跳过安装。2 分钟内即可运行。
在 cloud.anythingmcp.com 开始免费试用，一键添加 WorkOS，然后将你的 AI 客户端（Claude、ChatGPT、Copilot 或 Cursor）指向生成的 MCP 端点。无需 Docker，无需 git clone，无需任何工程经验。
摘要
面向 B2B 身份的 WorkOS API（单个环境）：组织及其域名，AuthKit 用户、成员关系、邀请和会话，SSO 连接，Directory Sync 的目录、用户和群组，Audit Logs 导出，事件流，以及 RBAC 角色和权限。可创建和更新组织、用户、成员关系和邀请；删除和撤销在安装时关闭。
试试这样问
WorkOS 的示例提示
点击任意提示即可复制，然后粘贴到 Claude、ChatGPT、Cursor、Gemini、Copilot 或 OpenClaw 中，在该连接器上运行。
Claude 是 AI，可能会出错。请核对回答。
💡 无需安装? 直接使用 cloud.anythingmcp.com。 登录、点击 Connectors → WorkOS、粘贴凭证、生成 MCP API key，即可完成。无 Docker、无
git clone、无本地服务器。
WorkOS + Gemini
面向 B2B 身份的 WorkOS API（单个环境）：组织及其域名，AuthKit 用户、成员关系、邀请和会话，SSO 连接，Directory Sync 的目录、用户和群组，Audit Logs 导出，事件流，以及 RBAC 角色和权限。可创建和更新组织、用户、成员关系和邀请；删除和撤销在安装时关闭。
前提条件
完整的设置说明已内置在连接器中 (在 store 中选择连接器时可见)。所需环境变量:
WORKOS_API_KEY
步骤 1 — 获取凭证
设置大约需要 2 分钟。
- 打开 https://dashboard.workos.com，在顶部栏选择环境（Sandbox 或 Production），然后打开 API Keys。
- 创建一个密钥（
sk_...，只显示一次），不带空格也不加Bearer前缀，粘贴到WORKOS_API_KEY。 - 安装连接器并运行
workos_list_organizations：它会列出该环境的组织并确认密钥可用。
密钥属于单个环境，并拥有该环境 API 的全部权限：WorkOS 密钥没有 scope。先用 Sandbox 密钥开始，只有在 AI 需要处理真实数据时才使用 Production 密钥。
个人数据和敏感数据：该密钥可访问环境中每个组织的身份数据，AI 会读取工具返回的一切：姓名和邮箱地址、登录身份、会话的 IP 地址和 user agent、带职位的目录用户、组织的元数据和 Stripe 客户 id，以及审计日志内容。workos_get_directory_user 和 workos_get_directory_group 会完整返回提供方的原始属性，其中可能包含电话号码、上级、部门和员工编号；列表工具会省略这些属性。AI 只分享任务所需的内容。
机密值：连接器从不返回 API 密钥。邀请的响应中会移除 token 和 accept_invitation_url，因为任何拿到该链接的人都能加入组织。workos_get_audit_log_export 返回一个指向 CSV 的短时有效下载链接（url）；AI 会像对待密码一样对待它，不会粘贴到其他地方。
组织和域名：workos_list_organizations（按名称文本或域名筛选）、workos_get_organization、workos_get_organization_by_external_id、workos_create_organization 和 workos_update_organization。workos_create_organization_domain 以待验证状态添加域名，并给出由域名所有者发布的 DNS TXT 记录（verification_prefix、verification_token）；之后 workos_verify_organization_domain 启动验证，workos_get_organization_domain 显示状态。
用户、成员关系和角色：workos_list_users（按 email 或 organization_id）、workos_get_user、workos_get_user_by_external_id、workos_create_user（不设密码；本人通过 Magic Auth、社交登录、SSO 或邀请登录）和 workos_update_user；用 workos_list_user_identities 查看登录提供方，用 workos_list_user_sessions 查看会话。成员关系：workos_list_organization_memberships、workos_get_organization_membership、workos_create_organization_membership、用于更改角色的 workos_update_organization_membership，以及用于停用和恢复访问的 workos_deactivate_organization_membership 和 workos_reactivate_organization_membership。角色 slug 来自 workos_list_roles、workos_get_role 和 workos_list_organization_roles（自定义角色以 org- 开头），权限来自 workos_list_permissions。
邀请：workos_list_invitations、workos_get_invitation、workos_send_invitation（邮件由 WorkOS 自己发送）和 workos_resend_invitation。
SSO 和 Directory Sync：workos_list_connections 和 workos_get_connection 显示连接类型和 state（active 表示用户可以登录）。workos_list_directories、workos_get_directory、workos_list_directory_users（需要 directory 或 group）、workos_get_directory_user、workos_list_directory_groups（需要 directory 或 user）和 workos_get_directory_group 读取已同步的用户和群组；workos_sync_directory 会立即把一次同步加入队列。
Audit Logs 和事件：workos_list_audit_log_actions 和 workos_list_audit_log_schemas 显示记录了哪些内容。workos_create_audit_log_export 为某个时间段启动 CSV 导出（不会写入事件），workos_get_audit_log_export 会报告进度，直到 state 变为 ready；workos_get_audit_log_retention 说明事件保留多少天。workos_list_events 按类型（user.created、organization_membership.updated、dsync.user.created、connection.activated 等）并结合 range_start 和 range_end 读取事件流；order: asc 可按发生顺序回放。API 保留 90 天的事件，一次调用最多覆盖 30 天。
更新：workos_update_organization 和 workos_update_user 只修改传入的字段，但 domain_data 和 metadata 会替换已保存的值，因此 AI 会发送完整的列表或对象。修改用户的邮箱会把 email_verified 重置为 false。成员关系的新角色会替换当前角色。
安装时关闭：workos_delete_organization、workos_delete_organization_domain、workos_delete_user、workos_delete_organization_membership、workos_revoke_invitation、workos_revoke_session 和 workos_create_audit_log_event。它们都无法撤销（审计日志事件一旦写入就无法删除），因此由工作区管理员在团队需要时开启。
数据格式：id 带有类型前缀（org_、org_domain_、user_、om_、invitation_、session_、conn_、directory_、directory_user_、directory_group_、audit_log_export_、event_）。时间戳为 UTC 的 ISO 8601 格式。列表以 {"object": "list", "data": [...], "list_metadata": {...}} 的形式返回。metadata 的值都是字符串。
分页：列表默认返回 10 条，用 limit 最多 100 条，按从新到旧排列。获取下一页时，AI 把 list_metadata.after 作为 after 传入，值为 null 时停止；workos_list_events 的分页方式相同。
限制：每个密钥每分钟 6,000 个请求；AuthKit 每 10 秒 1,000 次读取和 500 次写入；目录用户每个目录每秒 4 个请求；删除组织每分钟 50 次。邀请邮件计入 WorkOS 的邮件发送限额。
常见错误：401 表示密钥错误或已撤销。403 表示密钥无权执行此操作，或该环境未启用此功能。404 表示 id 未知，或是另一个环境的 id。400 或 422 表示字段无效，响应正文会指出是哪个字段。429 表示触发速率限制：等待后重试一次。
连接器不配置 SSO 连接、AuthKit 品牌、重定向 URI、Vault、Pipes 或 API 密钥，不设置密码，也从不替任何人登录。
步骤 2 — 安装 adapter
curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d
步骤 3 — 在 Gemini 中添加连接器
你的服务器 URL： 在 AnythingMCP 中打开 MCP Servers → 此连接器所在的服务器，复制它的 URL（
https://cloud.anythingmcp.com/mcp/…）。本指南中出现YOUR_SERVER_ID的地方都用它替换。
Gemini CLI 从 ~/.gemini/settings.json（Windows 上为 %USERPROFILE%\.gemini\settings.json）读取 MCP 服务器。添加：
{
"mcpServers": {
"anythingmcp": {
"httpUrl": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
"headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
}
}
}
- 在 AnythingMCP 的 MCP Servers → 你的服务器 → API keys 中创建 MCP API 密钥，并用它替换
YOUR_MCP_API_KEY。 - 保存文件并重启
gemini。 - 在 Gemini CLI 中运行
/mcp（或在终端运行gemini mcp list），anythingmcp应显示为已连接。 - 开始输入提示，Gemini CLI 现在可以调用
WorkOS的工具。
可用工具
| Tool | What it does |
|---|---|
workos_list_organizations | List organizations (the customer companies of this WorkOS environment), newest first: id, name, external_id, domains with their… |
workos_get_organization | One organization by id: name, domains (each with id, state and verification strategy), external_id, stripe_customer_id, metadata and… |
workos_get_organization_by_external_id | One organization by the external_id your own application stored on it |
workos_create_organization | Create an organization |
workos_update_organization | Update an organization: name, domains (domain_data replaces the whole list), external_id, Stripe customer id, metadata or the… |
workos_delete_organization | Permanently delete an organization together with its SSO connections and directories |
workos_get_organization_domain | One organization domain: domain name, state (pending, verified, failed, legacy_verified), verification strategy (dns or manual), the DNS… |
workos_create_organization_domain | Add a domain to an organization |
workos_verify_organization_domain | Start DNS verification of a pending organization domain after its TXT record was published |
workos_delete_organization_domain | Remove a domain from its organization |
workos_list_users | List AuthKit users of the environment, newest first: id, email, email_verified, first and last name, profile picture URL, external_id… |
workos_get_user | One AuthKit user by id: email, verification state, names, external_id, metadata, locale and last sign-in time |
workos_get_user_by_external_id | One AuthKit user by the external_id your own application stored on it |
workos_create_user | Create an AuthKit user without a password; the person signs in with a method enabled in the environment (Magic Auth, social or SSO) or… |
workos_update_user | Update an AuthKit user: name, email (resets email_verified to false), email_verified, external_id, metadata or locale |
workos_delete_user | Permanently delete an AuthKit user with their memberships, identities and sessions |
workos_list_user_identities | The sign-in identities linked to a user: provider (e.g |
workos_list_user_sessions | A user's AuthKit sessions, newest first: id, status, auth_method, organization_id, ip_address, user_agent, impersonator, expires_at and… |
workos_revoke_session | End one AuthKit session (sign the user out of that device) |
workos_list_organization_memberships | List organization memberships (which user belongs to which organization, with role(s) and status active, inactive or pending) |
workos_get_organization_membership | One organization membership: user, organization, role(s), status, whether a directory manages it, and IdP custom attributes |
workos_create_organization_membership | Add an existing AuthKit user to an organization with one role (role_slug) or several (role_slugs) |
workos_update_organization_membership | Change the role(s) of an organization membership; the new role replaces the current one |
workos_deactivate_organization_membership | Deactivate a membership: the user keeps the account and the membership record but can no longer sign in to that organization |
workos_reactivate_organization_membership | Reactivate an inactive membership, with its previous role(s) |
workos_delete_organization_membership | Permanently remove a user from an organization |
workos_list_invitations | List invitations, newest first: email, state (pending, accepted, expired, revoked), organization, role, inviter, expires_at |
workos_get_invitation | One invitation by id with its state and expiry, without the token and accept link |
workos_send_invitation | Invite someone by email, optionally into an organization with a role |
workos_resend_invitation | Send the email of a pending invitation again, optionally in another language |
workos_revoke_invitation | Revoke a pending invitation so its link stops working |
workos_list_connections | List SSO connections, newest first: id, name, organization_id, connection_type (OktaSAML, AzureSAML, GoogleOAuth, GenericOIDC, ...), state… |
workos_get_connection | One SSO connection by id: connection type, state, organization and domains |
workos_list_directories | List Directory Sync directories (SCIM, Entra ID, Google Workspace, Okta, BambooHR, ...), newest first: id, name, type, state (linked… |
workos_get_directory | One directory: type, state, organization, domain and user and group counts |
workos_sync_directory | Ask WorkOS to sync a directory from its provider now |
workos_list_directory_users | List users synced from a directory or a directory group: name, emails, username, job title, state (active, suspended, inactive), role(s)… |
workos_get_directory_user | One directory user with everything the provider sent, including raw_attributes (can hold phone numbers, manager, department, employee ids) |
workos_list_directory_groups | List groups synced from a directory, or the groups of one directory user: id, name, idp_id. raw_attributes are left out |
workos_get_directory_group | One directory group by id: name, idp_id, directory, organization and the provider's raw_attributes |
workos_list_audit_log_actions | List the Audit Logs actions configured in the environment (e.g. user.signed_in, document.updated) with their latest schema |
workos_list_audit_log_schemas | List the schema versions of one Audit Logs action: allowed target types and the actor, target and metadata JSON schemas |
workos_create_audit_log_event | Write an event into an organization's audit log |
workos_create_audit_log_export | Start a CSV export of an organization's audit log events for a time range, optionally filtered by actions, actors and target types |
workos_get_audit_log_export | State of an audit log export (pending, ready, error) |
workos_get_audit_log_retention | How many days an organization's audit log events are kept (retention_period_in_days) |
workos_list_events | Read the environment's event stream (what happened in WorkOS and at the connected identity and directory providers): id, event type… |
workos_list_roles | List the environment roles (RBAC) with slug, name, description, permissions and type, the roles every organization starts with |
workos_get_role | One environment role by slug: name, description, type and its permission slugs |
workos_list_organization_roles | All roles available in one organization: the environment roles plus its own custom roles (slugs starting with org-), with permissions |
workos_list_permissions | List the RBAC permissions defined in the environment: slug, name, description |
示例提示
- “哪些组织的 SSO 连接还没有激活？”
- “列出组织 Acme Corp 的成员及其角色和状态。”
- “以 admin 角色邀请 [email protected] 加入组织 Acme Corp。”
- “哪些目录处于 invalid_credentials 状态，它们属于哪些组织？”
- “把 Acme Corp 十月份的审计日志导出为 CSV 文件。”
FAQ
Gemini CLI 从哪里读取 MCP 服务器？ 用户级配置位于 ~/.gemini/settings.json，项目级配置位于项目内的 .gemini/settings.json。gemini mcp list 会列出每个服务器及其连接状态。
下一步
这份指南对你有帮助吗?