• SECURITY
  • COMPLIANCE
  • MONITORING
  • HUMAN

How to audit identity events with your AI

Connect WorkOS once. After that, your AI handles the heavy lifting of pulling and analyzing security logs.

Ask AI about this page

Short answer

How can I audit identity events with my AI?

Your AI uses the WorkOS connector to fetch specific event streams for any organization you specify. It identifies access changes and security events so you can monitor compliance without manual log digging. You get a clear breakdown of what happened and who did it.

Where every issue lands.

Audit outcomes

The AI processes raw event data into these specific results.

SECURITY

Access change alerts

The AI flags unauthorized or unexpected permission changes. You get a list of exactly which users gained or lost access.

COMPLIANCE

Audit log summaries

It pulls raw event streams and turns them into readable reports. This makes proving compliance much easier.

MONITORING

Organization activity

The AI tracks specific organizations to show you a timeline of identity events. You see the full history of what occurred.

HUMAN

Manual intervention

The AI identifies suspicious patterns but won't lock accounts or change permissions. You decide if an event requires a response.

The workflow

What your AI does when the event arrives.

The AI acts as a bridge between your WorkOS data and your chat interface.

  1. Fetch event streams

    The AI reaches into WorkOS to grab the latest security and identity logs for your target organization.

    get_audit_log_events

  2. Filter for changes

    It sifts through the raw data to find specific identity or access modifications you actually care about.

    get_audit_log_events

  3. Identify actors

    The AI maps event data to specific users or service accounts to show who triggered an action.

    get_audit_log_events

  4. Report findings

    It presents the filtered logs in a clean format, highlighting any anomalies or critical security shifts.

    get_audit_log_events

Try it

Copy these to start.

Use these prompts to begin your audit.

Starting points

Swap out the organization IDs and event types with your actual WorkOS data.

WorkOS Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_rwxMA9lZDQOsPAB4YWRqrtYcwkF7I80gqKgTYNRP/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — WorkOS capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "workos-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_rwxMA9lZDQOsPAB4YWRqrtYcwkF7I80gqKgTYNRP/mcp"
    }
  }
}
Copy into chat04

  • Get the last 50 audit log events for organization 'org_123'.

  • Show me all recent access changes for the 'Acme Corp' organization.

  • List all identity events related to user 'user_987' from the last 24 hours.

  • Find any suspicious permission changes in the audit logs for my production org.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect WorkOS once, then ask.

Just link your account once. Your credentials stay encrypted, and you can immediately start asking questions about your logs.

Connect WorkOS to your AI

FAQ

How this task behaves

  • 01

    Can the AI delete audit logs?

    No. The AI can only read event streams using the get_audit_log_events tool. It has no permission to delete or modify logs.

  • 02

    Can the AI revoke user access?

    No. The AI identifies access changes, but it cannot perform administrative actions like revoking permissions or deleting users.

  • 03

    Does it work for all organizations?

    Yes, as long as you provide the correct organization ID for the logs you want to pull.

  • 04

    Can I filter by specific dates?

    Yes, you can ask the AI to look for events within a specific timeframe or date range.

  • 05

    How does it handle large log volumes?

    The AI pulls the data through the connector and processes it, so you can ask it to summarize or find specific needles in the haystack.

  • More questions about WorkOS? The Connector page answers them. See everything the WorkOS Connector can do

Connect WorkOS to Claude, Cursor, ChatGPT & more