workos.com/docs
Finalizing the report
Preparing the stored Is Agentic score
Essential—
Recommended—
Bonus signals—
workos.com/docs
Preparing the stored Is Agentic score
workos.com/docs
These checks describe whether an ordinary agent can enter, read, and operate the public site.
Agents can reach the site
Crawler access and bot defenses.
Core content is available
Useful content remains accessible without a fragile browser-only path.
Navigation fails safely
Redirects and missing pages give agents a recoverable path.
Controls are understandable
Forms and interactive controls expose usable names and structure.
The public website is always evaluated. Optional surfaces appear when the scan finds positive evidence that they apply.
Strong
Weighted across 17 applicable checks
Strong
Weighted across 12 applicable checks
Ready with gaps
Weighted across 3 applicable checks
Ready with gaps
Weighted across 1 applicable check
Critical access gaps come first, followed by other applicable readiness gaps.
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
Make your API spec self-describing: a unique operationId and a description on every operation, typed parameters, and response schemas. For GraphQL, a fully typed schema with a documented cost or rate limit reads best.
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
Keep authentication enabled. Verify tool listing with an authorized MCP client. This unauthenticated scan cannot establish whether protected tools are missing or unusable.
Checks are grouped by relevance for App sites.
Homepage: 8772 chars, semantic headings (1 H1 + 6 H2s + 5 H3s), 10.0% content ratio. 5 of 5 sampled inner pages have text without JavaScript.
Site accessible to 4 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot).
No meta-refresh or JavaScript-redirect stubs across 19 checked pages
All 5 sampled pages are publicly readable (5 with substantive content)
OpenAPI spec found at https://workos.com/docs/openapi.json (version: 3.1.1)
Canonical URL serves text/markdown and text/html via Accept negotiation with Vary: Accept
OAuth authorization server metadata at https://signin.workos.com
OpenAPI declares security schemes but no named OAuth scopes - agents get all-or-nothing access. Declare per-scope grants (e.g. read:*, write:*) in the spec.
How to pass
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
API returns JSON error responses (401 at GET https://api.workos.com/agents/blueprints, an operation in the OpenAPI spec)
Nonexistent paths return HTTP 404 with markdown guidance for agents - the strongest 404 contract
In a search for your API docs, your docs came up at #1 (https://workos.com/docs/reference). In a search for your MCP server, SDK or CLI, we found your CLI at #2 (https://github.com/workos/cli), MCP server at #3 (https://workos.com/docs/mcp)
workos.com ranks #5 for "WorkOS" (searched your brand name alone: no main product term from your homepage qualified)
No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search.
Valid sitemap found at https://workos.com/sitemap.xml with multiple sitemaps entries
Rich JSON-LD identity: Corporation with name, description, url, and sameAs/logo/address (1 block)
Pricing page found at /pricing
Documentation site found at https://workos.com
When-to-use guidance found in llms.txt
All metadata signals present: canonical URL, lang="en", og:image, og:type
Organization schema complete with contactPoint and address
All trust anchor pages verified: About, Contact, Privacy
All 7 measured pages fit an agent context budget (largest ~3K tokens)
Code fences balanced across 1 markdown document
Developer portal found at https://workos.com
Documented REST API detected; endpoints require authentication (API key / OAuth), which is expected for agent access. GraphQL endpoint at https://api.workos.com/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7.
Low friction onboarding verified live: free tier available, self-serve key generation, sandbox/test environment, zero-auth access, zero-friction self-serve registration at /register
MCP server detected at https://mcp.workos.com/mcp; it requires authentication. Presence is verified (5/6), but Ora could not inspect its tools or verify access scopes without credentials.
How to pass
Keep authentication enabled. Verify tool listing with an authorized MCP client. This unauthenticated scan cannot establish whether protected tools are missing or unusable.
GraphQL rate-limit / cost headers found on introspection response: x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-reset (REST signal: fail 0).
OpenAPI defines a typed error schema in components.schemas and 4xx/5xx responses reference it
API versioning found (URL versioning (servers or paths)) but no deprecation or sunset policy detected - add Sunset/Deprecation headers or a deprecation policy page
How to pass
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
CLI package found on npm: workos
82% of operations define typed response schemas, 82% use application/json
REST: agent-friendly schema (269 operations, 100% with operationIds, 100% documented by description or summary) | GraphQL: introspection auth-gated and no schema evidence in docs | Combined score: 1/2
How to pass
Make your API spec self-describing: a unique operationId and a description on every operation, typed parameters, and response schemas. For GraphQL, a fully typed schema with a documented cost or rate limit reads best.
Compatible: 269/269 ops with IDs, 269/269 with typed schemas
Verified in the official MCP Registry as com.workos/mcp via domain-namespace
NPM package found: @workos-inc/node - "A Node wrapper for the WorkOS API"
Agent config found: github.com/workos/cli/blob/main/CLAUDE.md
MCP manifest has name and description but no icon at /.well-known/mcp.json
How to pass
Give the server card of each MCP server a display name (title), an icon (icons[].src), and a description - all three together are what reads as a complete, branded listing agents can present. Serve each card at <server URL>/server-card or list it in /.well-known/ai-catalog.json; the older /.well-known/mcp/server-card.json at your origin is still read.
Found in ChatGPT app directory: "WorkOS"
52 official skills published on skills.sh - 4,913 total installs (skills.sh/workos)
Structured pricing.md found at /pricing.md (67 lines)
MCP server discoverable at standard path https://workos.com/.well-known/mcp.json
Modular llms.txt files found for sections: guide, blog, changelog, docs, compare, reference
100% of 500 sampled sitemap entries carry lastmod; newest is 1 day(s) old
Found the llms.txt at https://workos.com/llms.txt.
The llms.txt is well-formatted: 49 lines with markdown links, 7,346 characters in total.
Rich skills.sh presence - 52 skills, 4,913 installs. Agents can understand capabilities in depth
Strong entity linking via sameAs: linkedin.com, github.com
All 5 probed llms.txt links resolve to real content
Path-suffix markdown docs served with text/markdown content-type: /auth.md
product MCP requires authentication with OAuth metadata discovery
RFC 8414 OAuth metadata for product MCP: issuer=https://signin.workos.com, auth and token endpoints present; client registration: CIMD (client_id_metadata_document_supported)
OAuth metadata for product MCP supports PKCE S256 code challenge
RFC 9728 metadata at https://mcp.workos.com: resource=https://mcp.workos.com/mcp, authorization_servers (1), bearer_methods_supported
auth.md at https://workos.com/auth.md served as text/markdown; charset=utf-8 (5000 chars)
auth.md at https://workos.com/auth.md - 3/8 walkthrough sections (found Register, Claim, and Use credential; missing Discover, Pick a method, Exchange, Errors, and Revocation); anchors: claim_token
How to pass
Structure /auth.md as the WorkOS spec prescribes: sections for Discover, Pick a method, Register, Claim, Exchange, Use the access_token, Errors, and Revocation, with spec anchor keywords (agent_auth, identity_endpoint, identity_assertion, service_auth, id-jag, WWW-Authenticate). Reference https://github.com/workos/auth.md.
Static fallback (deep check disabled): PRM + AS metadata both reachable with agent_auth.identity_endpoint (https://signin.workos.com/agent/identity); walkthrough discoverable end-to-end
PRM + AS metadata cross-linked (PRM discovered at https://mcp.workos.com) (AS metadata fetched from advertised origin https://signin.workos.com) with agent_auth.identity_endpoint (https://signin.workos.com/agent/identity) and identity_types_supported [service_auth] but agent_auth.skill (https://signin.workos.com/agent/auth.md) does not match the published /auth.md (https://workos.com/auth.md)
How to pass
Publish RFC 9728 protected-resource metadata at /.well-known/oauth-protected-resource on your resource server (the host that actually serves the API, e.g. api.<apex>) with resource and authorization_servers. Publish RFC 8414 authorization-server metadata at /.well-known/oauth-authorization-server on the AS origin, and include the WorkOS auth.md agent_auth block with identity_endpoint, identity_types_supported drawn from the spec enum (anonymous, identity_assertion, service_auth - the assertion variant, the ID-JAG URN urn:ietf:params:oauth:token-type:id-jag, belongs inside identity_assertion.assertion_types_supported, not at the top level), and the identity_assertion.assertion_types_supported block when you advertise that type, so agents can check their assertion shape is accepted before minting. Cross-link by listing the AS origin in PRM authorization_servers, and point agent_auth.skill back at your published /auth.md. Spec: https://github.com/workos/auth.md.
agent_auth endpoints reachable (source: AS metadata agent_auth block) - identity_endpoint: HTTP 405, claim_endpoint: HTTP 405, events_endpoint: not advertised
REST Idempotency-Key header found on POST /audit_logs/events in OpenAPI spec (GraphQL signal: fail 0).
Cursor-based pagination found in OpenAPI spec response schemas or query parameters
Async job pattern detected: 202 Accepted with a Location header or job-tracking fields on the 202 body
SDK packages found across 4 ecosystems: npm, pypi, go, rubygems
Sandbox environment found at https://workos.com/docs/sandbox
Server HTML is a well-structured document (main=true, landmarks=4/4, h1=1, maxHeadingSkip=1).
137 native controls, 0 non-native div-soup affordances (100% native).
136/137 interactive elements have a computable accessible name (99%).
No hidden instruction text detected in accessibility-tree attributes or off-screen content.
What does workos.com do and who is it for? Explain it back to me.
Sign me up for Vercel product updates and marketing emails.
Unsubscribe anytime. Privacy Notice
Source: Ora API
What does workos.com do and who is it for? Explain it back to me.
4 steps1 reasoning step
The agent successfully gathered a comprehensive overview of WorkOS by reading the homepage, pricing page, and docs index. The site publishes pricing and product details in machine-readable form (pricing.md, llms.txt), but lacks explicit competitive positioning and leaves several pricing mechanics ambiguous; the agent had to infer differentiators from migration guides rather than find them stated.