{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "grist", "name": "Grist", "vendor": "Grist Labs Inc.", "vendorUrl": "https://www.getgrist.com", "kind": "http-api", "category": "spreadsheets", "summary": "Grist is a spreadsheet-database hybrid from Grist Labs with typed columns and Python formulas, sold as a hosted service and as open-source software to self-host. Agents reach it through a REST API and an MCP server with OAuth.", "url": "https://www.anchorterminal.com/tools/grist", "markdownUrl": "https://www.anchorterminal.com/tools/grist.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/grist.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/grist.json", "repo": "https://github.com/gristlabs/grist-core", "license": "Apache-2.0 for the community edition in gristlabs/grist-core. The full edition, which adds the MCP server, the OAuth server and audit log streaming, is proprietary and needs an activation key after a 30-day trial. Docs are CC BY-SA 4.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://docs.getgrist.com/api", "packages": [ { "registry": "npm", "name": "grist-api" }, { "registry": "pypi", "name": "grist-api" } ], "auth": "mixed", "authNotes": "Self-serve. A signed-in user creates an API key on the Developer page of account settings and sends it as `Authorization: Bearer`. The key carries its owner's full account access, and each account has one. The alternative is OAuth 2.0 with PKCE, used by the MCP server and by registered apps. The user approves any of seven scopes (`doc:read`, `doc:write`, `doc.schema:write`, `doc:download`, `doc:webhooks`, `user.profile:read`, `offline_access`) and can limit the grant to chosen sites, workspaces or documents. Access tokens last 1 hour and refresh tokens 60 days, and a grant can be revoked per app. Clients can register themselves by Client ID Metadata Document. Not every REST endpoint accepts an OAuth token.", "pricing": "freemium", "pricingNotes": "Free plan with 5,000 rows a document and 3,000 API calls a month per site, REST and MCP calls together, so an agent can start without a contract. Pro is $10 a user a month ($8 billed yearly) and Business $30 ($24 yearly, minimum 5 users), Enterprise through sales. API calls aren't priced, the MCP server is on every plan for now, and there's no separate sandbox. The self-hosted community edition is free (checked 2026-10-08).", "priceSummary": "$10 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI file, the MCP docs or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 34, "popularity": { "githubStars": 11900, "npmWeekly": 341, "pypiWeekly": 240, "asOf": "2026-10-08" }, "docsUrl": "https://support.getgrist.com/rest-api/", "openapi": "https://raw.githubusercontent.com/gristlabs/grist-help/master/api/grist.yml", "capabilities": [ "sheets.records", "sheets.read", "sheets.write", "sheets.tables", "sheets.formulas" ], "tags": [ "official", "hosted", "self-hosted", "open-source", "mcp", "free-tier", "oauth", "api-key", "openapi", "webhooks", "python", "javascript" ], "lastRelease": "2026-09-28", "graded": true, "anchor": { "graded": true, "score": 50.1, "grade": "D", "agentReady": false, "rank": 597, "ranked": true, "rankOf": 722, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 57, "maintenance": 78, "payments": 30, "reliability": 39, "schema": 63, "security": 62, "transparency": 61 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 39, "points": 7.8, "reason": "Graded on hosted Grist's REST API and MCP server at docs.getgrist.com, with the hosted lines. No status page was found. status.getgrist.com redirects to a signup form, and the site footer and help centre link to none (0). With no page there is no readable incident history (5). Limits are published with numbers, 3,000 calls a month on Free, 40,000 and 60,000 per document per day on Pro and Business, 5 requests a second per document on Free and 10 concurrent requests per document on every plan (15). The limits page says an eleventh concurrent request gets 429 and that a client sending one request at a time won't hit it. No Retry-After header or backoff guidance was found, and `PUT` on `/records` with `require` gives a retry-safe write (9 of 15). The pricing page names SLAs among Enterprise services and publishes no terms (0). The REST API is generally available and the MCP server, live since June 2026, carries no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 63, "points": 10.24, "reason": "The OpenAPI 3.0.0 file in the public docs repository has 101 paths and 120 operations and is rendered at support.getgrist.com/api. The MCP server is in the proprietary full edition and its endpoint answers 401 without a token, so we couldn't read its tool schemas (22 of 25). No llms.txt on www.getgrist.com or support.getgrist.com. The docs source is Markdown in a public repository (3 of 10). Parameter descriptions are detailed, but the four `/records` operations carry a summary and no description. The MCP docs group 34 tools with one line each (13 of 20). Path and query parameters are typed with 16 enums. Record fields depend on the table, `filter` is a JSON string and `/apply` takes arrays in Grist's internal action format (8 of 15). The file has examples throughout, but only 36 of 120 operations document an error response (400, 403 or 404) and none documents 429 (8 of 15). The file is versioned 1.0.1 with no version in the path. GitHub release notes and monthly newsletters record API changes, and four `/data` operations are marked deprecated (9 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 57, "points": 9.26, "reason": "The MCP docs list 34 tools, more than 30, which earns 5. We added 8 because OAuth scopes limit a connection to reading and the client can ask for fewer scopes (13 of 25). List records takes `filter`, `sort` and `limit` with no offset or cursor, and the read-only `/sql` endpoint takes a SELECT with parameters and a timeout (15 of 20). OAuth errors follow the standard `error` and `error_description` shape, and the MCP docs explain the missing scope and doc not found errors. The REST reference documents few error bodies (10 of 20). `PUT` on `/records` adds or updates by `require` keys, with `onmany`, `noadd` and `noupdate` to control it. No idempotency key was found, and we couldn't read whether the MCP tools carry readOnlyHint or destructiveHint (10 of 20). Few required parameters. Grist Labs maintains `grist-api` for JavaScript and Python, last published in February 2022 and October 2024 (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 62, "points": 10.85, "reason": "OAuth 2.0 authorisation code flow with PKCE, seven scopes, grants limited to chosen sites, workspaces or documents, access tokens of 1 hour, refresh tokens of 60 days and revocation per app. The alternative API key carries its owner's full access, with one key per account, and travels only in the `Authorization` header (28 of 30). A connection can hold `doc:read` alone, and schema changes need a separate scope. No server-side confirmation for `remove_records` or `remove_table` was found, and the docs leave approval to the client (15 of 20). Cells can hold text written by others. The MCP docs warn that anything read is visible to the client's AI provider, and no prompt-injection guidance was found (3 of 15). The Authorised apps page shows each app's scopes, resources and last use, and document history records changes. Audit log streaming is an Enterprise capability (7 of 15). SECURITY.md gives security@getgrist.com with acknowledgement in three working days, and 10 advisories are published on GitHub. No security.txt or bug bounty, and the docs say hosted Grist has no SOC 2 or ISO 27001 audit (9 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "Graded on hosted Grist. No x402, MPP or L402 found (0). Plan prices are public, Pro at $10 and Business at $30 a user a month ($8 and $24 billed yearly), with no per-call price (10). A Free plan with 5,000 rows a document and 3,000 API calls a month. The pricing page doesn't mention a card for it, and we didn't complete a signup (20). A person signs up in a browser and creates the key or approves the OAuth consent screen. A client can register itself by Client ID Metadata Document, but that doesn't remove the sign-in (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 78, "points": 6.83, "reason": "Release v1.7.20 was tagged on 28 September 2026, 10 days before the check (30). Four releases in the last 90 days, v1.7.17 on 29 July, v1.7.18 on 28 August, v1.7.19 on 5 September and v1.7.20 (20). The repository shows 636 open issues, with 15 updated between 9 September and 5 October 2026, and the community forum had posts on the day of the check. We didn't read maintainers' reply times (15 of 25). The only Grist entry in the official MCP registry is a third party's. The official `grist-api` clients exist but date from February 2022 (npm 0.1.7) and October 2024 (PyPI 0.1.1) (5 of 15). The CI workflow runs lint, server, browser and Python test groups on every push to main, and v1.7.20 updated a dependency for a security fix. We didn't read the current CI result (8 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 61, "points": 5.34, "note": "editorial 50, provenance 71", "reason": "The core in gristlabs/grist-core is Apache-2.0. The MCP server, the OAuth server and audit log streaming are in the proprietary full edition, which is what hosted Grist runs (24 of 30). The privacy policy is dated 1 April 2019 and names no retention periods. The data security page adds AWS in the United States, encrypted S3 storage, a 30-day trash and logs kept only as long as needed, and the two don't conflict. No DPA was found (12 of 30). No deprecation policy was found, and the terms allow changes and withdrawal without notice. The OpenAPI file marks the four `/data` operations deprecated, and release notes list API changes (5 of 20). AWS in the United States is stated, OpenAI is named for the AI Assistant, and the privacy policy names Amazon, Google and MailChimp. No sub-processor list was found (9 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "The MCP docs list 34 tools, more than 30, which earns 5. We added 8 because OAuth scopes limit a connection to reading and the client can ask for fewer scopes (13 of 25). List records takes `filter`, `sort` and `limit` with no offset or cursor, and the read-only `/sql` endpoint takes a SELECT with parameters and a timeout (15 of 20). OAuth errors follow the standard `error` and `error_description` shape, and the MCP docs explain the missing scope and doc not found errors. The REST reference documents few error bodies (10 of 20). `PUT` on `/records` adds or updates by `require` keys, with `onmany`, `noadd` and `noupdate` to control it. No idempotency key was found, and we couldn't read whether the MCP tools carry readOnlyHint or destructiveHint (10 of 20). Few required parameters. Grist Labs maintains `grist-api` for JavaScript and Python, last published in February 2022 and October 2024 (9 of 15).", "maintenance": "Release v1.7.20 was tagged on 28 September 2026, 10 days before the check (30). Four releases in the last 90 days, v1.7.17 on 29 July, v1.7.18 on 28 August, v1.7.19 on 5 September and v1.7.20 (20). The repository shows 636 open issues, with 15 updated between 9 September and 5 October 2026, and the community forum had posts on the day of the check. We didn't read maintainers' reply times (15 of 25). The only Grist entry in the official MCP registry is a third party's. The official `grist-api` clients exist but date from February 2022 (npm 0.1.7) and October 2024 (PyPI 0.1.1) (5 of 15). The CI workflow runs lint, server, browser and Python test groups on every push to main, and v1.7.20 updated a dependency for a security fix. We didn't read the current CI result (8 of 10).", "payments": "Graded on hosted Grist. No x402, MPP or L402 found (0). Plan prices are public, Pro at $10 and Business at $30 a user a month ($8 and $24 billed yearly), with no per-call price (10). A Free plan with 5,000 rows a document and 3,000 API calls a month. The pricing page doesn't mention a card for it, and we didn't complete a signup (20). A person signs up in a browser and creates the key or approves the OAuth consent screen. A client can register itself by Client ID Metadata Document, but that doesn't remove the sign-in (0).", "reliability": "Graded on hosted Grist's REST API and MCP server at docs.getgrist.com, with the hosted lines. No status page was found. status.getgrist.com redirects to a signup form, and the site footer and help centre link to none (0). With no page there is no readable incident history (5). Limits are published with numbers, 3,000 calls a month on Free, 40,000 and 60,000 per document per day on Pro and Business, 5 requests a second per document on Free and 10 concurrent requests per document on every plan (15). The limits page says an eleventh concurrent request gets 429 and that a client sending one request at a time won't hit it. No Retry-After header or backoff guidance was found, and `PUT` on `/records` with `require` gives a retry-safe write (9 of 15). The pricing page names SLAs among Enterprise services and publishes no terms (0). The REST API is generally available and the MCP server, live since June 2026, carries no beta label (10).", "schema": "The OpenAPI 3.0.0 file in the public docs repository has 101 paths and 120 operations and is rendered at support.getgrist.com/api. The MCP server is in the proprietary full edition and its endpoint answers 401 without a token, so we couldn't read its tool schemas (22 of 25). No llms.txt on www.getgrist.com or support.getgrist.com. The docs source is Markdown in a public repository (3 of 10). Parameter descriptions are detailed, but the four `/records` operations carry a summary and no description. The MCP docs group 34 tools with one line each (13 of 20). Path and query parameters are typed with 16 enums. Record fields depend on the table, `filter` is a JSON string and `/apply` takes arrays in Grist's internal action format (8 of 15). The file has examples throughout, but only 36 of 120 operations document an error response (400, 403 or 404) and none documents 429 (8 of 15). The file is versioned 1.0.1 with no version in the path. GitHub release notes and monthly newsletters record API changes, and four `/data` operations are marked deprecated (9 of 15).", "security": "OAuth 2.0 authorisation code flow with PKCE, seven scopes, grants limited to chosen sites, workspaces or documents, access tokens of 1 hour, refresh tokens of 60 days and revocation per app. The alternative API key carries its owner's full access, with one key per account, and travels only in the `Authorization` header (28 of 30). A connection can hold `doc:read` alone, and schema changes need a separate scope. No server-side confirmation for `remove_records` or `remove_table` was found, and the docs leave approval to the client (15 of 20). Cells can hold text written by others. The MCP docs warn that anything read is visible to the client's AI provider, and no prompt-injection guidance was found (3 of 15). The Authorised apps page shows each app's scopes, resources and last use, and document history records changes. Audit log streaming is an Enterprise capability (7 of 15). SECURITY.md gives security@getgrist.com with acknowledgement in three working days, and 10 advisories are published on GitHub. No security.txt or bug bounty, and the docs say hosted Grist has no SOC 2 or ISO 27001 audit (9 of 20).", "transparency": "The core in gristlabs/grist-core is Apache-2.0. The MCP server, the OAuth server and audit log streaming are in the proprietary full edition, which is what hosted Grist runs (24 of 30). The privacy policy is dated 1 April 2019 and names no retention periods. The data security page adds AWS in the United States, encrypted S3 storage, a 30-day trash and logs kept only as long as needed, and the two don't conflict. No DPA was found (12 of 30). No deprecation policy was found, and the terms allow changes and withdrawal without notice. The OpenAPI file marks the four `/data` operations deprecated, and release notes list API changes (5 of 20). AWS in the United States is stated, OpenAI is named for the AI Assistant, and the privacy policy names Amazon, Google and MailChimp. No sub-processor list was found (9 of 20)." }, "sources": [ { "what": "MCP server docs", "url": "https://support.getgrist.com/mcp/", "seen": "2026-10-08" }, { "what": "REST API usage and client libraries", "url": "https://support.getgrist.com/rest-api/", "seen": "2026-10-08" }, { "what": "API reference", "url": "https://support.getgrist.com/api/", "seen": "2026-10-08" }, { "what": "OpenAPI file (docs repository cloned at commit b047726, 30 September 2026)", "url": "https://github.com/gristlabs/grist-help/blob/master/api/grist.yml", "seen": "2026-10-08" }, { "what": "OAuth apps", "url": "https://support.getgrist.com/oauth-apps/", "seen": "2026-10-08" }, { "what": "connected apps", "url": "https://support.getgrist.com/connected-apps/", "seen": "2026-10-08" }, { "what": "limits", "url": "https://support.getgrist.com/limits/", "seen": "2026-10-08" }, { "what": "data security", "url": "https://support.getgrist.com/data-security/", "seen": "2026-10-08" }, { "what": "webhooks", "url": "https://support.getgrist.com/webhooks/", "seen": "2026-10-08" }, { "what": "telemetry overview", "url": "https://support.getgrist.com/telemetry/", "seen": "2026-10-08" }, { "what": "AI Assistant data use policy", "url": "https://support.getgrist.com/assistant/", "seen": "2026-10-08" }, { "what": "newsletters (June to September 2026)", "url": "https://support.getgrist.com/newsletters/", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://www.getgrist.com/pricing/", "seen": "2026-10-08" }, { "what": "security page", "url": "https://www.getgrist.com/security/", "seen": "2026-10-08" }, { "what": "terms (End-User Licence Agreement)", "url": "https://www.getgrist.com/terms/", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.getgrist.com/privacy/", "seen": "2026-10-08" }, { "what": "home page navigation and footer", "url": "https://www.getgrist.com/", "seen": "2026-10-08" }, { "what": "OAuth authorisation server metadata", "url": "https://login.getgrist.com/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "OAuth protected resource metadata", "url": "https://docs.getgrist.com/.well-known/oauth-protected-resource", "seen": "2026-10-08" }, { "what": "MCP endpoint (401 without a token)", "url": "https://docs.getgrist.com/api/mcp", "seen": "2026-10-08" }, { "what": "status.getgrist.com (redirects to signup)", "url": "https://status.getgrist.com/", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://www.getgrist.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "repository (cloned at commit c08ec70, 7 October 2026)", "url": "https://github.com/gristlabs/grist-core", "seen": "2026-10-08" }, { "what": "releases", "url": "https://github.com/gristlabs/grist-core/releases", "seen": "2026-10-08" }, { "what": "security policy", "url": "https://github.com/gristlabs/grist-core/blob/main/SECURITY.md", "seen": "2026-10-08" }, { "what": "security advisories", "url": "https://github.com/gristlabs/grist-core/security/advisories", "seen": "2026-10-08" }, { "what": "advisory GHSA-9x4j-4rw5-3vmq", "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-9x4j-4rw5-3vmq", "seen": "2026-10-08" }, { "what": "advisory GHSA-7xvx-8pf2-pv5g", "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g", "seen": "2026-10-08" }, { "what": "open issues", "url": "https://github.com/gristlabs/grist-core/issues", "seen": "2026-10-08" }, { "what": "npm package grist-api", "url": "https://registry.npmjs.org/grist-api", "seen": "2026-10-08" }, { "what": "PyPI package grist-api", "url": "https://pypi.org/pypi/grist-api/json", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=grist", "seen": "2026-10-08" }, { "what": "community forum, latest topics", "url": "https://community.getgrist.com/latest.json", "seen": "2026-10-08" }, { "what": "RDAP for getgrist.com", "url": "https://rdap.verisign.com/com/v1/domain/getgrist.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the MCP server's tool definitions, input schemas and annotations. The server is in the proprietary full edition and `https://docs.getgrist.com/api/mcp` answers 401 without a token. The count of 34 tools is from the docs page, and the September 2026 newsletter names 6 layout tools the page doesn't list", "unchecked: whether signup on hosted Grist asks for a card, an email confirmation or a captcha. We didn't create an account, and the pricing page doesn't mention a card for the Free plan", "unchecked: maintainers' reply times on GitHub issues and the current CI result. The GitHub API refused us, and the counts of 11,900 stars and 636 open issues are read from the repository pages", "unchecked: whether hosted Grist was affected by the five advisories of the last 12 months. None of the advisories read says", "No status page, published SLA terms, DPA, sub-processor list, retention period, security.txt, bug bounty, llms.txt, Retry-After header, idempotency key, deprecation policy or prompt-injection guidance was found in the reviewed pages", "The terms page is an End-User Licence Agreement with no date. It covers Grist Labs' products, software, services and websites, so it is recorded as the governing terms. The privacy policy is dated 1 April 2019", "The pricing page names SLAs among Enterprise services. No points were given because no terms are published", "List records has `limit` with no offset or cursor in the OpenAPI file. Paging beyond that needs the `/sql` endpoint", "The lead was right on vendor, URL and the REST interface. It missed the MCP server at `https://docs.getgrist.com/api/mcp` and OAuth, both launched in June 2026, and the legal entity is Grist Labs Inc." ] }, "negative": -4, "negativeNotes": [ "2026-09-13. GHSA-9x4j-4rw5-3vmq, critical (CVSS 10.0), remote code execution through prototype pollution from an imported crafted document, affecting Docker images before 1.7.19 and fixed in 1.7.19. Four more advisories were published in the last 12 months, among them GHSA-7xvx-8pf2-pv5g (CVE-2026-24002, critical, 21 January 2026) on the pyodide sandbox option, fixed in 1.7.9. All five are fixed and published and none says whether hosted Grist was affected, so the deduction is reduced (https://github.com/gristlabs/grist-core/security/advisories)" ], "verdict": "OAuth tokens carry seven scopes, can be limited to chosen documents and expire after an hour, and the REST API has a public OpenAPI file with an add-or-update call. No status page, SLA terms, DPA or security.txt was found, and the docs say the hosted service has no SOC 2 or ISO 27001 audit.", "bestFor": "Teams that want a relational spreadsheet with Python formulas and per-document OAuth grants for an agent, or that need to self-host.", "strengths": [ "OAuth 2.0 with PKCE and seven scopes, with `doc:read`, `doc:write` and `doc.schema:write` granted separately and the grant limited to chosen sites, workspaces or documents", "Access tokens last 1 hour, refresh tokens 60 days, and a user can revoke one app's grant from the Authorised apps page", "Public OpenAPI 3.0.0 file with 101 paths and 120 operations, including a read-only SQL endpoint and `PUT` on `/records` to add or update by key columns", "Limits are published with numbers per plan, with 10 concurrent requests per document and a 1 MB request body on every plan", "The core is Apache-2.0 and four releases were tagged between 29 July and 28 September 2026" ], "weaknesses": [ "No status page was found. status.getgrist.com redirects to a signup form, and the site footer and help centre link to none", "An API key carries its owner's full account access, and each account has one key, so it can't be limited to a document or revoked per integration", "The data security page says hosted Grist has no SOC 2, ISO 27001, HIPAA or GDPR certification, and no DPA, sub-processor list or security.txt was found", "The MCP server and OAuth server are in the proprietary full edition, so the Apache-2.0 community edition has neither and the tool definitions aren't public", "Five security advisories were published in the last 12 months, two rated critical, the latest on 13 September 2026 with CVSS 10.0", "The Free plan allows 3,000 API calls a month across a site, with REST and MCP calls sharing the pool" ], "agentNotes": [ "Connect through OAuth, not an API key. Ask for `doc:read` alone for reading, and have the user pick Selected resources on the consent screen", "Keep `doc.schema:write` off unless needed. The docs say formula editing lets its holder read any data in the document whatever the access rules", "Send requests for one document one at a time. The eleventh concurrent request gets 429, and no Retry-After header is documented", "Use `PUT /api/docs/{docId}/tables/{tableId}/records` with `require` to add or update by key, so a retried write doesn't create a duplicate row", "Use the `/records` endpoints, not the deprecated `/data` ones, and split large writes to stay under the 1 MB body limit" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 50.1 } ], "editorialScores": { "ergonomics": 57, "maintenance": 78, "payments": 30, "reliability": 39, "schema": 63, "security": 62, "transparency": 50 }, "provenanceScore": 71 }, "connect": { "install": "pip install grist-api", "http": "curl -H \"Authorization: Bearer \u003cAPI-KEY-GOES-HERE\u003e\" https://docs.getgrist.com/api/orgs", "claudeCode": "claude mcp add --transport http grist https://docs.getgrist.com/api/mcp" }, "letme": { "capability": "https://letme.dev/sheets.records", "tool": "https://letme.dev/grist" }, "notable": [ "The MCP server at https://docs.getgrist.com/api/mcp went live in June 2026 on every hosted plan and on the full edition of self-hosted Grist, and the docs say plan availability may change (https://support.getgrist.com/mcp/)", "The docs list 34 MCP tools in six groups, each prefixed `grist_`, from `list_orgs` and `query_document` to `remove_table` and `add_page_widget` (https://support.getgrist.com/mcp/)", "OAuth grants can be limited to chosen sites, workspaces or documents, and a request for a document outside the grant returns 403 (https://support.getgrist.com/oauth-apps/)", "The docs warn that `doc.schema:write` lets its holder obtain any data in the document through formulas, whatever the access rules (https://support.getgrist.com/oauth-apps/)", "Free plans are limited to 3,000 API calls a month per site, Pro to 40,000 and Business to 60,000 per document per day, and every plan to 10 concurrent requests per document (https://support.getgrist.com/limits/)", "The OpenAPI 3.0.0 file has 101 paths and 120 operations, with a read-only SQL endpoint and `PUT` on `/records` to add or update by key columns (https://github.com/gristlabs/grist-help/blob/master/api/grist.yml)", "The data security page says hosted Grist runs on AWS in the United States and has not gone through SOC 2, ISO 27001, HIPAA or GDPR certification (https://support.getgrist.com/data-security/)", "Advisory GHSA-9x4j-4rw5-3vmq of 13 September 2026, rated critical at CVSS 10.0, covers remote code execution from an imported crafted document and was fixed in 1.7.19 (https://github.com/gristlabs/grist-core/security/advisories/GHSA-9x4j-4rw5-3vmq)" ], "area": "business", "details": [ { "label": "Surfaces graded", "value": "Hosted Grist's REST API at https://docs.getgrist.com/api (or https://\u003cteam\u003e.getgrist.com/api) and its MCP server at https://docs.getgrist.com/api/mcp. The same API can be self-hosted, and the MCP server needs the full edition there" }, { "label": "Free tier", "value": "5,000 rows a document, 10 team members, 1 GB of attachments a document, 3,000 API calls a month per site with REST and MCP calls sharing the pool" }, { "label": "Rate limits", "value": "Free 3,000 calls a month per site and 5 requests a second per document. Pro 40,000 and Business 60,000 calls per document per day. 10 concurrent requests per document on all plans, 429 beyond that. 1 MB per request body, 50 MB per upload" }, { "label": "Auth and scopes", "value": "API key (`Authorization: Bearer`), one per account, full account access. OAuth 2.0 with PKCE and scopes `doc:read`, `doc:write`, `doc.schema:write`, `doc:download`, `doc:webhooks`, `user.profile:read`, `offline_access`, limited to chosen sites, workspaces or documents" }, { "label": "Tokens", "value": "Access tokens prefixed `grist_at_` last 1 hour, refresh tokens prefixed `grist_rt_` last 60 days and rotate. Revocation at `/oidc/revocation` or from the Authorised apps page" }, { "label": "Read and write", "value": "Records (list, add, modify, add or update, delete), tables and columns, attachments, webhooks, read-only SQL, downloads as CSV, TSV, XLSX or the whole document, plus sites, workspaces, access and service accounts" }, { "label": "Filtering", "value": "`filter` (JSON object of column to allowed values), `sort`, `limit`, `hidden` and `cellFormat` on list records, also as `X-Sort` and `X-Limit` headers. No offset or cursor. `/sql` runs a SELECT with parameters and a timeout" }, { "label": "MCP server", "value": "Remote, streamable HTTP, 34 tools listed in the docs for discovery, reading, writing, schema, pages and widgets, and attachments. OAuth, API key or service account. Tool schemas aren't public" }, { "label": "Change events", "value": "Webhooks per table on rows added or updated, with a ready column as a condition, an optional `Authorization` header, a batched queue and periodic retries" }, { "label": "SDKs", "value": "`grist-api` on npm (0.1.7, February 2022) and PyPI (0.1.1, October 2024), both by Grist Labs. Community clients for Go, Rust, R and others are linked from the docs" }, { "label": "Deprecations", "value": "No policy found. The OpenAPI file marks the four `/data` operations deprecated in favour of `/records`, and release notes list API changes" }, { "label": "Certifications", "value": "None. The data security page says hosted Grist has not gone through SOC 2, ISO 27001, HIPAA or GDPR certification. No bug bounty or security.txt found" }, { "label": "Advisories", "value": "10 published on GitHub, 5 in the last 12 months, 2 of them critical (21 January and 13 September 2026), all fixed" }, { "label": "Status and SLA", "value": "No status page found. SLAs are named among Enterprise services on the pricing page, with no terms published" }, { "label": "Data location", "value": "AWS in the United States, with S3 for encrypted storage. A dedicated server in a chosen AWS region on Enterprise. Deleted documents stay 30 days in the trash" }, { "label": "Open source", "value": "Community edition under Apache-2.0 with the REST API, webhooks and access rules. The MCP server, OAuth server, AI Assistant and audit log streaming are in the proprietary full edition" } ], "unitPrices": [ { "item": "Pro (hosted)", "unit": "seat-month", "usd": 10, "note": "billed monthly, $8 billed yearly, 100,000 rows a document, 40,000 API calls per document per day" }, { "item": "Business (hosted)", "unit": "seat-month", "usd": 30, "note": "billed monthly, $24 billed yearly, minimum 5 users, 150,000 rows a document, 60,000 API calls per document per day" } ], "provenance": { "legalEntity": "Grist Labs Inc.", "domain": "getgrist.com", "domainRegistered": "2014-05-12", "endpointOnVendorDomain": true, "terms": "https://www.getgrist.com/terms/", "privacy": "https://www.getgrist.com/privacy/", "statusPage": "", "changelog": "https://github.com/gristlabs/grist-core/releases", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms page is an End-User Licence Agreement between the user and Grist Labs Inc., covering its products, software, services and websites, governed by New York State law, with legal notices to 93 4th Ave, #1127, New York, NY 10003. It carries no date.", "The privacy policy has an effective date of 1 April 2019 and covers the websites, products and services. It names no retention periods.", "The REST API and MCP server answer at docs.getgrist.com and \u003cteam\u003e.getgrist.com, and OAuth at login.getgrist.com, all getgrist.com subdomains.", "No status page was found. status.getgrist.com redirects to a signup form because every subdomain is treated as a team site.", "www.getgrist.com/.well-known/security.txt and docs.getgrist.com/.well-known/security.txt return 404. SECURITY.md in the repository gives security@getgrist.com.", "RDAP for getgrist.com gives a registration date of 2014-05-12." ], "score": 71, "checks": [ { "check": "Legal entity named", "value": "Grist Labs Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "getgrist.com, registered 2014-05-12 (12 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "docs.getgrist.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 3 of the 7 things a reader expects, and has 1 clause that costs points", "points": 4.6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 3 of the 8 things a reader expects", "points": 6.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://www.getgrist.com/terms/", "state": "read", "readAt": "2026-10-08", "words": 2008, "points": 4.6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "You agree that this EULA shall be governed by New York State law, consent to the exclusive jurisdiction and venue of applicable courts located in New York County for any dispute related to the Software or this EULA, and agree to bring any action solely in such courts.", "says": "The law of New York, with disputes in the courts of New York County" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": false }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": false }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Grist Labs may modify or amend the terms of this EULA by posting a copy of the most current agreement on our website.", "says": "Changes are posted, with no other notice named" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS EULA, YOU MAY NOT DOWNLOAD, INSTALL, USE, OR COPY THE SOFTWARE." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "You acknowledge and agree that the form and nature of the Software which Grist Labs provides may change from time to time without prior notice to you.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Grist Labs reserves the right to suspend or terminate this EULA, the License and the rights afforded to you hereunder at any time at our discretion and without notice." } ], "notes": [ { "date": "2026-10-08", "text": "Grist Labs excludes liability for all damages, direct damages included, however caused.", "quote": "YOU EXPRESSLY UNDERSTAND AND AGREE THAT GRIST LABS SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES WHICH MAY BE INCURRED BY YOU, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY." } ] }, { "kind": "privacy", "url": "https://www.getgrist.com/privacy/", "state": "read", "readAt": "2026-10-08", "statedDate": "2019-04-01", "words": 1025, "points": 6.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Effective Date: April 1, 2019", "says": "Last updated 2019-04-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This policy sets out our privacy practices and explains how we handle the information we collect when you visit and use our websites, products, and services (“Services”)." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Some of our Services also let you access your accounts with other service providers and we collect information required to establish those connections." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": false }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "toKnow": [ { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Effective Date: April 1, 2019" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/grist.json", "live": { "slug": "grist", "probe": { "target": "https://docs.getgrist.com/api", "method": "get", "lastAt": "2026-10-08T21:12:11.613117891Z", "lastOk": true, "lastStatus": 404, "lastMs": 251, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 256, "p95ms24h": 311, "samples24h": 21, "samples30d": 21, "days": [ { "date": "2026-10-08", "probes": 21, "ok": 21 } ] }, "updatedAt": "2026-10-08T21:12:11.613117891Z" } } }