET_ORGANIZATION` | Get Organization | Get one WorkOS organization by its WorkOS ID or external ID. |
| `WORKOS_GET_ORGANIZATION_MEMBERSHIP` | Get Organization Membership | Get one WorkOS AuthKit organization membership by ID. |
| `WORKOS_GET_USER` | Get User | Get one WorkOS AuthKit user by WorkOS ID or external ID. |
| `WORKOS_LIST_CONNECTIONS` | List Connections | List one page of WorkOS SSO and OAuth connections, optionally filtered by connection type, domain, organization, or name. |
| `WORKOS_LIST_DIRECTORIES` | List Directories | List one page of WorkOS Directory Sync directories, optionally filtered by organization, directory name, or domain. |
| `WORKOS_LIST_DIRECTORY_GROUPS` | List Directory Groups | List one page of WorkOS Directory Sync groups for a directory, a directory user, or both. |
| `WORKOS_LIST_DIRECTORY_USERS` | List Directory Users | List one page of WorkOS Directory Sync users for a directory or group, optionally filtering a directory by exact identity-provider ID or primary email. WorkOS limits this endpoint to 4 requests per second per directory; on HTTP 429, honor Retry-After before retrying. |
| `WORKOS_LIST_INVITATIONS` | List Invitations | List one page of WorkOS AuthKit invitations by organization or exact recipient email without exposing acceptance credentials. |
| `WORKOS_LIST_ORGANIZATION_MEMBERSHIPS` | List Organization Memberships | List one page of WorkOS AuthKit organization memberships for a specific organization or user, optionally including inactive or pending memberships. |
| `WORKOS_LIST_ORGANIZATIONS` | List Organizations | List one page of WorkOS organizations, optionally filtered by domain or organization name. |
| `WORKOS_LIST_USERS` | List Users | List one page of WorkOS AuthKit users, optionally filtered by organization or exact email address. |
| `WORKOS_RESEND_INVITATION` | Resend Invitation | Send another real invitation email to the existing recipient of a pending WorkOS AuthKit invitation. This externally visible email delivery cannot be undone. The response excludes the invitation token and acceptance URL. |
| `WORKOS_REVOKE_INVITATION` | Revoke Invitation | Revoke a pending AuthKit invitation so it can no longer be accepted. |
| `WORKOS_SEND_INVITATION` | Send Invitation | Create an AuthKit invitation and immediately send a real invitation email to the recipient. This externally visible email delivery cannot be undone. Use only when the recipient and delivery are intentional. The output omits the sensitive acceptance token and acceptance URL. |
| `WORKOS_SET_ORGANIZATION_MEMBERSHIP_STATUS` | Set Organization Membership Status | Activate or deactivate a WorkOS organization membership without deleting it. Deactivation removes access but can be reversed by setting the status to active. |
| `WORKOS_UPDATE_ORGANIZATION` | Update Organization | Update selected properties of an existing WorkOS organization. |
| `WORKOS_UPDATE_ORGANIZATION_MEMBERSHIP_ROLES` | Update Organization Membership Roles | Replace the role assignment on an existing WorkOS organization membership. |
| `WORKOS_UPDATE_USER` | Update User | Update selected profile fields on an AuthKit user without invoking email delivery flows. |

## Supported Triggers

None listed.

## Troubleshooting

### Why is my API key rejected?

Copy the key directly from the Composio dashboard. Atomic Agent requires ASCII characters because it sends the key in an HTTP header. Remove any extra characters introduced when copying.

### Why are Composio tools unavailable after saving a key?

Check that you use Atomic Agent v0.5.6 or later and that Composio is enabled in your configuration. A "composio": { "enabled": false } setting disables the integration while keeping the saved key on disk.

### Does Composio have a free plan?

The Hobby plan includes 100,000 tool calls per month. Composio-managed OAuth apps have a lower included allowance. See [Composio pricing](/pricing) for the current limits that apply to your connection.

## Complete Code

None listed.

## Conclusion

### Use WorkOS from Atomic Agent
With your account connected, ask Atomic Agent to work with WorkOS in natural language. You can connect more apps through the same Composio integration as you need them.
Visit the [Atomic Agent website](https://atomicagent.io/?cta_placement=atomic-agent-site) or inspect the [Atomic Agent source code](https://github.com/AtomicBot-ai/atomic-agent?cta_placement=atomic-agent-repo).

## How to build WorkOS MCP Agent with another framework

- [ChatGPT](https://composio.dev/toolkits/workos/framework/chatgpt)
- [Claude Cowork](https://composio.dev/toolkits/workos/framework/claude-cowork)
- [Hermes](https://composio.dev/toolkits/workos/framework/hermes-agent)

## Related Toolkits

- [Supabase](https://composio.dev/toolkits/supabase) - Supabase is an open-source backend platform offering scalable Postgres databases, authentication, storage, and real-time APIs. It lets developers build modern apps without managing infrastructure.
- [Codeinterpreter](https://composio.dev/toolkits/codeinterpreter) - Codeinterpreter is a Python-based coding environment with built-in data analysis and visualization. It lets you instantly run scripts, plot results, and prototype solutions inside supported platforms.
- [GitHub](https://composio.dev/toolkits/github) - GitHub is a code hosting platform for version control and collaborative software development. It streamlines project management, code review, and team workflows in one place.
- [1password](https://composio.dev/toolkits/_1password) - 1Password is a password manager and digital vault for storing logins, secrets, notes, and secure documents. It helps individuals and teams protect credentials, share access safely, and reduce password risk.
- [Ably](https://composio.dev/toolkits/ably) - Ably is a real-time messaging platform for live chat and data sync in modern apps. It offers global scale and rock-solid reliability for seamless, instant experiences.
- [Abuselpdb](https://composio.dev/toolkits/abuselpdb) - Abuselpdb is a central database for reporting and checking IPs linked to malicious online activity. Use it to quickly identify and report suspicious or abusive IP addresses.
- [Alchemy](https://composio.dev/toolkits/alchemy) - Alchemy is a blockchain development platform offering APIs and tools for Ethereum apps. It simplifies building and scaling Web3 projects with robust infrastructure.
- [Algolia](https://composio.dev/toolkits/algolia) - Algolia is a hosted search API that powers lightning-fast, relevant search experiences for web and mobile apps. It helps developers deliver instant, typo-tolerant, and scalable search without complex infrastructure.
- [Anakin](https://composio.dev/toolkits/anakin_io) - Anakin is a web automation platform offering scraping, crawling, search, and browser automation. Use it to extract structured data, automate site tasks, and monitor web changes reliably.
- [Anchor browser](https://composio.dev/toolkits/anchor_browser) - Anchor browser is a developer platform for AI-powered web automation. It transforms complex browser actions into easy API endpoints for streamlined web interaction.
- [Apiflash](https://composio.dev/toolkits/apiflash) - Apiflash is a website screenshot API for programmatically capturing web pages. It delivers high-quality screenshots on demand for automation, monitoring, or reporting.
- [Apiverve](https://composio.dev/toolkits/apiverve) - Apiverve delivers a suite of powerful APIs that simplify integration for developers. It's designed for reliability and scalability so you can build faster, smarter applications without the integration headache.
- [Appcircle](https://composio.dev/toolkits/appcircle) - Appcircle is an enterprise-grade mobile CI/CD platform for building, testing, and publishing mobile apps. It streamlines mobile DevOps so teams ship faster and with more confidence.
- [Appdrag](https://composio.dev/toolkits/appdrag) - Appdrag is a cloud platform for building websites, APIs, and databases with drag-and-drop tools and code editing. It accelerates development and iteration by combining hosting, database management, and low-code features in one place.
- [Appveyor](https://composio.dev/toolkits/appveyor) - AppVeyor is a cloud-based continuous integration service for building, testing, and deploying applications. It helps developers automate and streamline their software delivery pipelines.
- [Authyo](https://composio.dev/toolkits/authyo) - Authyo is a REST API service for passwordless authentication, OTP verification, session management, and transactional notifications. Use it to add secure login flows and user verification without building auth infrastructure from scratch.
- [AWS Marketplace MCP](https://composio.dev/toolkits/aws_marketplace_mcp) - AWS Marketplace MCP provides MCP access to AWS Marketplace's cloud software, data, and services catalog. Use it to discover, compare, and evaluate 30K+ AWS Marketplace listings faster.
- [Azure Monitor Activity Log](https://composio.dev/toolkits/azure_monitor_activity_log) - Azure Monitor Activity Log is Azure's service that records management and control-plane events for a subscription. Use it to audit changes, troubleshoot issues, and track resource operations across your Azure resources.
- [Backendless](https://composio.dev/toolkits/backendless) - Backendless is a backend-as-a-service platform for mobile and web apps, offering database, file storage, user authentication, and APIs. It helps developers ship scalable applications faster without managing server infrastructure.
- [Baserow](https://composio.dev/toolkits/baserow) - Baserow is an open-source no-code database platform for building collaborative data apps. It makes it easy for teams to organize data and automate workflows without writing code.

## Frequently Asked Questions

### What are the differences in Tool Router MCP and WorkOS MCP?

With a standalone WorkOS MCP server, the agents and LLMs can only access a fixed set of WorkOS tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from WorkOS and many other apps based on the task at hand, all through a single MCP endpoint.

### Can I use Tool Router MCP with Atomic Agent?

Yes, you can. Atomic Agent fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right WorkOS tools.

### Can I manage the permissions and scopes for WorkOS while using Tool Router?

Yes, absolutely. You can configure which WorkOS scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

### How safe is my data with Composio Tool Router?

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your WorkOS data and credentials are handled as safely as possible.

---
[See all toolkits](https://composio.dev/toolkits) · [Composio docs](https://docs.composio.dev/llms.txt)