WorkOS is Good to agents.
Discry independently scored how well an AI agent can discover and understand the WorkOS API from what’s public — not whether it’s usable. Below: every signal we checked, what’s costing the score, and what to change.
SCORED UNDER RUBRIC 1.2 · A full re-launch under Discry Score 2.5 — a new behavioral instrument, not comparable to these scores — is in progress.
Discovery
45% of score · 83/100Comprehension
55% of score · 84/100What we found
- WorkOS has excellent agent-discovery infrastructure: llms.txt (65KB), llms-full.txt (1.6MB), public OpenAPI spec on GitHub, and presence across all three major MCP registries
- The docs site is heavily JavaScript-rendered, making direct scraping difficult — but the llms.txt files fully compensate by providing clean markdown for agent consumption
- WorkOS publishes a skills repo (workos/skills) for coding agents with auth implementation guidance, showing deliberate investment in the agent developer experience
- Rate limits are documented per endpoint category with specific numbers, enabling agents to implement proactive throttling — but error recovery guidance is thin beyond listing status codes
- The llms.txt at 65KB slightly exceeds the 50KB ideal but is well-organized with clear product descriptions and structured sections
What to change
Prioritized by impact on discoverability. You (or your docs platform) deploy these — Discry never touches your API.
- 01Add .well-known/mcp.json advertising available MCP server capabilities
- 02Enhance error documentation with actionable recovery steps (e.g., what to do on 401, how to handle connection configuration errors) — current guidance is minimal
- 03Trim llms.txt to under 50KB by moving detailed glossary/configuration content to llms-full.txt
- 04Add AGENTS.md to primary workos/workos-node or workos/authkit-nextjs repos for coding agent context
- 05Consider server-side rendering for docs pages to improve scrapability for agents that don't use llms.txt
Execution coverage · INFORMATIONAL, UNSCORED
Whether an agent can actually complete a call and recover from errors is the deeper Audit layer — documented here, but not part of the Discry Score.
API key authentication via Bearer token. Standard HTTP error codes (200, 400, 401, 403, 404, 429, 500) documented. Rate limits documented per endpoint: 6,000 requests per 60 seconds per IP (general), with specific limits for SSO and user management endpoints. Cursor-based pagination documented. No idempotency keys mentioned.