WorkOS MCP server

What the model can do

WorkOS for one environment: AuthKit users (name, email, verified, last sign-in), a user's sessions and organisation memberships with roles and status, organisations with their domains, invitations and their state, and Directory Sync directories with their provisioned users. Can delete a user, revoke a session, add, re-role, deactivate, reactivate or delete a membership, send, resend or revoke an invitation, and create an organisation, each only when asked.

Reads

• workos_list_usersWorkOS AuthKit users: name, email, whether it is verified, external id, last sign-in and created date.
• workos_get_userOne WorkOS user by id (user_…), with every organisation membership they hold (active, inactive or pending) and its role.
• workos_list_membershipsWorkOS organisation memberships for a user or an organisation (one of the two is required): user, organisation, role, status (active by default…
• workos_list_organizationsWorkOS organisations: id, name, domains, external id and created date.
• workos_list_sessionsA WorkOS user's sessions: id, status, sign-in method, organisation, created, expiry and end.
• workos_list_invitationsWorkOS invitations: email, state (pending, accepted, expired, revoked), organisation, role, inviter, and when it was sent, expires…
• workos_list_directoriesWorkOS Directory Sync directories: id, name, provider type (Okta SCIM, Azure, Google Workspace, BambooHR …), state, domain and organisation.
• workos_list_directory_usersUsers provisioned into a WorkOS directory from the customer's identity provider: name, email, state (active, inactive) and role.

Acts, when you ask

These change something in WorkOS. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

• workos_delete_userDelete a WorkOS user from this environment.
• workos_revoke_sessionRevoke a WorkOS session (session_…, from workos_list_sessions).
• workos_create_membershipAdd a WorkOS user to an organisation, active at once, with a role (the environment's default role when none is given).
• workos_update_membership_roleChange the role of a WorkOS organisation membership (om_…), which changes what that user can do in the organisation.
• workos_deactivate_membershipDeactivate an active WorkOS organisation membership: the user loses access to the organisation but the membership and its roles are kept for…
• workos_reactivate_membershipReactivate an inactive WorkOS organisation membership with the roles it had, giving the user access again.
• workos_delete_membershipDelete a WorkOS organisation membership.
• workos_send_invitationInvite somebody through WorkOS.
• workos_resend_invitationResend a pending WorkOS invitation: WorkOS emails the invitee again.
• workos_revoke_invitationRevoke a WorkOS invitation so it can no longer be accepted.
• workos_create_organizationCreate a WorkOS organisation with a name and nothing else: no domains, so it changes nobody's sign-in until somebody configures it.

Connect it

First connect WorkOS on Dashboard → Connections, then add Memtro to your client once. The WorkOS tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared WorkOS connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

• › Who are the members of the BigCo organisation?
• › When did priya@acme.com last sign in?
• › Which invitations are still pending?
• › Which directories are connected, and from which identity provider?
• › Deactivate Tom Reilly's membership in the Northwind organisation

Questions

Is this an official WorkOS MCP server?

No. It is Memtro's MCP server with Memtro's WorkOS connector behind it: the connector reads WorkOS through its API with the credentials you connect on Dashboard → Connections, and WorkOS publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

What does it cost?

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in WorkOS?

Only when you ask, and only what it has been granted: delete a user (permanent); revoke a user's session; add a user to an organisation with a role; change a membership's role; deactivate an organisation membership (the user loses access); reactivate an organisation membership; delete an organisation membership (permanent); send an invitation (WorkOS emails the person); resend a pending invitation's email; revoke a pending invitation; create an organisation (name only). Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Which clients work?

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

Other MCP servers · Engineering and operations

• GitHub MCP server
• AWS CloudWatch MCP server
• Sentry MCP server
• ServiceNow MCP server
• Okta MCP server
• Twilio MCP server