Smartsheet MCP Server: Setup, Tools & Real Limits
Smartsheet's official MCP server gives AI clients controlled access to live work data, but safe deployment depends on narrow permissions and disciplined writes.
Smartsheet MCP is the official bridge that lets compatible AI clients find, read, analyze, and change live Smartsheet assets through conversational tool calls. It is useful for portfolio questions and bounded updates, but it is not an autonomous project manager: permissions, API ceilings, sampled results, and irreversible write tools still define what is safe.
- What Smartsheet MCP actually is
- What exists today
- Setup
- Tools you get
- Permissions and blast radius
- Real limits
- When not to use it
What Smartsheet MCP actually is
Smartsheet MCP is a hosted translation layer between an MCP client and Smartsheet's public API. An agent can search assets, inspect columns and rows, summarize work, update rows, create reports, and manage comments without copying sheet data into a prompt.
The model chooses server-defined tools, the server calls Smartsheet, and the authenticated user's access still applies. Smartsheet's official introduction describes this flow and supported clients. For how tools differ from resources and prompts, see the MCP Directory capabilities guide.
The best use is a bounded request with a named asset and explicit output: “On the Launch Plan sheet, show overdue Marketing rows, then draft—but do not apply—status changes.” Avoid “clean up our portfolio” with write access. Ambiguity is expensive in a shared operating sheet.
What exists today
There is now a first-party Smartsheet MCP server, so we would choose it over community wrappers for almost every deployment. It is hosted by Smartsheet, generally available, and offered at regional endpoints for the United States, Europe, and Australia; there is no official package to install locally.
Smartsheet documents https://mcp.smartsheet.com, https://mcp.smartsheet.eu, and https://mcp.smartsheet.au in its installation guide. The official service has vendor-maintained tool schemas and OAuth support in named clients, and it requires a Business, Enterprise, or Advanced Work Management plan.
A community server fits only when self-hosting or a deliberately smaller tool set is mandatory. You then own authentication, pagination, retries, schema changes, and incidents. Start with the official endpoint; build a wrapper only for a documented control requirement. Compare other vendor-backed choices in the MCP Directory official collection.
Setup
Setup means registering the correct regional HTTP endpoint in your AI client and authenticating with OAuth or a personal access token. Prefer OAuth for interactive use; use a token where the client lacks Smartsheet OAuth or for a controlled custom integration.
Confirm these prerequisites:
- An eligible Smartsheet plan and production-environment access.
- An MCP-compatible client supporting remote HTTP servers.
- The client's Smartsheet OAuth flow or an API token stored outside source control.
Then follow these steps:
- Choose the endpoint matching the account's data region.
- Register that URL using the client's own UI, command, JSON, or TOML format.
- Authenticate. With OAuth, approve only needed scopes; with a token, use an environment variable.
- List Smartsheet tools, then test read-only by finding a known sheet and retrieving its columns.
- Add write access only after reviewing tools, approvals, and account sharing.
For clients using Gemini CLI's documented settings.json shape, Smartsheet publishes this exact example:
{
"mcpServers": {
"smartsheet-mcp": {
"httpUrl": "https://mcp.smartsheet.com",
"headers": {
"Authorization": "Bearer ${SMARTSHEET_API_TOKEN}"
}
}
}
}
Do not paste it into another client unless it supports the same keys. Use its documentation or the MCP Directory config generator for the native format.
Tools you get
The official server exposes dozens of tools across discovery, sheets, rows, collaboration, reports, dashboards, charts, sharing, and favorites. We would validate the following common read-to-write path first.
| Tool name | What it does | Required scope |
|---|---|---|
search | Finds accessible assets by name or content | READ_SHEETS |
browse_workspace | Lists assets and folders in a workspace | READ_SHEETS |
get_sheet_summary | Returns selected, filtered, or sorted sheet data | READ_SHEETS |
find_in_sheet | Locates text and returns matching cell positions | READ_SHEETS |
get_columns | Retrieves column IDs, types, and metadata | READ_SHEETS |
add_rows | Inserts rows into a sheet | WRITE_SHEETS |
update_rows | Changes existing row and cell values | WRITE_SHEETS |
delete_rows | Permanently removes selected rows | WRITE_SHEETS |
get_cell_history | Retrieves a cell's change history | READ_SHEETS |
create_report | Creates a report from sheets or workspaces | READ_SHEETS |
add_comment | Adds a comment to an existing discussion | WRITE_SHEETS |
list_shares | Lists users and groups shared to an asset | ADMIN_WORKSPACES, SHARE_SHEETS, SHARE_SIGHTS |
These names and scopes come from Smartsheet's live MCP tool catalog. Query the self-describing server before fixing a workflow because availability can change. For other products, use the MCP Directory's best MCP servers rather than stale aggregator configuration.
Permissions and blast radius
Start read-only, and treat every write as a production change. READ_SHEETS covers search, discovery, summaries, and many audits; row changes require WRITE_SHEETS, while structural changes can require ADMIN_SHEETS.
OAuth scopes do not override Smartsheet sharing levels. Smartsheet's OAuth documentation notes that WRITE_SHEETS cannot update a sheet where the user is only a viewer. That contains risk, but a highly privileged human token still gives the agent a wide working area.
For unattended use, create a dedicated integration identity and share only required assets. Separate read and write connections, require confirmation for writes, and disable destructive tools unless essential. Before bulk updates, retrieve the affected rows, show IDs and proposed values, and request approval.
A careless write has specific consequences: delete_column removes a column and all its data with no rollback; changing a column type can lose data and break formulas, reports, dashboards, and automations. The tool documentation labels these operations destructive. Chat convenience does not create an undo button.
Real limits
The main limit is how much correct data fits into one tool result and model context. get_sheet_summary caps data at roughly 8,000 tokens and may sample large sheets, while search returns at most 100 results without pagination. A plausible summary can be incomplete.
Use filters, select only needed columns, and paginate where supported. For totals, compliance, or reconciliation, never infer completeness from sampled output; use a deterministic API job that walks every page. The tool catalog documents the token cap, AND-only filters, case-sensitive column names, and eventual search consistency. New assets may take minutes to appear.
The underlying API adds hard ceilings. Most endpoints allow 300 requests per minute per token; file uploads and cell-history requests count 10 times and are effectively limited to 30 per minute. Concurrent same-sheet updates can collide, so serialize and batch writes. Smartsheet's scalability guide documents HTTP 429 handling and error 4004 for concurrent updates.
Other constraints are structural:
- Add or update no more than 500 rows per API call.
- Keep a sheet at or below 500,000 cells and each cell at 4,000 characters.
- A paged report request returns at most 10,000 rows; reports top out at 50,000 rows.
- The API cannot create or update sheet filters.
These figures come from Smartsheet's API limitations. Asking the model differently will not bypass them.
When not to use it
Do not use Smartsheet MCP for exhaustive, repeatable processing, strict transactions, or the smallest security surface. A plain API script is better for nightly synchronization, every-row reconciliation, deterministic retries, audit logs, and testing exact payloads.
Use Smartsheet's own AI when users work inside Smartsheet and need formula generation, summaries, or column enrichment without another AI client. The Smartsheet AI feature page places native features inside the product, while MCP brings live work to external assistants.
Our rule: choose MCP for interactive, human-reviewed exploration; choose an API script for repeatable operations; choose native Smartsheet AI when work should remain in the sheet interface. Avoid autonomous destructive edits unless you have backups, narrow access, validation, and a tested recovery plan.