WorkOS

@workos list all active organization memberships for user@example.com and show which organizations they belong to

Found 3 active memberships for user@example.com: 1. Acme Corp (org_01HZXYZ) — Role: member, Status: active, Created: 2024-01-15 2. Beta Industries (org_01HZABC) — Role: admin, Status: active, Created: 2024-02-03 3. Gamma LLC (org_01HZDEF) — Role: member, Status: active, Created: 2024-03-12 This user has admin privileges in one organization and standard member access in two others. All memberships are currently active and grant AuthKit access to their respective environments.

This example demonstrates WorkOS's multi-tenancy model where users can belong to multiple organizations with different roles. Requires read access to both users and organization_memberships scopes. The MCP returns structured membership data but cannot infer business logic about what each role permits — that's defined in your application's authorization layer.

@workos create a new organization called 'Delta Systems' and immediately add admin@deltasystems.com as an admin member

Organization created successfully: • Organization ID: org_01HZGHI • Name: Delta Systems • Status: active Admin membership created: • User: admin@deltasystems.com (user_01HZJKL) • Role: admin • Status: active • Membership ID: om_01HZMNO The organization is now live in your WorkOS environment and the admin user has full access. You'll need to configure SSO or Directory Sync connections separately if this organization requires enterprise authentication.

This write-heavy example shows how WorkOS structures tenant provisioning. The MCP creates both resources but does not automatically configure authentication methods — SSO connections and directory sync must be set up through additional tools or the WorkOS dashboard. Be cautious: these are production changes that immediately affect your AuthKit environment.

@workos check all Directory Sync directories and summarize which ones have sync errors or are inactive, then recommend next steps

Analyzed 5 Directory Sync directories: ✓ 3 directories syncing successfully (Acme Corp SCIM, Beta Okta, Gamma Azure AD) ⚠️ 2 directories need attention: 1. Epsilon Corp (dir_01HZPQR) — Status: invalid_credentials — Last sync failed 6 hours ago. The SCIM bearer token appears expired. 2. Zeta Inc (dir_01HZSTU) — Status: inactive — No sync activity in 14 days. Directory may have been disabled on the IdP side. Recommended actions: Re-authenticate Epsilon's SCIM connection through the WorkOS dashboard, and contact Zeta's IT team to verify their IdP configuration is still active.

This synthesis example pairs WorkOS's directory state with AI reasoning to surface operational issues. The MCP provides raw directory status but the AI interprets patterns and suggests fixes. Useful for monitoring enterprise SSO health, but remember that directory sync errors often require coordination with customer IT teams — the MCP cannot fix IdP misconfigurations on its own.

When WorkOS MCP handles new customer org setup

A 6-person SaaS startup onboards 3-5 enterprise customers per month, each needing a dedicated organization with SSO and directory sync. The WorkOS MCP wins here because it automates the full provisioning chain—create the org, attach the connection, grant the first admin membership—without leaving the AI workspace. Your support engineer describes the new customer in chat, Switchy calls Create Organization and Create Organization Membership in sequence, and the customer's SSO is live in under two minutes. The threshold: if you're onboarding fewer than 2 orgs per month, the manual WorkOS dashboard is faster than teaching the AI your naming conventions. Above that frequency, this MCP pays for itself in the first week.

WorkOS MCP for quarterly access reviews

A 12-person fintech team runs quarterly SOC 2 access reviews, checking which users belong to which organizations and whether any memberships should be deactivated. The WorkOS MCP is the right call because it surfaces membership and directory data in conversational queries—your compliance lead asks 'show me all users in the Acme org with admin roles' and Switchy returns the list without writing a script. The 29 tools include Get Directory and membership lookups, so you can cross-reference SCIM-synced users against active memberships. The trade-off: if your review process requires bulk CSV exports or historical snapshots, the MCP's read-only queries won't replace your data warehouse. For live spot-checks and triage, it's the fastest path from question to answer.

When to use WorkOS MCP for churned account teardown

A 4-person B2B team churns 1-2 customers per quarter and needs to deprovision their organizations, memberships, and SSO connections without leaving orphaned records. The WorkOS MCP handles this cleanly: your account manager confirms the org ID in chat, Switchy calls Delete Organization Membership for each user, then Delete Organization to remove the parent entity. The API_KEY auth means no OAuth dance, and the destructive tools (Delete User, Delete Organization) require explicit confirmation, so you won't accidentally nuke the wrong account. The boundary: if your offboarding checklist spans multiple systems (Stripe, Zendesk, your own DB), the MCP only covers the WorkOS slice. For pure identity and access cleanup, it's the safest way to script teardown without writing throwaway code.