Smartsheet MCP Server: Tools, Setup and Security

The Smartsheet MCP server lets an AI app search, read and update sheets, rows, columns, reports, discussions and workflows. Smartsheet publishes and hosts it, with separate servers for the US, EU and Australia. It needs a Business, Enterprise or Advanced Work Management plan.

Checked against: Install the Smartsheet MCP server on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

Smartsheet's MCP server tools page is long and detailed. Highlights by group:

• Discovery: search, list_workspaces, browse_workspace and browse_folder.
• Sheets: get_sheet_summary, find_in_sheet, get_sheet_version, get_sheet_path and create_sheet.
• Columns and rows: get_columns, add_columns, add_rows, update_rows, delete_rows, update_column and delete_column.
• Attachments and discussions: list_attachments, attach_url, list_discussions, create_discussion and add_comment.
• Reports: list_reports, get_report and create_report.
• Workflows: get_workflows, create_workflow, update_workflow, enable_workflow, disable_workflow and delete_workflow, in an automations toolset.
• Dashboards and charts: list_dashboards, create_dashboard_with_ai, get_chart_suggestions and add_charts_to_dashboard.
• Portfolios and scenario planning: list_portfolios, create_portfolio, list_projects and scenario tools, in portfolio and scenario_planning toolsets.
• Solutions: create_workspace_assets uses an AI agent to build a multi-asset solution from a description.

Smartsheet marks many tools as destructive and irreversible, including update_rows, update_column, delete_rows, delete_column, delete_attachment, delete_discussion, update_workflow and delete_portfolio. get_cell_history returns the change history for a single cell, which helps when you need to check what an agent changed.

How to connect it

Smartsheet lists OAuth sign-in, with no token needed, for ChatGPT, Claude AI, Claude Desktop, Gemini Enterprise Plus and Microsoft 365 Copilot. Other clients need an API token. Smartsheet links setup guides for Amazon Quick, ChatGPT, Claude, Claude Code, Codex, Cursor, Gemini CLI, Gemini Enterprise Plus and Microsoft 365 Copilot.

For manual setup, Smartsheet's manual configuration guide gives this Gemini CLI example:

{
  "mcpServers": {
    "smartsheet-mcp": {
      "httpUrl": "https://mcp.smartsheet.com",
      "headers": {
        "Authorization": "Bearer ${SMARTSHEET_API_TOKEN}"
      }
    }
  }
}

Swap in the EU or AU URL if your account lives there. Smartsheet notes the variable name is your choice.

Security notes

Smartsheet is one of the clearer vendors on tool risk. It marks every tool, which makes approval rules easier to set.

• Destructive tools. Many tools are labeled destructive and irreversible, from row and column changes to portfolio deletes. Require human approval for all of them. Our page on MCP tool annotations explains how clients use labels like this.
• Scopes. Read-only tools need only READ_SHEETS. Write and delete tools need scopes such as WRITE_SHEETS or ADMIN_SHEETS. Start with read-only access where you can; see least privilege for MCP.
• Token storage. Smartsheet recommends environment variables for API tokens, so secrets are not committed or shared with config files. Rotating a token then means updating one variable.
• Prefer OAuth. Where your AI app supports Smartsheet OAuth, you avoid storing a long-lived token at all.
• Region. Use the server in your account's region so data stays where your contract expects it.

The MCP security hub has more.

Alternatives

• monday.com MCP server for board-based work management.
• Asana MCP server for task and project tracking.
• Google Workspace MCP servers if your trackers live in Google Sheets.

Next step

Smartsheet's labeled tools make it a good candidate for a careful pilot. Start with read-only reporting, then add write tools with approval. eSEOspace can help plan that pilot in an MCP readiness audit. Compare other servers in the MCP server directory.

Frequently asked questions