Agent readiness · Authentication as a service
workos.com
10 of 14 measurable points under formula 9.2, measured on 2026-08-12. 15 checks exist; each is one HTTP request with a published rule, so every sentence below can be rerun and argued with. 2 of them could not be measured from where we ask, and those are left out of the denominator rather than counted as failures.
A · Discovery
- PASSAnswers an agent user-agentAnswered 200 to LetAgentsIn/1.0 (+https://letagentsin.com/methodology)
- PASSllms.txt publishedllms.txt and llms-full.txt present at https://workos.com/llms.txt and https://workos.com/llms-full.txt, and the 12 links we sampled across both files all answer
- PASSDocs readable without JavaScript13,436 characters of text without JS, on https://workos.com/docs/authkit/api-keys rather than on https://workos.com/docs
- FAILOn-demand agents not blockedrobots.txt permits them, but your edge answered Claude-User 404 at https://workos.com/docs, which a browser is served
- N/APaths robots.txt points at answerrobots.txt names no concrete path, only patterns or nothing, so there is no claim to check
- PASSNo punishing crawl delayNo Crawl-delay applies to the agents we check
B · Agent entry
- FAILAgent entry pointNone of the 9 known agent entry paths returns a file rather than your page shell
- PASSOAuth dynamic client registrationregistration_endpoint published, but none of the 3 advertised grants (authorization_code, refresh_token, urn:ietf:params:oauth:grant-type:device_code) finishes without a person at a browser
- PASSMCP surfaceLive MCP endpoint at https://mcp.workos.com/mcp, answered 401 with an auth challenge
C · Registration
- UNMEASUREDNo CAPTCHA in the signup HTMLUnmeasurable: the signup form at https://workos.com/signup is not in the server HTML, so its gates are not eitherServer-render the form, or tell us the endpoint it posts to, and the gates become visible to us and to an agent.
- UNMEASUREDSignup reachable without a browserUnmeasurable: https://workos.com/signup answers 403 to an agent and 403 to a Chrome user-agent, so nothing gets in from here and the difference we test for cannot be seenNothing for you to do here. It becomes measurable from a network your edge admits.
D · Provisioning
- PARTProgrammatic key provisioning1 of 7 provisioning phrases across the 6 documents we read: "management api"
- PASSFree tier or no-card trial stated in textFree tier or no-card signals at https://workos.com/pricing: "$0"
E · Integration
- PASSTyped SDK on the registry@workos-inc/node@10.9.0 ships types, matched from the registry by who publishes it rather than by a link on your site
- PASSMachine-readable API descriptionDocs serve markdown to machines, at https://workos.com/docs/pipes/api-keys
Tell me when this changes
The failures here are the kind nobody notices. An edge rule that starts refusing agents changes nothing a person sees in a browser, so the first sign is usually an integration that quietly stopped working. We rescan weekly and write only when a verdict moves.
This page is the newest scan we hold for workos.com and changes when we rescan. It is not a judgement of the product: we measure whether an unattended run can get through, not whether the thing is any good. The whole corpus is published as JSON and CSV.