Connect
Optimize
Secure
Announcing StackOne Defender: leading open-source prompt injection guard for your agent • Read More →
StackOne's Smartsheet MCP server gives AI agents 189 ready-to-use actions for Smartsheet — with built-in authentication, security, governance, token efficiency, and high tool-calling accuracy.
Coverage
Create, read, update, and delete across Smartsheet — and extend your agent's capabilities with custom actions.
Authentication
Per-user OAuth in one call. Your Smartsheet MCP server gets session-scoped tokens with zero credentials stored on your infra.
Agent Auth →Security
Every Smartsheet tool response scanned for prompt injection in milliseconds — 88.7% accuracy, all running on CPU.
Prompt Injection Defense →Performance
Free up to 96% of your agent's context window to enhance reasoning and reduce cost, on every Smartsheet call.
Tools Discovery →A Smartsheet MCP server lets AI agents read and write Smartsheet data through the Model Context Protocol — Anthropic's open standard for connecting LLMs to external tools. StackOne's Smartsheet MCP server ships with 189 pre-built actions, fully extensible via the Connector Builder — plus managed authentication, prompt injection defense, and optimized agent context. Connect it from MCP clients like Claude Desktop, Claude Code, Cursor, Goose, and VS Code, or from agent frameworks like OpenAI Agents SDK, LangChain, and Vercel AI SDK.
Every action from Smartsheet's API, ready for your agent. Create, read, update, and delete — scoped to exactly what you need.
Retrieve a paginated list of all attachments on a sheet via GET /sheets/{sheetId}/attachments
Retrieve a specific attachment by ID via GET /sheets/{sheetId}/attachments/{attachmentId}
Delete an attachment from a sheet via DELETE /sheets/{sheetId}/attachments/{attachmentId}
Retrieve all versions of an attachment via GET /sheets/{sheetId}/attachments/{attachmentId}/versions
Delete all versions of an attachment via DELETE /sheets/{sheetId}/attachments/{attachmentId}/versions
Retrieve all automation rules on a sheet via GET /sheets/{sheetId}/automationrules
Retrieve a specific automation rule via GET /sheets/{sheetId}/automationrules/{automationRuleId}
Update an automation rule via PUT /sheets/{sheetId}/automationrules/{automationRuleId}
Delete an automation rule via DELETE /sheets/{sheetId}/automationrules/{automationRuleId}
Retrieve a paginated list of the authenticated user's Smartsheet contacts via GET /contacts
Retrieve a specific contact's details by ID via GET /contacts/{contactId}
Create a cross-sheet reference between two sheets to define a data range for formulas via POST /sheets/{sheetId}/crosssheetreferences
Retrieve all cross-sheet references on a sheet via GET /sheets/{sheetId}/crosssheetreferences
Retrieve a specific cross-sheet reference via GET /sheets/{sheetId}/crosssheetreferences/{crossSheetReferenceId}
Duplicate a dashboard to a destination folder or workspace via POST /sights/{sightId}/copy
Retrieve a paginated list of all dashboards (sights) accessible to the user via GET /sights
Retrieve a dashboard's full configuration and widgets via GET /sights/{sightId}
Move a dashboard to a different folder or workspace via POST /sights/{sightId}/move
Update a dashboard's name via PUT /sights/{sightId}
Delete a dashboard via DELETE /sights/{sightId}
Retrieve the publish status of a dashboard via GET /sights/{sightId}/publish
Set the publish status of a dashboard via PUT /sights/{sightId}/publish
Start a new discussion thread on a sheet via POST /sheets/{sheetId}/discussions
Retrieve a paginated list of all discussions on a sheet via GET /sheets/{sheetId}/discussions
Retrieve a specific discussion by ID via GET /sheets/{sheetId}/discussions/{discussionId}
Delete a discussion and all its comments via DELETE /sheets/{sheetId}/discussions/{discussionId}
Add a reply comment to an existing discussion thread via POST /sheets/{sheetId}/discussions/{discussionId}/comments
Retrieve a single comment by ID from a sheet via GET /sheets/{sheetId}/comments/{commentId}
Delete a comment from a sheet via DELETE /sheets/{sheetId}/comments/{commentId}
Start a discussion on a specific row via POST /sheets/{sheetId}/rows/{rowId}/discussions
Retrieve all discussions on a specific row via GET /sheets/{sheetId}/rows/{rowId}/discussions
Add one item to the current user's favorites via POST /favorites
Retrieve the authenticated user's favorited items via GET /favorites
Remove a single favorite by type and ID via DELETE /favorites/{favoriteType}/{favoriteId}
Duplicate a folder and its contents to a destination folder or workspace via POST /folders/{folderId}/copy
Rename a folder via PUT /folders/{folderId}
Move a folder to a different folder or workspace via POST /folders/{folderId}/move
Permanently delete a folder and all its contents via DELETE /folders/{folderId}
Create a new group in the organization via POST /groups, optionally seeding it with initial members by email
Retrieve a paginated list of all groups in the organization via GET /groups, useful for auditing group membership and managing access control
Retrieve a specific group and its full member list via GET /groups/{groupId}
Update a group's name, description, or transfer ownership via PUT /groups/{groupId}
Permanently delete a group from the organization via DELETE /groups/{groupId}
Add one or more members to an existing group via POST /groups/{groupId}/members
Remove a specific member from a group via DELETE /groups/{groupId}/members/{userId}
Create a new proof on a row via POST /sheets/{sheetId}/rows/{rowId}/proofs
Retrieve all proofs on a sheet via GET /sheets/{sheetId}/proofs
Retrieve a specific proof by ID via GET /sheets/{sheetId}/proofs/{proofId}
Update a proof on a sheet via PUT /sheets/{sheetId}/proofs/{proofId}
Delete a proof from a sheet via DELETE /sheets/{sheetId}/proofs/{proofId}
Start a discussion on a proof via POST /sheets/{sheetId}/proofs/{proofId}/discussions
Retrieve discussions on a proof via GET /sheets/{sheetId}/proofs/{proofId}/discussions
Send proof requests (review invitations) via POST /sheets/{sheetId}/proofs/{proofId}/requests
Delete proof requests from a proof via DELETE /sheets/{sheetId}/proofs/{proofId}/requests
Create a new version of a proof via POST /sheets/{sheetId}/proofs/{proofId}/versions
Retrieve all versions of a proof via GET /sheets/{sheetId}/proofs/{proofId}/versions
Delete a proof version via DELETE /sheets/{sheetId}/proofs/{proofId}/versions
Create a new report via POST /reports
Retrieve a paginated list of all reports accessible to the user via GET /reports
Retrieve a report's data and configuration via GET /reports/{reportId}
Delete a report via DELETE /reports/{reportId}
Retrieve the publish status of a report via GET /reports/{reportId}/publish
Set the publish status of a report and return the new status including any enabled publish URLs via PUT /reports/{reportId}/publish
Add source sheets or workspaces to a report's scope via POST /reports/{reportId}/scope
Remove source sheets or workspaces from a report's scope via DELETE /reports/{reportId}/scope
Create a new sheet by importing data from a CSV or XLSX file via POST /sheets/import
Create a copy of a sheet to a specified folder or workspace via POST /sheets/{sheetId}/copy
Search for text within a specific sheet identified by sheetId via GET /search/sheets/{sheetId}, returning matching rows for the given query string with an optional numericDates flag to receive dates as Unix epoch timestamps.
Retrieve a paginated list of all sheets accessible to the authenticated user via GET /sheets
Retrieve a full sheet including rows, columns, and cell data via GET /sheets/{sheetId}, with extensive filtering and include options
Move a sheet to a different folder or workspace via POST /sheets/{sheetId}/move
Update a sheet's name, project settings, or user-level display settings via PUT /sheets/{sheetId}
Permanently delete a sheet and all its data via DELETE /sheets/{sheetId}
Retrieve a specific share on a sheet via GET /sheets/{sheetId}/shares/{shareId}
Update a share's access level on a sheet via PUT /sheets/{sheetId}/shares/{shareId}
Remove a share from a sheet via DELETE /sheets/{sheetId}/shares/{shareId}
Retrieve sharing permissions on a report via GET /reports/{reportId}/shares
Retrieve a specific share on a report via GET /reports/{reportId}/shares/{shareId}
Update a share's access level on a report via PUT /reports/{reportId}/shares/{shareId}
Remove a share from a report via DELETE /reports/{reportId}/shares/{shareId}
Retrieve sharing permissions on a dashboard via GET /sights/{sightId}/shares
Retrieve a specific share on a dashboard via GET /sights/{sightId}/shares/{shareId}
Update a share's access level on a dashboard via PUT /sights/{sightId}/shares/{shareId}
Remove a share from a dashboard via DELETE /sights/{sightId}/shares/{shareId}
Retrieve sharing permissions on a workspace via GET /workspaces/{workspaceId}/shares
Retrieve a specific share on a workspace via GET /workspaces/{workspaceId}/shares/{shareId}
Update a share's access level on a workspace via PUT /workspaces/{workspaceId}/shares/{shareId}
Remove a share from a workspace via DELETE /workspaces/{workspaceId}/shares/{shareId}
Add one or more columns to a sheet via POST /sheets/{sheetId}/columns, supporting bulk insertion in a single request
Retrieve all column definitions for a sheet via GET /sheets/{sheetId}/columns, including type, title, and configuration
Retrieve a single column's definition by ID via GET /sheets/{sheetId}/columns/{columnId}
Update a column's title, type, position, or configuration via PUT /sheets/{sheetId}/columns/{columnId}
Permanently delete a column and all its cell data from a sheet via DELETE /sheets/{sheetId}/columns/{columnId}
Add one or more rows with cell data to a sheet via POST /sheets/{sheetId}/rows, with flexible positioning control
Copy rows from one sheet to another via POST /sheets/{sheetId}/rows/copy
Retrieve a specific row and its cell data from a sheet via GET /sheets/{sheetId}/rows/{rowId}
Update cell values, row positions, or expand/collapse state for one or more rows via PUT /sheets/{sheetId}/rows
Move rows from one sheet to another via POST /sheets/{sheetId}/rows/move
Delete one or more rows from a sheet via DELETE /sheets/{sheetId}/rows, using comma-separated row IDs as a query parameter
Create a summary field on a sheet via POST /sheets/{sheetId}/summary/fields
Retrieve a paginated list of summary fields for a sheet via GET /sheets/{sheetId}/summary/fields
Update a summary field on a sheet via PUT /sheets/{sheetId}/summary/fields
Delete one or more summary fields from a sheet via DELETE /sheets/{sheetId}/summary/fields
Retrieve the publish status of a sheet via GET /sheets/{sheetId}/publish
Set the publish status of a sheet via PUT /sheets/{sheetId}/publish
Retrieve all sent update requests on a sheet via GET /sheets/{sheetId}/sentupdaterequests
Retrieve a specific sent update request via GET /sheets/{sheetId}/sentupdaterequests/{sentUpdateRequestId}
Delete a sent update request via DELETE /sheets/{sheetId}/sentupdaterequests/{sentUpdateRequestId}
Create an update request on a sheet via POST /sheets/{sheetId}/updaterequests
Retrieve all update requests on a sheet via GET /sheets/{sheetId}/updaterequests
Retrieve a specific update request via GET /sheets/{sheetId}/updaterequests/{updateRequestId}
Update an existing update request via PUT /sheets/{sheetId}/updaterequests/{updateRequestId}
Delete an update request via DELETE /sheets/{sheetId}/updaterequests/{updateRequestId}
Add a new user to the Smartsheet organization via POST /users, requiring System Admin permissions
Retrieve a paginated list of all users in the Smartsheet organization via GET /users, with optional filtering by email, seat type, and plan ID, plus a displayContributorSeatType flag for free-tier seat visibility
Retrieve a specific user's profile by their numeric user ID via GET /users/{userId}
Update a user's role assignments or profile attributes via PUT /users/{userId}, requiring System Admin permissions
Permanently remove a user from the Smartsheet organization via DELETE /users/{userId}, with optional asset transfer
Add one or more alternate email addresses for a user via POST /users/{userId}/alternateemails (Enterprise only, requires System Admin)
Retrieve a user's alternate email addresses via GET /users/{userId}/alternateemails
Retrieve a specific alternate email for a user via GET /users/{userId}/alternateemails/{alternateEmailId} (Enterprise only, requires System Admin)
Remove an alternate email address from a user via DELETE /users/{userId}/alternateemails/{alternateEmailId} (Enterprise only, requires System Admin)
Create a new webhook subscription via POST /webhooks, targeting a specific sheet or other scoped object
Retrieve a paginated list of all webhooks owned by the authenticated user via GET /webhooks
Retrieve a specific webhook's configuration and status via GET /webhooks/{webhookId}
Update a webhook's enabled state, event subscriptions, or custom headers via PUT /webhooks/{webhookId}. Note that scope and scopeObjectId are immutable and cannot be changed after creation.
Permanently delete a webhook via DELETE /webhooks/{webhookId}, immediately stopping all callbacks
Create a new workspace via POST /workspaces to organize sheets, reports, and dashboards
Duplicate a workspace and its contents via POST /workspaces/{workspaceId}/copy, with control over which elements are included
Retrieve a paginated list of all workspaces accessible to the authenticated user via GET /workspaces, supporting token-based pagination (paginationType, maxItems, lastKey) and optional accessApiLevel for COMMENTER access.
Retrieve a workspace and its contents by ID via GET /workspaces/{workspaceId} (deprecated, prefer workspace metadata and children endpoints)
Rename a workspace via PUT /workspaces/{workspaceId}
Permanently delete a workspace and all its contents via DELETE /workspaces/{workspaceId}
Attach a URL to a sheet via POST /sheets/{sheetId}/attachments
(DEPRECATED path, sunsetting June 2026) Create a new subfolder within an existing folder via POST /folders/{folderId}/folders
Create a new top-level folder in the user's Home via POST /home/folders
Add columns to a report by matching source sheet columns via POST /reports/{reportId}/columns
Email a report to recipients via POST /reports/{reportId}/emails
(DEPRECATED) Create a new sheet from scratch or from a template in the user's Sheets folder (Home) via POST /sheets. The Sheets folder is being replaced by workspaces.
Create a new sheet in a workspace via POST /workspaces/{workspaceId}/sheets, either from scratch with column definitions or from a template
Create a new sheet from scratch or template inside a folder via POST /folders/{folderId}/sheets
Email one or more rows from a sheet via POST /sheets/{sheetId}/rows/emails
Email a sheet to recipients via POST /sheets/{sheetId}/emails
Create a new top-level folder in a workspace via POST /workspaces/{workspaceId}/folders
Retrieve all attachments on a specific row via GET /sheets/{sheetId}/rows/{rowId}/attachments
Retrieve the path (folder hierarchy) to a dashboard via GET /sights/{sightId}/path
Retrieve attachments on a discussion via GET /sheets/{sheetId}/discussions/{discussionId}/attachments
Retrieve an audit trail of events in the organization via GET /events
Retrieve filtered events via POST /filteredEvents
Retrieve a paginated list of top-level personal folders from the user's Home via GET /folders/personal
(DEPRECATED, sunsetting June 2026) Retrieve a folder and its contents by ID via GET /folders/{folderId}. Use get_folder_metadata and list_folder_children instead.
Retrieve folder metadata (name, dates, permalink) via GET /folders/{folderId}/metadata
List immediate child resources of a folder (sheets, reports, dashboards, subfolders, templates) via GET /folders/{folderId}/children
Retrieve the hierarchical path to a folder via GET /folders/{folderId}/path
Retrieve attachments on a proof via GET /sheets/{sheetId}/proofs/{proofId}/attachments
Retrieve request actions on a proof via GET /sheets/{sheetId}/proofs/{proofId}/requestactions
Retrieve the path (folder hierarchy) to a report via GET /reports/{reportId}/path
Search for text across all accessible sheets, reports, and dashboards via GET /search, with optional scopes filtering, modifiedSince date filter, and numericDates flag for Unix epoch timestamps.
(DEPRECATED) Retrieve a paginated list of sharing permissions on a sheet via GET /sheets/{sheetId}/shares, filterable by sharingInclude (ITEM for item-level shares, WORKSPACE for workspace-inherited shares).
Retrieve the summary object for a sheet via GET /sheets/{sheetId}/summary
Retrieve the path (folder hierarchy) to a sheet via GET /sheets/{sheetId}/path
Retrieve the current version number of a sheet via GET /sheets/{sheetId}/version
Retrieve all sheets in the organization via GET /users/sheets (System Admin only)
Get temporary download URLs for cell images via POST /imageurls
(DEPRECATED) Retrieve a paginated list of user-created templates via GET /templates. Use list_folder_children or workspace children with childrenResourceTypes=sheets,templates instead.
Retrieve all public Smartsheet templates via GET /templates/public
Retrieve the profile of the currently authenticated user via GET /users/me, useful for verifying credentials and obtaining the caller's account context
Retrieve plans associated with a user via GET /users/{userId}/plans (System Admin only)
Retrieve Smartsheet server information via GET /serverinfo
Retrieve top-level folders in a workspace via GET /workspaces/{workspaceId}/folders, with page-based pagination support (deprecated, use workspace children endpoint instead).
Retrieve child items of a workspace via GET /workspaces/{workspaceId}/children
Retrieve workspace metadata via GET /workspaces/{workspaceId}/metadata
Update a report's definition (filters, sorting, grouping) via PUT /reports/{reportId}/definition
Remove multiple favorites of a given type via DELETE /favorites/{favoriteType}
Remove a user from a plan via DELETE /users/{userId}/plans/{planId} (System Admin only)
Update the text of a comment on a sheet via PUT /sheets/{sheetId}/comments/{commentId}
Check if an item is favorited via GET /favorites/{favoriteType}/{favoriteId}
(DEPRECATED) Share a sheet with users or groups via POST /sheets/{sheetId}/shares
Share a report with users or groups via POST /reports/{reportId}/shares
Share a dashboard with users or groups via POST /sights/{sightId}/shares
Share a workspace with users or groups via POST /workspaces/{workspaceId}/shares
Sort rows in a sheet by one or more columns via POST /sheets/{sheetId}/sort
Deactivate a user via POST /users/{userId}/deactivate, blocking all Smartsheet access while preserving their data and permissions
Reactivate a previously deactivated user via POST /users/{userId}/reactivate, restoring full Smartsheet access
Promote an alternate email to primary via POST /users/{userId}/alternateemails/{alternateEmailId}/makeprimary (Enterprise only, requires System Admin)
Downgrade a user on a plan via POST /users/{userId}/plans/{planId}/downgrade (System Admin only)
Upgrade a user on a plan via POST /users/{userId}/plans/{planId}/upgrade (System Admin only)
Revoke the current OAuth access token via DELETE /token
Reset a webhook's shared secret via POST /webhooks/{webhookId}/resetSharedSecret
One endpoint. Any framework. Your agent is talking to Smartsheet in under 10 lines of code.
MCP Clients
Agent Frameworks
{
"mcpServers": {
"stackone": {
"command": "npx",
"args": [
"-y",
"mcp-remote@latest",
"https://api.stackone.com/mcp?x-account-id=<account_id>",
"--header",
"Authorization: Basic <YOUR_BASE64_TOKEN>"
]
}
}
}185+ actions
147+ actions
135+ actions
133+ actions
133+ actions
133+ actions
126+ actions
Anthropic's code_execution processes data already in context. Custom MCP code mode keeps raw tool responses in a sandbox. 14K tokens vs 500.
11 min
Benchmarking BM25, TF-IDF, and hybrid search for MCP tool discovery across 916 tools. The 80/20 TF-IDF/BM25 hybrid hits 21% Top-1 accuracy in under 1ms.
10 min
MCP tools that read emails, CRM records, and tickets are indirect prompt injection vectors. Here's how we built a two-tier defense that scans tool results in ~11ms.
12 min
origin_owner_id.All the tools you need to build and scale AI agent integrations, with best-in-class connectivity, execution, and security.