All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This analysis is scoped to WorkOS agent identity and access line.
WorkOS sells identity software to engineering teams, and its agent products control what AI agents can access in their applications. Its AuthKit product issues the credentials an agent needs for MCP, the protocol agents use to call application tools. Airlock, its early-access product, checks each agent call against the agent’s intent and allows, denies, or sends it to a person. Founded in 2019, WorkOS raised a $100 million Series C led by Meritech and Sapphire at a $2 billion valuation. It names OpenAI, Anthropic and Cursor among more than 3,000 customers. A customer that runs sign-in and authorization rules on WorkOS would have to rewire both to leave. Auth0 under Okta and Stytch also sell MCP authorization servers, so WorkOS competes on how much of AuthKit and Airlock customers wire in.
| Description | WorkOS AuthKit provides an OAuth 2.1 authorization server for MCP applications, letting developers add fine-grained authorization to the agentic apps and workflows built on their MCP tools. | [f1] |
|---|---|---|
| Founded | 2019 | [f2] |
| HQ | San Francisco, California, US | [f3] |
| Latest funding | Series C, $100M, March 2026, led by Meritech and Sapphire ($2B valuation) | [f4] |
| Deployment | SaaS | [f5] |
| Compliance | SOC 2 Type 2 | [f5] |
| Product | What it does |
|---|---|
| WorkOS AuthKit | WorkOS AuthKit: OAuth 2.1 authorization server for MCP applications that handles agent authorization flows and token validation, enabling fine-grained authorization for agentic workflows. |
| WorkOS Radar | WorkOS Radar: real-time sign-in protection that uses device fingerprinting to detect bots and abuse, and can allow or deny a bot's authentication attempt under settings the customer configures. |
| WorkOS FGA | WorkOS Fine-Grained Authorization: resource-scoped roles and permissions that extend WorkOS RBAC, with users and groups as the supported subject types. |
| WorkOS Airlock | WorkOS Airlock: early-access authorization layer that evaluates each AI agent call against the task's intent and allows it, denies it, or sends it to a human. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
WorkOS AuthKit is an OAuth 2.1 authorization server for MCP applications that handles agent authorization flows and token validation, enabling fine-grained authorization for agentic workflows. It is mapped to the AI Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | WorkOS states the agent-access problem concretely: its Airlock page says least privilege requires hard-coding permissions while an agent’s job is unknown until runtime. MarkTechPost independently calls tool-level permission scoping the right abstraction for agentic access control, but neither source quantifies the harm from agents holding too much access. [s19, s9, s15] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | WorkOS documents AuthKit as a spec-compatible OAuth authorization server for MCP, Radar’s fingerprinting across more than 20 device signals, and sub-50ms p95 access checks in Fine-Grained Authorization. Outside its own pages, MarkTechPost describes AuthKit working with the official MCP SDKs, and Cloudflare publishes an MCP server example that uses AuthKit permissions to gate an agent’s tools. [s13, s3, s4, s9, s14] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | The enabler is the Model Context Protocol, which MarkTechPost dates to November 2024, and WorkOS had proposed auth.md by May 2026 and introduced Airlock in August 2026. The buyer-side demand in the cited sources is one kind of signal, press coverage of the category that relays a Gartner adoption projection, so timing is plausible rather than corroborated. [s9, s15, s20] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Founder Michael Grinich signed the Series C announcement and gave the keynote that introduced Airlock, and Sacra names him chief executive. The cited sources document the identity business he built at WorkOS and carry no prior founder exit or sustained publication record, which fits verifiable relevant experience. [s6, s20, s8] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | WorkOS’s MCP page quotes a founding engineer who shipped a product called Rube on WorkOS MCP OAuth in two weeks, and Cloudflare lists WorkOS among its MCP authorization integrations. Those references cover AuthKit alone and no cited source names a customer of Radar, Fine-Grained Authorization or Airlock for agents, so WorkOS’s 3,000-plus company customer figure is context for the agent line. [s1, s17, s14] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | At product-line scope the capital figures belong to WorkOS as a whole and are not broken out for the agent line. They are a $100 million Series C in March 2026 and a Sacra estimate of $30 million in annual recurring revenue in October 2025. The line shows visible shipping, with Airlock in August 2026, while its own economics are undisclosed. [s10, s6, s8, s15, s20] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | MarkTechPost places WorkOS beside Stytch and Auth0 by Okta as MCP-compatible OAuth authorization servers and says FGA enables tool-level permission scoping for agentic access control. Cloudflare’s own integration example uses AuthKit to authenticate users and manage the permissions granted to AI agents. Two outside publishers place the line in agent authentication and authorization, a clearly emerging category, while the intent-based access control label Airlock sells under is WorkOS’s own. [s9, s14, s20] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Customers using AuthKit for sign-in and MCP authorization would need to change those integrations to switch providers. Sacra says Google, Amazon and Microsoft have the resources to match WorkOS features, and MarkTechPost lists Auth0 by Okta and Stytch as MCP authorization servers too. The cited sources show no proprietary data behind the line. [s13, s8, s9] |
WorkOS frames the agent-access problem as authorization that has to be decided while an agent runs. Its Airlock page says least privilege requires hard-coding permissions, while an agent’s job is unknown until runtime. The MCP page addresses the builder side of the same problem, letting developers give AI agents access to an app through OAuth 2.1 flows, tool permissions and scopes.
MarkTechPost describes the need from outside WorkOS. Its roundup of authentication platforms for AI agents calls tool-level permission scoping the right abstraction for agentic access control. Its auth.md write-up says handing an agent a raw API key produces credentials that are unscoped, hard to audit per session and impossible to revoke selectively. Neither article quantifies the harm.
The buyer is the engineering team shipping software that agents use. MarkTechPost names enterprise engineering teams that need single sign-on, SCIM provisioning, fine-grained authorization and audit logging wired to MCP server access control. [s19, s1, s9, s15]
The agent line spans four products. AuthKit acts as a spec-compatible OAuth authorization server for MCP servers, and its Agent Registration feature lets AI agents obtain identity credentials from an AuthKit-powered service. WorkOS also authors auth.md, an open protocol under which an app issues an agent a scoped token tied to the user. WorkOS Connect can supply only the MCP OAuth flows for teams that already run their own login.
Radar and Fine-Grained Authorization come from the core platform. Radar analyzes more than 20 device signals and can allow or deny a sign-in it determines is coming from a bot, which lets a customer admit AI agents acting for a user. Sacra reports that WorkOS acquired Warrant to add fine-grained authorization. Fine-Grained Authorization’s documentation lists users and groups as the supported subjects today, with additional subject types coming soon.
Airlock, introduced at WorkOS’s Agent Night in August 2026, is the product built around agent behavior. It evaluates every agent call against the task’s intent and allows it, denies it or sends it to a human. It combines static rules with runtime checks and logs every request and verdict, and WorkOS offers it in early access. [s13, s22, s21, s1, s3, s2, s8, s4, s19, s20]
WorkOS competes for the agent buyer from an enterprise identity platform. MarkTechPost lists WorkOS first among authentication platforms for AI agents and MCP servers, calling it a strong choice for enterprise identity plus MCP-compatible auth. The same roundup notes that WorkOS, Stytch and Auth0 by Okta each serve as MCP-compatible OAuth authorization servers.
The identity incumbents sell to the same developers. Sacra names Auth0, now part of Okta, as the established leader in customer identity and says Google, Amazon and Microsoft have the resources to match WorkOS features. Cloudflare’s MCP announcement offers integrations with Stytch, Auth0 and WorkOS side by side.
WorkOS pitches coexistence with a customer’s existing identity stack. MarkTechPost notes teams can add MCP OAuth without replacing a user database or an identity provider such as Okta or Entra ID. Airlock adds call-by-call authorization of agent actions on top of token issuance. [s9, s8, s14, s19]
WorkOS runs a self-serve developer motion. The platform is free to start with no credit card needed until production, and WorkOS User Management is free for up to 1 million monthly active users. Radar’s first 1,000 checks are free before it charges by volume.
Company-level adoption is broad. WorkOS’s customers page lists OpenAI, Anthropic and Cursor among its customers and says more than 3,000 companies are powered by WorkOS. Sacra estimates the company reached $30 million in annual recurring revenue in October 2025, after crossing 1,000 paying customers in early 2025. Cursor’s founder is quoted on the WorkOS homepage saying Cursor now completely runs on WorkOS.
The references tied to agent products are AuthKit MCP builders. WorkOS’s MCP page quotes a founding engineer who shipped a product called Rube on WorkOS MCP OAuth in two weeks and another builder who integrated an MCP server in days. The page also shows a Mux and WorkOS MCP integration demonstration, and Mux appears on the customers page. No cited source names a customer of Radar, Fine-Grained Authorization or Airlock for agents. [s5, s3, s17, s8, s11, s1]
Michael Grinich founded WorkOS and leads it. He signed the March 2026 Series C announcement, Sacra names him chief executive, and he gave the Agent Night keynote that introduced Airlock.
Investor backing is independently reported. SiliconANGLE reports that Meritech Capital Partners and Sapphire Ventures led the $100 million round at a $2 billion valuation. Audacious, Craft, Abstract and Greenoaks also participated, and WorkOS describes itself as a team of more than 100 builders.
The team’s shipping on the agent line is visible in 2026. WorkOS released the auth.md protocol, which MarkTechPost covered in May, and introduced Airlock in August. The cited sources document no prior founder exit. [s6, s8, s20, s10, s12, s15]
WorkOS publishes its security posture on its own site. Its security page lists SOC 2 Type 2 certification, GDPR and CCPA compliance, annual third-party penetration tests and external code audits. It also says WorkOS can sign HIPAA business associate agreements for customers on enterprise plans.
Trust carries weight because customers run these products in their sign-in path. AuthKit is the authorization server an MCP server delegates to and Radar screens authentication attempts, so a WorkOS failure would affect customer sign-in and agent access. WorkOS says it runs at five nines of uptime across thousands of customers.
Airlock adds an audit record for agent actions. WorkOS says every request and every verdict is logged, so security teams have a complete record of what agents do. [s16, s13, s3, s6, s19]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Aembit | competes with | Competes for the enterprise buyer securing how AI agents and workloads authenticate to the services they call. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Oasis Security | competes with | Competes for spending on AI agent and non-human identity controls, where WorkOS sells agent authorization. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Token Security | competes with | Overlaps on AI agent identity, the surface WorkOS addresses through AuthKit and Airlock. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Auth0 | competes with | MarkTechPost lists Auth0 by Okta beside WorkOS as an MCP-compatible OAuth authorization server for the same developer buyer. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Descope | competes with | Sacra names Descope among the alternative approaches to identity infrastructure that WorkOS competes with. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Stytch | competes with | MarkTechPost and Cloudflare each list Stytch beside WorkOS as an authorization provider for MCP servers. | N/AWe scored these companies at different scopes, so the totals measure different things. |
Add analyzed competitors to compare them side by side with WorkOS.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Customers that build sign-in and agent access on WorkOS take on real work to leave. AuthKit issues the tokens applications and MCP servers rely on, and Fine-Grained Authorization stores resource-scoped role assignments. Airlock runs between agents and the tools they call, so a customer using those products would re-plumb authentication and re-create authorization rules to switch. The products are hosted software the customer configures. A funded competitor can earn the same certifications WorkOS lists, and no cited source names a dataset or patent WorkOS accumulates. Auth0 under Okta and Stytch also offer authorization servers for MCP, so WorkOS competes on how much of AuthKit and Airlock customers wire into their applications.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | AuthKit and Radar are hosted software priced by users and checks with a free start, and the customer’s team writes the rules and owns the outcomes. That is software sold as the product, with Airlock following the same model in early access. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Once AuthKit issues the tokens an application and its MCP server rely on and Fine-Grained Authorization holds resource-scoped roles, leaving means re-plumbing authentication and re-creating authorization data. That is integration work, and the cited sources document the mechanism without sizing a departure from WorkOS. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | WorkOS’s security page lists SOC 2 Type 2, GDPR and CCPA compliance, third-party penetration tests and HIPAA business associate agreements on enterprise plans. A funded competitor can obtain those through ordinary enterprise preparation, and the cited sources tie no authorization or mandate to the agent line. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | The line runs a spec-compatible OAuth authorization server for MCP, screens sign-ins with fingerprinting across more than 20 device signals, and answers resource-scoped access checks at sub-50ms p95. Airlock adds runtime judgment of agent calls against intent, and building those real-time security systems takes specialized expertise. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | MarkTechPost names enterprise engineering teams that need single sign-on, provisioning and audit logging as the buyer, and the agent line’s named references are software builders shipping MCP servers. The cited sources name no regulated-enterprise or government buyer of the agent products, so the evidenced class is software teams with some IT governance. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | AuthKit is the OAuth authorization server MCP servers delegate to for agent tokens, and Airlock runs between an agent and the integrations it calls. That places the line in infrastructure other applications depend on. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | What WorkOS calls proprietary device fingerprinting in Radar is a technique applied to each authentication attempt, and Airlock logs each customer’s agent requests and verdicts. No cited source names a retained dataset, content licence or granted patent that WorkOS accumulates across customers. |
WorkOS aims the agent line at engineering teams building software that AI agents use. MarkTechPost names enterprise engineering teams that need single sign-on, SCIM provisioning, fine-grained authorization and audit logging wired to MCP server access control. WorkOS’s MCP page offers the same builders OAuth 2.1 flows, tool permissions and scopes for agents.
WorkOS reaches that segment two ways. Teams on AuthKit can add MCP authorization and Agent Registration inside an existing account. WorkOS Connect serves teams that already have users and login and want only the MCP OAuth flows, with no migration.
The customer base is recorded at company level. WorkOS’s customers page lists OpenAI, Anthropic and Cursor and says more than 3,000 companies are powered by WorkOS. The cited references specific to agents are builders who shipped MCP servers on AuthKit.
AuthKit carries the most documented agent capability. WorkOS documents it as a spec-compatible OAuth authorization server for MCP servers. Cloudflare publishes a remote MCP server example in which WorkOS permissions decide whether a user can grant an agent access to an image generation tool. Agent Registration lets agents obtain identity credentials once enabled for an environment, and under auth.md an app issues an agent a short-lived, revocable token tied to the user.
Airlock is the capability built around how agents behave. It judges every agent call against the task’s intent and allows the call, denies it or sends it to a human. Static rules set fixed limits on integrations, and runtime rules judge what those cannot. WorkOS offers Airlock in early access and demonstrated it live at its August 2026 Agent Night.
Radar and Fine-Grained Authorization are platform capabilities that agent traffic also passes through. Radar analyzes more than 20 device signals and can allow or deny a sign-in from a bot, including AI agents a customer wants to admit on a user’s behalf. Fine-Grained Authorization answers resource-scoped access checks at sub-50ms p95. Its documentation lists users and groups as supported subjects, with additional subject types coming soon.
WorkOS sells through self-serve developer adoption. The platform is free to start with no credit card needed until production, while customers can request early access to Airlock and ask WorkOS to enable auth.md on an account.
Company-level adoption is broad by WorkOS’s own count and an outside estimate. WorkOS says more than 3,000 companies are powered by it. Sacra estimates $30 million in annual recurring revenue in October 2025 and more than 1,000 paying customers in early 2025.
The references tied to agent products are AuthKit MCP builders. WorkOS’s MCP page quotes a founding engineer who shipped a product called Rube on WorkOS MCP OAuth in two weeks. It also shows a Mux and WorkOS MCP integration demonstration, and Mux appears on the customers page. No cited source names a customer of Radar, Fine-Grained Authorization or Airlock for agents.
WorkOS publishes prices for the core products the agent line builds on. WorkOS User Management is free for up to 1 million monthly active users. Radar’s first 1,000 checks are free before it charges $100 a month per 50,000 checks.
The pricing page lists no price for Airlock or for enabling auth.md on a WorkOS account. Airlock is reached by requesting early access, and WorkOS enables auth.md on an account on request. Any app can publish an auth.md file without a WorkOS account.
WorkOS delivers the agent line as hosted services a customer integrates. AuthKit handles the OAuth authorization server while the customer builds the MCP tools and resource endpoints. Radar blocks or challenges suspicious sign-ins based on the settings the customer configures.
Airlock places WorkOS in the path of agent actions. In the Agent Night demo it ran between the agent and Pipes, the WorkOS integrations product, and governed calls with deterministic and non-deterministic policies. WorkOS says it runs at five nines of uptime across thousands of customers.
The customer’s team owns policy and outcomes. Customers write Airlock’s rules in natural language, configure Radar’s settings and assign Fine-Grained Authorization roles through the API, so results depend on how each team sets them.
WorkOS’s security page lists SOC 2 Type 2 certification, GDPR and CCPA compliance, annual third-party penetration tests and external code audits. WorkOS can also sign HIPAA business associate agreements on enterprise plans, which eases a security review of a vendor whose software handles customer sign-in.
For agents, WorkOS offers an audit record. Airlock logs every request and every verdict so security teams can see what agents did, and Radar blocks or challenges suspicious authentication attempts.
WorkOS builds the agent line into a broader identity platform. Its Series C announcement says the company expanded from authentication into granular permissions, integrations, encryption, abuse detection, feature flags and MCP. In its launch demo, Airlock governed agent calls made through Pipes, the WorkOS integrations product.
The platform coexists with other identity systems. MarkTechPost notes teams can add MCP OAuth without replacing Okta, Entra ID or an internal directory. Cloudflare lists WorkOS as one of three MCP authorization integrations, alongside Stytch and Auth0.
auth.md reaches past WorkOS accounts. WorkOS authors the protocol, and its page says any app can publish an auth.md file or any agent can read one with no WorkOS account required.
Michael Grinich founded WorkOS and introduced Airlock in his August 2026 Agent Night keynote. Sacra names him chief executive, and WorkOS describes a team of more than 100 builders.
SiliconANGLE reports that Meritech Capital Partners and Sapphire Ventures led the $100 million Series C at a $2 billion valuation. Audacious, Craft, Abstract and Greenoaks also participated.
The team had proposed auth.md by May 2026 and introduced Airlock in August. The cited sources document no prior founder exit.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | WorkOS: Secure auth for MCP servers | official | 2026-09-16 |
| f2 | Sacra WorkOS company profile | research | 2026-09-16 |
| f3 | Craft WorkOS headquarters and office locations | research | 2026-06-14 |
| f4 | WorkOS raises $100M Series C hits $2B valuation | official | 2026-09-16 |
| f5 | AI Defense Matrix Catalog entry | other | 2026-06-13 |
| f6 | AI Defense Matrix Catalog mapping | other | 2026-06-23 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.