workos

workos is a documentation and routing skill for the WorkOS platform. Rather than answering directly, its SKILL.md acts as a router that matches a user request — a docs URL, a term, a dashboard field, or an implementation, debugging, or migration task — to one of many bundled reference files, which the agent must read before producing any answer, URL, or code. It covers the full WorkOS surface: AuthKit, SSO/SAML, Directory Sync, RBAC, FGA, MFA, Vault, Audit Logs, Admin Portal, Pipes, Feature Flags, Radar, webhooks, Custom Domains, the workos CLI, and migrations from Auth0, Clerk, Cognito, Firebase, Supabase, Stytch, Descope, and Better Auth.

The skill's defining feature is a strong set of guardrails aimed squarely at preventing fabrication. It instructs the agent never to invent CLI commands (verifying against the registered command tree instead), never to invent dashboard click-paths (citing stable docs URLs and describing destinations conceptually), to prefer the WorkOS MCP server for workspace-management tasks when connected, to prefer WORKOS_MODE=agent when invoking the CLI from a coding-agent session, and to be explicit when a task is not supported by the CLI. It bundles per-language SDK references (Node, Python, Ruby, Go, PHP/Laravel, .NET, Kotlin, Elixir), per-framework AuthKit guides (Next.js, React, React Router, SvelteKit, TanStack Start, vanilla JS), API references, and migration guides, plus an evals file.

Target users are developers implementing, debugging, or migrating to WorkOS authentication and enterprise-readiness features. Use cases include finding the correct docs URL or dashboard field, wiring up SSO or Directory Sync, and migrating from another auth provider. The content is defensive and security-conscious — it documents standard WORKOS_* environment variables and official CLI/MCP authentication and warns against fabricated commands — with no exfiltration, destructive operations, or unsafe execution.