Blog

Dec 11, 2025

Cloudflare: Code Mode Cuts Token Usage by 81%

Cloudflare's Code Mode generates code instead of calling MCP tools directly—cutting token usage by 32% for simple tasks and 81% for complex batch operations.

Top RBAC providers for multi-tenant SaaS in 2025

A practical guide to choosing the right role-based access control provider for modern multi-tenant SaaS apps.

WorkOS MCP Night: The Holiday Special

MCP Night, The Holiday Special, marked a historic moment: Anthropic donated MCP to the Linux Foundation, launching the Agentic AI Foundation. Demos from Cloudflare, Supabase, Datadog, Microsoft, and Google.

Cross App Access (XAA): The enterprise way to govern AI app integrations

How Cross-App Access (XAA)—the access pattern standardized at the IETF as the Identity Assertion JWT Authorization Grant (ID-JAG)—lets enterprises manage MCP AI app connections through their IdP, with centralized visibility, policy control, and no consent fatigue.

The Linux Foundation Launches the Agentic AI Foundation—MCP Finds Its Permanent Home

The Linux Foundation unites MCP, goose, and AGENTS.md under open governance. WorkOS breaks down what the new Agentic AI Foundation (AAIF) means for developers.

Dynamic Client Registration (DCR) in MCP: What it is, why it exists, and when to still use it

A practical guide to OAuth’s original MCP onboarding method: how DCR works, where it breaks at scale, and why it still matters alongside CIMD.

Client ID Metadata Documents (CIMD): How OAuth client registration works in MCP

Scalable, stateless client registration for AI agents: using a URL as your OAuth client ID to access MCP servers.

How AI makes OAuth 2.0 and OIDC non-negotiable for SaaS apps

OAuth 2.0 and OIDC are no longer just for SSO or integrations; they’re the trust layer that makes AI agents safe, scoped, and governable.

November Updates

Strengthened SSO Security with Sign-in Consent, CIMD Support for MCP Auth, AuthKit SDK for TanStack Start, & more

Amazon Nova Forge: Custom foundation models are no longer just for tech giants

‍AWS’s new “open training” approach could fundamentally reshape who gets to build frontier-grade AI models—and what they can do with their proprietary data.

MCP Async Tasks: Building long-running workflows for AI Agents

What MCP Tasks are, why they matter, and the full technical guide to implementing them.

The developer’s guide to SaaS multi-tenant architecture

A practical, end-to-end deep dive into data isolation, tenant-aware auth, scaling, and compliance for B2B SaaS.

CIMD vs DCR: The new default for MCP Client Registration in 2025

A technical guide to MCP client registration: Dynamic Client Registration (DCR) vs Client ID Metadata Documents (CIMD).

What is OAuth 2.0?

How modern apps get access to your data without your password.

FGA : How WorkOS is rethinking authorization for the next generation of SaaS

WorkOS FGA introduces a new approach to SaaS authorization that extends familiar RBAC into a flexible, hierarchical model designed for real product evolution. Learn why traditional RBAC and schema-driven FGA systems break down as applications grow, how WorkOS’ resource-scoped model avoids rewrites and role explosion, and how it supports enterprise identity mapping, high-cardinality architectures, and emerging AI agent workflows.