Connect
Optimize
Secure
Announcing StackOne Defender: leading open-source prompt injection guard for your agent • Read More →
Production-ready Smartsheet MCP server with 78 extensible actions — plus built-in authentication, security, and optimized execution.
Coverage
Create, read, update, and delete across Smartsheet — and extend your agent's capabilities with custom actions.
Authentication
Per-user OAuth in one call. Your Smartsheet MCP server gets session-scoped tokens with zero credentials stored on your infra.
Agent Auth →Security
Every Smartsheet tool response scanned for prompt injection in milliseconds — 88.7% accuracy, all running on CPU.
Prompt Injection Defense →Performance
Free up to 96% of your agent's context window to enhance reasoning and reduce cost, on every Smartsheet call.
Tools Discovery →A Smartsheet MCP server lets AI agents read and write Smartsheet data through the Model Context Protocol — Anthropic's open standard for connecting LLMs to external tools. StackOne's Smartsheet MCP server ships with 78 pre-built actions, fully extensible via the Connector Builder — plus managed authentication, prompt injection defense, and optimized agent context. Connect it from MCP clients like Claude Desktop, Cursor, and VS Code, or from agent frameworks like OpenAI Agents SDK, LangChain, and Vercel AI SDK.
Every action from Smartsheet's API, ready for your agent. Create, read, update, and delete — scoped to exactly what you need.
Retrieve a paginated list of the authenticated user's Smartsheet contacts via GET /contacts
Retrieve a specific contact's details by ID via GET /contacts/{contactId}
Retrieve a paginated list of all dashboards (sights) accessible to the user via GET /sights
Retrieve a dashboard's full configuration and widgets via GET /sights/{sightId}
Start a new discussion thread on a sheet via POST /sheets/{sheetId}/discussions
Retrieve a paginated list of all discussions on a sheet via GET /sheets/{sheetId}/discussions
Duplicate a folder and its contents to a destination folder or workspace via POST /folders/{folderId}/copy
Rename a folder via PUT /folders/{folderId}
Move a folder to a different folder or workspace via POST /folders/{folderId}/move
Permanently delete a folder and all its contents via DELETE /folders/{folderId}
Create a new group in the organization via POST /groups, optionally seeding it with initial members by email
Retrieve a paginated list of all groups in the organization via GET /groups, useful for auditing group membership and managing access control
Retrieve a specific group and its full member list via GET /groups/{groupId}
Update a group's name, description, or transfer ownership via PUT /groups/{groupId}
Permanently delete a group from the organization via DELETE /groups/{groupId}
Add one or more members to an existing group via POST /groups/{groupId}/members
Remove a specific member from a group via DELETE /groups/{groupId}/members/{userId}
Retrieve a paginated list of all reports accessible to the user via GET /reports
Retrieve a report's data and configuration via GET /reports/{reportId}
Create a new sheet by importing data from a CSV or XLSX file via POST /sheets/import
Create a copy of a sheet to a specified folder or workspace via POST /sheets/{sheetId}/copy
Search for text within a specific sheet via GET /search/sheets/{sheetId}
Retrieve a paginated list of all sheets accessible to the authenticated user via GET /sheets
Retrieve a full sheet including rows, columns, and cell data via GET /sheets/{sheetId}, with extensive filtering and include options
Move a sheet to a different folder or workspace via POST /sheets/{sheetId}/move
Update a sheet's name, project settings, or user-level display settings via PUT /sheets/{sheetId}
Permanently delete a sheet and all its data via DELETE /sheets/{sheetId}
Add one or more columns to a sheet via POST /sheets/{sheetId}/columns, supporting bulk insertion in a single request
Retrieve all column definitions for a sheet via GET /sheets/{sheetId}/columns, including type, title, and configuration
Retrieve a single column's definition by ID via GET /sheets/{sheetId}/columns/{columnId}
Update a column's title, type, position, or configuration via PUT /sheets/{sheetId}/columns/{columnId}
Permanently delete a column and all its cell data from a sheet via DELETE /sheets/{sheetId}/columns/{columnId}
Add one or more rows with cell data to a sheet via POST /sheets/{sheetId}/rows, with flexible positioning control
Retrieve a specific row and its cell data from a sheet via GET /sheets/{sheetId}/rows/{rowId}
Update cell values, row positions, or expand/collapse state for one or more rows via PUT /sheets/{sheetId}/rows
Delete one or more rows from a sheet via DELETE /sheets/{sheetId}/rows, using comma-separated row IDs as a query parameter
Add a new user to the Smartsheet organization via POST /users, requiring System Admin permissions
Retrieve a paginated list of all users in the Smartsheet organization via GET /users, with optional filtering by email and seat type
Retrieve a specific user's profile by their numeric user ID via GET /users/{userId}
Update a user's role assignments or profile attributes via PUT /users/{userId}, requiring System Admin permissions
Permanently remove a user from the Smartsheet organization via DELETE /users/{userId}, with optional asset transfer
Create a new webhook subscription via POST /webhooks, targeting a specific sheet or other scoped object
Retrieve a paginated list of all webhooks owned by the authenticated user via GET /webhooks
Retrieve a specific webhook's configuration and status via GET /webhooks/{webhookId}
Update a webhook's enabled state, event subscriptions, or custom headers via PUT /webhooks/{webhookId}
Permanently delete a webhook via DELETE /webhooks/{webhookId}, immediately stopping all callbacks
Create a new workspace via POST /workspaces to organize sheets, reports, and dashboards
Duplicate a workspace and its contents via POST /workspaces/{workspaceId}/copy, with control over which elements are included
Retrieve a paginated list of all workspaces accessible to the authenticated user via GET /workspaces
Retrieve a workspace and its contents by ID via GET /workspaces/{workspaceId} (deprecated, prefer workspace metadata and children endpoints)
Rename a workspace via PUT /workspaces/{workspaceId}
Permanently delete a workspace and all its contents via DELETE /workspaces/{workspaceId}
Attach a URL to a sheet via POST /sheets/{sheetId}/attachments
(DEPRECATED path, sunsetting June 2026) Create a new subfolder within an existing folder via POST /folders/{folderId}/folders
(DEPRECATED) Create a new sheet from scratch or from a template in the user's Sheets folder (Home) via POST /sheets. The Sheets folder is being replaced by workspaces.
Create a new sheet in a workspace via POST /workspaces/{workspaceId}/sheets, either from scratch with column definitions or from a template
Create a new top-level folder in a workspace via POST /workspaces/{workspaceId}/folders
Retrieve a paginated list of all attachments on a sheet via GET /sheets/{sheetId}/attachments
Retrieve all automation rules on a sheet via GET /sheets/{sheetId}/automationrules
Retrieve all cross-sheet references on a sheet via GET /sheets/{sheetId}/crosssheetreferences
Retrieve an audit trail of events in the organization via GET /events
Retrieve the authenticated user's favorited items via GET /favorites
Retrieve a paginated list of top-level personal folders from the user's Home via GET /folders/personal
(DEPRECATED, sunsetting June 2026) Retrieve a folder and its contents by ID via GET /folders/{folderId}. Use get_folder_metadata and list_folder_children instead.
Retrieve folder metadata (name, dates, permalink) via GET /folders/{folderId}/metadata
List immediate child resources of a folder (sheets, reports, dashboards, subfolders, templates) via GET /folders/{folderId}/children
Retrieve the hierarchical path to a folder via GET /folders/{folderId}/path
Retrieve all proofs on a sheet via GET /sheets/{sheetId}/proofs
Search for text across all accessible sheets, reports, and dashboards via GET /search
(DEPRECATED) Retrieve a paginated list of sharing permissions on a sheet via GET /sheets/{sheetId}/shares
(DEPRECATED) Retrieve a paginated list of user-created templates via GET /templates. Use list_folder_children or workspace children with childrenResourceTypes=sheets,templates instead.
Retrieve the profile of the currently authenticated user via GET /users/me, useful for verifying credentials and obtaining the caller's account context
Retrieve a user's alternate email addresses via GET /users/{userId}/alternateemails
Retrieve top-level folders in a workspace via GET /workspaces/{workspaceId}/folders (deprecated, use workspace children endpoint instead)
(DEPRECATED) Share a sheet with users or groups via POST /sheets/{sheetId}/shares
Deactivate a user via POST /users/{userId}/deactivate, blocking all Smartsheet access while preserving their data and permissions
Reactivate a previously deactivated user via POST /users/{userId}/reactivate, restoring full Smartsheet access
Reset a webhook's shared secret via POST /webhooks/{webhookId}/resetSharedSecret
One endpoint. Any framework. Your agent is talking to Smartsheet in under 10 lines of code.
MCP Clients
Agent Frameworks
{
"mcpServers": {
"stackone": {
"command": "npx",
"args": [
"-y",
"mcp-remote@latest",
"https://api.stackone.com/mcp?x-account-id=<account_id>",
"--header",
"Authorization: Basic <YOUR_BASE64_TOKEN>"
]
}
}
}185+ actions
138+ actions
134+ actions
134+ actions
133+ actions
133+ actions
126+ actions
Anthropic's code_execution processes data already in context. Custom MCP code mode keeps raw tool responses in a sandbox. 14K tokens vs 500.
11 min
Benchmarking BM25, TF-IDF, and hybrid search for MCP tool discovery across 916 tools. The 80/20 TF-IDF/BM25 hybrid hits 21% Top-1 accuracy in under 1ms.
10 min
MCP tools that read emails, CRM records, and tickets are indirect prompt injection vectors. Here's how we built a two-tier defense that scans tool results in ~11ms.
12 min
origin_owner_id.All the tools you need to build and scale AI agent integrations, with best-in-class connectivity, execution, and security.