The news
WorkOS released guidance on connecting AI agents to company APIs. The post states that REST works well for human developers but that MCP serves agents better. It treats the two as separate layers rather than competing choices.
Context
Teams have been choosing between REST and MCP, sometimes by preference and sometimes by necessity. WorkOS notes that most MCP servers already call REST endpoints internally to perform the actual work. The company recommends keeping REST in place and adding MCP on top, focused on agent goals instead of exposing every endpoint as a tool.
The distinction arises because human developers interact with APIs through documentation, trial requests, and iterative calls that match their own mental models of the system. Agents operate differently. They receive goals, plan sequences, and execute without the same need for exhaustive endpoint visibility. WorkOS frames the choice as one of audience rather than replacement. Existing REST surfaces stay untouched while a narrower MCP interface sits above them.
Details
The layered model also requires shipping OAuth 2.1 with scoped tokens. WorkOS AuthKit already implements that specification, which removes the need to build a separate auth provider. The post points to a longer breakdown on the WorkOS site that compares MCP and REST directly. It emphasizes that the strongest MCP servers avoid one-to-one mapping of REST endpoints and instead surface only the operations agents pursue.
In practice this means an MCP server might expose a single capability such as “create customer record with verified email” even when the underlying REST API contains separate calls for user creation, email verification, and permission assignment. The server handles the orchestration internally by calling those REST endpoints in sequence. Agents receive fewer, higher-level tools and spend less time discovering which combinations are safe or complete. The same scoped OAuth 2.1 tokens that protect the REST layer can be passed through, preserving existing authorization rules without duplication.
WorkOS positions its own AuthKit product as the component that supplies the required OAuth 2.1 implementation out of the box. Teams already using the service can therefore add the MCP layer without introducing a new authentication system or reworking token issuance logic.
Why it matters
Developers integrating agents now face a practical decision about protocol layering rather than wholesale replacement of existing APIs. The approach keeps current REST surfaces intact while adding a narrower interface tuned to agent behavior. Companies that already use WorkOS AuthKit gain an immediate path to scoped OAuth 2.1 without new infrastructure. Teams that treat MCP as a simple wrapper over every REST route risk exposing more surface area than needed. The distinction matters most for organizations that must support both human developers and autonomous agents against the same backend systems. WorkOS’s framing reduces the problem to choosing the right layer for each audience instead of picking a single standard.
This separation also affects long-term maintenance. REST endpoints can continue to evolve according to the needs of human clients and internal services. The MCP layer can be adjusted independently as agent capabilities change, without forcing updates across the entire API surface. Organizations that skip the layering step and attempt to serve agents directly from raw REST endpoints may find themselves maintaining two inconsistent sets of documentation and access controls. The WorkOS guidance makes the cost of that duplication explicit by showing how the protocols can coexist without conflict.
For teams evaluating agent integration today, the concrete takeaway is to audit existing REST endpoints only for the operations agents will actually request, then implement MCP servers that call those endpoints rather than replicate them. The OAuth 2.1 requirement follows automatically once the decision to layer is made. Companies already invested in WorkOS tooling can move faster on the authentication piece; others will need to ensure their token system meets the scoped-token rules before deploying the MCP surface.
---
Sources:
{"word_count": 682, "sources_used": 1}
No comments yet