Smartsheet Model Context Protocol on AWS provides work management context for AI agents.

Smartsheet has launched a generally available Model Context Protocol (MCP) Server, giving AI assistants a standardized way to read, write, and manage work management data. The server exposes more than 40 tools for exploring, creating, and managing sheets, rows, columns, and automations — meaning users can update task statuses, create rows, and modify project structure through natural language without switching tools. The launch matters most for teams already running projects, portfolios, and operations inside Smartsheet who want AI agents to act on that live work rather than just talk about it.

The MCP Server sits as a central integration layer connecting to AWS services, with AI clients attaching directly. Smartsheet positions two paths for connection: Amazon Quick, an agentic AI workspace aimed at business users, project managers, and operations teams, and Kiro, an agentic IDE for developers. Both expose the same Smartsheet toolset, so the choice comes down to where the work happens.

What the server actually does

The protocol spans tools for exploring and managing sheets, rows, columns, and automations. Smartsheet says the server delivers structured context — including row relationships, column types, cell history, and comments — producing token-efficient payloads rather than returning raw API responses. That engineering choice is framed as a cost and latency benefit at scale, when hundreds of AI-assisted queries run across a project portfolio.

The server is available at three regional endpoints: Commercial US at https://mcp.smartsheet.com, EU at https://mcp.smartsheet.eu, and AU at https://mcp.smartsheet.au. It uses Streamable HTTP transport (MCP spec versions 2025-06-18 and 2025-03-26) and authenticates with either OAuth 2.0 or a Personal Access Token.

A sprint management example

Smartsheet illustrates the split with a software engineering team tracking a sprint — tasks, owners, statuses, and blockers all in a project sheet. A project manager asking Amazon Quick which sprint tasks are blocked this week gets a natural-language query routed through the MCP Server, which pulls the relevant rows and returns a summary with owner names and due dates, generated from live data without building a report or dashboard.

A developer on the same team can ask Kiro to pull the current sprint sheet and show open backend tasks assigned to them; Kiro queries Smartsheet through MCP and surfaces the list inline. When the fix is committed, a Kiro hook automatically updates the corresponding row status to Complete.

Prerequisites and connection paths

Before connecting, users need an active AWS account with appropriate AWS Identity and Access Management (IAM) permissions for the service being connected, a Smartsheet account on a Business, Enterprise, or AWM plan, and a Smartsheet Personal Access Token or OAuth credentials if the client supports the OAuth flow. Amazon Quick requires Author or higher permissions in the Quick account; Kiro requires the Kiro IDE installed from kiro.dev with Node.js available in the environment.

Amazon Quick includes Smartsheet as a pre-built connector in its directory. Setup involves navigating to Connectors, selecting the Smartsheet tile, and entering integration details: a descriptive name, the Base URL https://mcp.smartsheet.com, a Client ID and Client Secret from a Smartsheet Developer Tools app registration, Token URL https://api.smartsheet.com/2.0/token, and Auth URL https://app.smartsheet.com/b/authorize. After choosing Next through the Manage Tools & Permissions page and selecting who can access the connection on the Publish page, the chat agent can work with Smartsheet data — for example, asking "What projects in our portfolio are currently At Risk?" or instructing it to update the status of the authentication task in the Backend API sheet to Complete.

Kiro takes a lighter path: a single JSON configuration block added to `.kiro/settings/mcp.json` for workspace scope, using a Personal Access Token via an Authorization Bearer header. Smartsheet notes that OAuth is recommended for production deployments. Kiro loads MCP servers as background processes on startup, after which Smartsheet tools are available across chat, spec planning, and hooks-based automation. Developers can then ask Kiro to check the Backend API project sheet for open bugs and generate a prioritized fix list, or pull the Q3 Roadmap sheet and create a spec for features marked In Progress.

Governance and security posture

For regulated or enterprise environments, Smartsheet says the MCP Server's security model is built on the same infrastructure and permissions layer as the Smartsheet REST API — not a new trust boundary. OAuth 2.0 and Personal Access Token authentication are both supported. User-level permission enforcement means agents can only access data the authenticated user can see, with no privilege escalation through natural language prompts. Organization-level AI controls let system administrators turn AI features on or off globally, with write-tool access configurable by user group. Firewall allowlisting is done by fully qualified domain name (mcp.smartsheet.com) rather than IP address. Smartsheet also states the MCP Server doesn't store prompts; prompt content stays between the AI client and the model, and Smartsheet sees only structured tool calls and their results.

Who should use which path

Amazon Quick suits organizations that need a fully managed, organization-wide solution the whole team can use — no app registration, only pre-built OAuth, scaling across knowledge workers in the enterprise. Kiro suits developers who want something lightweight: no infrastructure, just a config file and a personal access token scoped to their own workflow.

What to try next, and how to undo it

Smartsheet recommends four starting actions: asking the chat agent to monitor active project sheets, identify rows marked Blocked or At Risk, annotate projects with a discussion comment, and deliver a structured summary through a preferred channel (chaining get_sheet_summary, search, and create_discussion_on_row); reconciling task statuses between an issue tracker and a Smartsheet project plan and flagging drift (using get_sheet_summary, get_columns, update_rows, and create_discussion_on_row in sequence); and aggregating project health signals across reports and dashboards into a structured briefing (drawing on list_reports, get_report, list_dashboards, and get_dashboard).

Removing the integration differs by path. In Amazon Quick, navigate to Connectors, select the Smartsheet connector, and choose Delete, which revokes the OAuth token and stops agent access to Smartsheet data. In Kiro, open `.kiro/settings/mcp.json`, remove the smartsheet-us entry from the mcpServers object, and restart Kiro to unload the server.

For teams weighing adoption, the practical question is whether AI agents should act inside existing work management data or stay in a separate chat window. Smartsheet's answer is the former — and with the server now generally available across three regions, the barrier to testing that claim is a connector setup or a config file, not a development project.