> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WorkOS

> Give the Sazabi agent read-only tools to look up the organizations, users, SSO connections, and directories behind an authentication signal in your WorkOS workspace.

[All WorkOS integration capabilities](https://docs.sazabi.com/catalogs/integrations/workos)

## About

This is an MCP connector that gives the Sazabi agent tools from WorkOS's hosted MCP server (`mcp.workos.com/mcp`). WorkOS authenticates over OAuth with dynamic client registration, and the server acts as the WorkOS dashboard user who connects it, with that user's dashboard role.

Sazabi uses this connector read-only. WorkOS tools that change the workspace are blocked and cannot be called, so the agent can inspect your workspace during an investigation but cannot change it.

Pair it with the [WorkOS log source](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/workos.md): the log source shows what happened and when, and this connector shows how the workspace is configured now.

**What the agent can do:**

* Look up the organization, user, or membership named in a sign-in or SSO event
* Inspect the SSO connections and directory sync configuration attached to an organization
* Check webhook endpoints and workspace settings while tracing a failed delivery

## Prerequisites

* A WorkOS account with access to the dashboard workspace you want to investigate
* A WorkOS dashboard role that can view the data the agent needs. The connector reads no more than that user can see.

## Set up in the dashboard

Configure connectors in the dashboard under [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Step 1**

### Open the connector

Find WorkOS in [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Step 2**

### Authorize

Start the connection. Sazabi redirects you to WorkOS, where you sign in to your WorkOS dashboard account and approve access, then back.

## Set up with the CLI

You can also connect WorkOS with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [`sazabi mcp-connectors` reference](https://docs.sazabi.com/reference/cli/mcp-connectors)).

WorkOS authenticates over OAuth, so the CLI opens a browser to complete authorization:

```bash theme={"system"}
sazabi mcp-connectors connect workos
```

Add `--project-id <project>` to target a specific project, or `--no-wait` to print the authorization link and exit without waiting. With `--json` the command prints the authorization URL and returns without waiting. Confirm the result with `sazabi mcp-connectors list`.

## Verify

Open the connector's connection page under [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors) and confirm Sazabi lists the tools it discovered. Then, in a thread, ask the agent to look up one of your WorkOS organizations and confirm it returns the organization.

## Troubleshooting

**No tools discovered** — Disconnect and reconnect from [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors), and sign in to the WorkOS account that belongs to the workspace you want to investigate.

**A lookup returns an authorization error** — The WorkOS user who connected the server does not have a dashboard role that can view that data. Reconnect with a user whose role can.

**Connection shows needs attention** — The authorization may have expired or been revoked; reconnect from [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

## Further reading

> [card] [Agent tools](https://docs.sazabi.com/guides/investigate/agent-tools.md)
>
> How the agent uses connector tools.

> [card] [MCP connectors](https://docs.sazabi.com/catalogs/mcp-connectors.md)
>
> Browse the connector catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.