Smartsheet MCP Server

A production-ready Model Context Protocol (MCP) server that gives AI agents full read/write access to Smartsheet — equivalent to the native Claude MCP, but deployable as a remote HTTP endpoint for Microsoft 365 Copilot declarative agents and Copilot Studio.

Tools Exposed

Prerequisites

• Node.js 18+

• A Smartsheet API token — generate one at: Account → Apps & Integrations → API Access

• For M365 Copilot deployment: an Azure App Service or Azure Container Apps to host the HTTP server

Local Development (stdio — Claude Desktop or Copilot Studio local)

npm install
npm run build

# Set your token
export SMARTSHEET_API_TOKEN=your_token_here

# Run in stdio mode (default)
npm start

Claude Desktop config (claude_desktop_config.json)

{
  "mcpServers": {
    "smartsheet": {
      "command": "node",
      "args": ["/absolute/path/to/smartsheet-mcp-server/dist/index.js"],
      "env": {
        "SMARTSHEET_API_TOKEN": "your_token_here"
      }
    }
  }
}

Remote HTTP Deployment (for M365 Copilot)

# Run in HTTP mode
TRANSPORT=http SMARTSHEET_API_TOKEN=your_token_here npm start

# Server listens at http://localhost:3000/mcp
# Health check: GET http://localhost:3000/health

Per-request Token (multi-user / OAuth scenarios)

Each request can pass its own token via header, overriding the server default:

X-Smartsheet-Token: user_specific_token

This supports SSO scenarios where each M365 user authenticates to Smartsheet with their own credentials.

Deploying to Azure App Service

# Build the project
npm run build

# Create a zip of the deployable files
zip -r deploy.zip dist/ package.json package-lock.json

# Deploy via Azure CLI
az webapp deploy --resource-group <rg> --name <app-name> --src-path deploy.zip

# Set environment variables in Azure
az webapp config appsettings set \
  --resource-group <rg> \
  --name <app-name> \
  --settings SMARTSHEET_API_TOKEN=your_token TRANSPORT=http

Your MCP endpoint will be:

https://<app-name>.azurewebsites.net/mcp

Wiring into M365 Copilot (Declarative Agent)

Option A — Copilot Studio (Recommended for EPO/no-code)

1. Open Copilot Studio → Create or edit an agent

2. Go to Actions → Add an action → Model Context Protocol (MCP)

3. Enter your server URL: https://<app-name>.azurewebsites.net/mcp

4. Select the tools you want the agent to use

5. Configure authentication (API key or OAuth)

6. Publish the agent

ℹ️ MCP is now generally available in Copilot Studio as of mid-2025.

Option B — VS Code + Microsoft 365 Agents Toolkit (for IT/Dev)

1. Install Microsoft 365 Agents Toolkit extension in VS Code

2. Create a new Declarative Agent from the toolkit

3. Choose Add Action → Start with an MCP server

4. Enter your MCP endpoint URL

5. The toolkit auto-generates the plugin manifest by reading your tool schemas

6. Pick which tools to expose

7. Configure OAuth (Smartsheet supports OAuth 2.0) or API key auth

8. Deploy to your M365 tenant via Microsoft 365 Admin Center → Copilot → Agents

Option C — Direct Manifest (Advanced)

The Agents Toolkit auto-generates ai-plugin.json and openapi.json from your MCP server's tool list. These files go into the declarative agent's appPackage/ directory and are uploaded to the Teams App Catalog.

Authentication Options for M365

Smartsheet OAuth App Setup (for per-user auth)

1. Go to Smartsheet Developer Portal

2. Create a new app → Set redirect URI to https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect

3. Copy the Client ID and Client Secret

4. In Agents Toolkit: choose OAuth (static registration) and paste these values

Environment Variables

Known M365 Copilot Limitations

• Only tools are supported — MCP resources and prompts are ignored by Copilot

• Nested object schemas with minimum/maximum/default on nested properties can fail manifest validation in the Agents Toolkit — strip these if provisioning fails

• Max 5 tools injected inline when ≤5 plugins are defined in a declarative agent manifest; above 5, the orchestrator selects dynamically

• Confirmation prompts: Read-only tools (annotated readOnlyHint: true) don't require user confirmation; write tools do on first call

Project Structure

smartsheet-mcp-server/
├── src/
│   ├── index.ts                     # Entry point, transport selection
│   ├── types.ts                     # Smartsheet entity types
│   ├── constants.ts                 # API base URL, limits
│   ├── services/
│   │   └── smartsheet.ts            # API client, auth, error handling
│   └── tools/
│       ├── sheets.ts                # Sheet CRUD, rows, columns
│       ├── reports-workspaces.ts    # Reports, workspaces, folders, dashboards
│       ├── discussions-attachments.ts  # Comments, attachments
│       └── search.ts               # Search, cell history, version check
├── dist/                            # Compiled JS (after npm run build)
├── package.json
├── tsconfig.json
└── README.md