WorkOS

• Okta or a cloud identity provider could add Model Context Protocol authorization and agent-versus-bot screening to their own developer platforms, treating WorkOS's agent controls as a checkbox inside a suite the buyer already runs.
• The agent line is built around the Model Context Protocol, so if enterprises consolidate on a different agent-tool interface, AuthKit's MCP authorization server loses the protocol it depends on.
• No public evidence names a customer using Radar, AuthKit MCP, or FGA for AI agents rather than for employee login, so adoption of the scoped agent line remains unverified outside WorkOS's own framing.
• Agent security may never form as a standalone budget line if platforms like WorkOS fold it into authentication, which secures the surface for WorkOS but leaves the scoped line without an independent purchase decision to win.
• Revenue is an outside estimate rather than a disclosed figure, and an enterprise sales motion could consume the $100 million raised before agent-specific traction is proven publicly.

WorkOS frames the agent-access problem as a developer infrastructure gap rather than a threat-hunting one. Agents that call tools through the Model Context Protocol need an OAuth authorization server, should not carry long-lived secrets, and need their permissions scoped to specific tools instead of whole services. The company addresses this for engineering teams building AI-powered applications, the same buyer that already adopts its core authentication.

Corroboration for the problem exists outside WorkOS's own marketing. A MarkTechPost roundup of authentication platforms for AI agents describes tool-level permission scoping as the right abstraction for agentic access control, framing the same problem WorkOS sells against. SiliconANGLE tied the company's March 2026 funding to enterprises adopting agentic AI infrastructure and facing new access-control demands.

The buyer is specific and developer-led. WorkOS sells to the engineering teams shipping AI products, and its agent-facing controls target that audience at the moment those teams wire agents into Model Context Protocol servers and external tools. [s1, s10, s12]

The agent-security line spans three documented products. AuthKit acts as an OAuth 2.1 authorization server for Model Context Protocol servers, based on the current MCP specification, and works with the official MCP software development kits. Radar screens authentication attempts and can tell an AI agent acting for a user apart from a malicious bot, allowing or denying the attempt even when the credentials are valid. Fine-Grained Authorization, which WorkOS gained by acquiring Warrant, scopes an agent's access to individual tools rather than to a whole service.

The capabilities can be verified beyond WorkOS's marketing pages. Public documentation explains how to use AuthKit as the authorization server for an MCP server, and Radar's product page describes device fingerprinting across more than 20 characteristics to separate legitimate users from attackers. A free self-service tier makes the products directly testable.

WorkOS demonstrated the agent path in public rather than only describing it. At its October 2025 conference, Tobin South showed MCP.shop, a working application where a user shopped through a conversational agent backed by AuthKit, and MarkTechPost independently described the FGA tool-scoping model as fitting agentic access control. [s1, s4, s6, s12]

WorkOS positions itself as the enterprise identity layer for developers, and its agent controls extend that position rather than opening a separate product. A MarkTechPost roundup ranks it first among authentication platforms for AI agents and MCP servers, citing the combination of MCP-compatible OAuth, Fine-Grained Authorization for tool scoping, and audit logs under one independent vendor.

Against the standalone non-human-identity vendors, WorkOS competes from a different starting point. Where those vendors lead with discovery and inventory of machine identities, WorkOS leads with the authentication and authorization path that developers already integrate, and it reaches the agent buyer through the core auth relationship rather than a new sale.

Against incumbents, the contest is direct. The same roundup notes that WorkOS lets teams add MCP OAuth without replacing an existing identity provider such as Okta or Entra ID, positioning the product next to the incumbents that sell to the same developer buyer. [s12, s1, s11]

WorkOS runs a developer-led motion that converts free usage into enterprise contracts. Its pricing is published openly, the products are free at low volume, and enterprise features scale by connection and by monthly active users, a self-service entry that grows into a sales-assisted enterprise relationship.

The named-customer evidence is unusually strong for this corpus. WorkOS lists OpenAI, Anthropic, xAI, Cursor, Perplexity, and Vercel among its customers in the Series C announcement, and the about page quotes Vercel chief executive Guillermo Rauch and Cursor founder Arvid Lunnemark by name. Sacra estimates the company crossed 1,000 paying customers in early 2025 and reached roughly $30M in recurring revenue by October 2025.

The gap is that none of this adoption is tied publicly to the agent-security products. The customer roster and revenue confirm WorkOS broadly, while public materials do not name a customer running Radar, AuthKit MCP authorization, or Fine-Grained Authorization for AI agents specifically. The traction case is strong for the company and unproven for the scoped line. [s7, s8, s11, s9]

Founder and chief executive Michael Grinich runs WorkOS, is publicly identifiable, and authored the Series C announcement. The company describes itself as a remote team of more than 100 builders, and its product breadth across authentication, Radar, Vault, and Fine-Grained Authorization points to a functioning engineering organization.

Investor signals are verifiable in press. Meritech and Sapphire led the $100 million round with participation from existing investors, and SiliconANGLE reported the financing alongside other agentic AI infrastructure rounds. These are credible backers placing a $2 billion valuation on the company.

What the public record does not show is a prior exit or a sustained publication record from the founding team in identity or AI security. The investor confidence and shipping pace are real signals, but the team's domain pedigree is not independently documented in the way a repeat-founder story would be, which holds the evidence at an adequate level. [s7, s8, s10]

WorkOS sells to engineering teams that fold its authentication into their own products, so its trust posture is read through how directly a failure would reach customer systems. Radar and AuthKit sit in the authentication path, meaning an outage or compromise at WorkOS would affect customer sign-in and agent access rather than a peripheral function.

The customer roster doubles as procurement evidence. OpenAI, Anthropic, Cursor, and Vercel running WorkOS in production is the kind of reference that enterprise buyers weigh, and several of those customers speak on the record about the relationship, which lowers the friction of a third-party security review.

Public materials cover much of what a developer buyer evaluates, including transparent pricing and detailed product documentation. What did not appear in the reviewed pages, scoped to the agent-security line, is specific compliance attestation or a vulnerability disclosure policy presented as agent-product evidence, which a security-focused buyer would ask for before routing agent authorization through the platform. [s8, s9, s1]

Add analyzed competitors to compare them side by side with WorkOS.

WorkOS aims the agent line at enterprise engineering teams that hit enterprise identity requirements early. MarkTechPost frames the target as teams that need single sign-on, SCIM provisioning, fine-grained authorization, and audit logging wired into MCP server access control, and the buyer is the developer building an AI-powered application. The agent controls can expand an existing AuthKit relationship, though WorkOS also markets MCP OAuth as standalone middleware for teams that already have their own users and login, so the cited record does not establish whether current agent-product adoption is mostly expansion or net-new.

The segment widens because agent identity rides on the same auth contract. A team wiring an agent into Model Context Protocol servers needs an OAuth authorization server, scoped tool permissions, and a way to detect bot-originated authentication and allow or deny it under configured policy, including AI agents acting for users, and WorkOS offers all three to the buyer it already serves. That lets it reach the agent buyer through the core auth relationship instead of cold outreach.

The open segmentation question is whether agent security becomes its own purchase. WorkOS names OpenAI, Anthropic, xAI, Cursor, Perplexity, and Vercel as customers, but those are company-level customer references, and no fetched source ties any of them to the agent products. If buyers never separate agent security from login, WorkOS keeps the surface by default rather than by winning a distinct contest.

The agent line spans three documented products built on standard protocols. AuthKit acts as an OAuth 2.1 authorization server for Model Context Protocol apps based on the current MCP specification, Radar screens authentication attempts using proprietary device fingerprinting across more than 20 characteristics, and Fine-Grained Authorization scopes access to individual resources rather than a whole tenant. WorkOS documents FGA as a product that extends its RBAC system, and Sacra ties the capability to the Warrant acquisition. MarkTechPost describes the same tool-level scoping as the right abstraction for agentic access control.

Radar carries the one agent-specific capability that is not plain authentication. It can allow an AI agent that operates on a user's behalf while denying a malicious bot, blocking or permitting an attempt even when the credentials are correct. That distinction matters for agentic traffic, where a legitimate non-human caller and an attacker can both present valid credentials. FGA, by contrast, lists agents as a subject type whose support WorkOS still marks as coming soon, so today's agent scoping rests more on AuthKit and Radar than on FGA.

The verifiable footprint is solid for the category, with an independent roundup ranking WorkOS first among authentication platforms for agents and MCP servers. What holds up, though, is standards-based auth engineering with no demonstrated proprietary barrier. WorkOS presents Radar's detections as flexible settings tailored to the customer's app, and the tool-scoping policies are customer-defined, while the reviewed sources name no non-public cross-customer fingerprint corpus that a funded rival would have to reproduce.

WorkOS runs a developer-led motion that converts free usage into enterprise contracts. AuthKit is free up to 1 million monthly active users and the agent controls layer onto that account, so a team can adopt MCP authorization or Radar as an expansion of an existing relationship rather than a new procurement. MarkTechPost notes the self-serve path and tailored enterprise pricing.

Conversion at the company level is strong and independently corroborated. Sacra estimates WorkOS crossed 1,000 paying customers in early 2025 and reached roughly $30M in recurring revenue by October 2025, and SiliconANGLE reported the March 2026 round alongside other agentic AI infrastructure raises. The named roster spans OpenAI, Anthropic, xAI, Cursor, Perplexity, and Vercel.

The gap is that little of that traction is tied publicly to the agent products. The MCP page carries named MCP OAuth references, a founding engineer says Rube shipped on WorkOS in two weeks and Mux demonstrates an MCP integration, while no cited source names a customer running Radar or Fine-Grained Authorization specifically, so the company-level roster and revenue still stand apart from most of the scoped agent line.

WorkOS publishes its pricing, a transparency signal in a category where many rivals hide it. AuthKit is user-metered, free up to 1 million monthly active users and then $2,500 per additional million, while single sign-on and directory sync are connection-metered, priced per connection starting at $125 each with volume discounts. The published meters are users and connections, the units of the core auth business.

Radar does carry its own check-based meter rather than riding the AuthKit account for free. The published Radar price gives a first 1,000 checks free, then charges 100 dollars per month per 50k checks, so screening agent and user authentication attempts bills by volume of checks. That is a usage unit distinct from the per-user and per-connection model of employee login, even though MCP authorization rides the same AuthKit account and MarkTechPost describes the enterprise path as tailored pricing reached through sales.

The inferable belief is that buyers pay for authenticated identities, enterprise connections, and metered screening checks, not yet for agent governance packaged as a separate good. Whether WorkOS introduces an explicitly agent-specific or workload-specific unit as agent volume grows is the pricing question the public record does not settle.

WorkOS delivers the agent line as a hosted, developer-integrated service. AuthKit runs as a managed OAuth 2.1 authorization server the customer points its MCP server at, Radar is integrated directly into AuthKit and analyzes every authentication attempt, and WorkOS hosts the authorization and identity services the customer integrates through its API. The customer wires these in through software development kits rather than receiving a managed operation.

The operational surface sits in the authentication path. Because Radar and AuthKit screen and authorize every sign-in, an outage or compromise at WorkOS would reach customer sign-in and agent access rather than a peripheral function, which is the operational counterpart to the trust posture a security buyer evaluates. WorkOS publishes a trust center that exposes gated compliance reports including a SOC 2 bridge letter, and it disclosed a statement on an April 2026 Vercel security incident.

The delivery model is software the customer configures and runs, not a service that accepts accountability for outcomes. WorkOS supplies the authorization and screening infrastructure, and the integrating team owns how it is deployed inside its own application.

WorkOS backs the agent line with an inspectable trust center rather than self-displayed badges alone. The portal lists SOC 2 Type II, HIPAA, PCI DSS SAQ-D, GDPR, and CCPA, and exposes gated downloads including a SOC 2 Type II plus HIPAA report and a PCI attestation of compliance. That breadth is meaningful procurement assurance for an enterprise buyer routing authentication through the platform.

The attestations are enterprise-grade but read as table-stakes rather than a moat. They ease a security review without blocking a substitute, and the cited record identifies commercial attestations but no agent-line-specific regulatory mandate, so a determined replacement could clear the same bars. The trust center also published a statement on an April 2026 Vercel security incident, which a buyer should read alongside the certifications.

The trust gap specific to agents is verification of agent behavior. The certifications cover how WorkOS handles data and operates, while a buyer routing agent authorization through AuthKit and Radar would still confirm in a formal review how agent decisions are logged and audited, since the published collateral is scoped to the company rather than to the agent products.

WorkOS positions the agent controls as part of an independent enterprise-identity platform rather than a point tool. MarkTechPost describes it as an independent company focused solely on enterprise authentication whose roadmap is not split across a broader platform, and notes that teams can add MCP OAuth without replacing an existing user database or identity provider such as Okta or Entra ID. The platform claim rests on owning the authentication and authorization surface the agent apps call through.

That position is a coexistence play rather than a rip-and-replace. The MCP authorization server and its tool scoping sit alongside whatever directory the customer already runs, so the platform reach comes from being the auth layer developers already integrate rather than from a proprietary data network. Radar sits inside that account rather than atop an external directory, since WorkOS describes it as directly integrated into AuthKit and analyzing every authentication attempt there.

The exposure is that the incumbents sell to the same developer buyer. Sacra names AWS, Google, and Microsoft as cloud providers that can bundle identity into other services, and Auth0 under Okta also offers MCP authorization for teams already using its identity infrastructure, so the layer WorkOS occupies is ground the platforms are well positioned to contest.

WorkOS runs a sustained enterprise authentication business under a publicly identifiable founder. Chief executive Michael Grinich authored and signed the Series C announcement, and Sacra names him as chief executive of a company estimated at roughly $30M in recurring revenue with more than 1,000 paying customers. That profile is a team operating an identity business at scale rather than a set of stated intentions.

The backer bench is press-verified. Meritech and Sapphire led the $100 million round at a $2 billion valuation, with participation from Audacious, Craft, Abstract, and Greenoaks, and SiliconANGLE reported the financing alongside other agentic AI infrastructure rounds. That is credible capital placed on the company's direction.

The execution signal that matters for the agent line is product breadth shipped from one auth core. WorkOS built AuthKit MCP authorization, Radar, and Fine-Grained Authorization from the Warrant acquisition onto the same platform, though the public record does not surface a prior exit or a sustained publication record from the founding team in identity or AI security.