# Grist > Grist is a spreadsheet-database hybrid from Grist Labs with typed columns and Python formulas, sold as a hosted service and as open-source software to self-host. Agents reach it through a REST API and an MCP server with OAuth. - Canonical: https://www.anchorterminal.com/tools/grist - Markdown: https://www.anchorterminal.com/tools/grist.md (~8,450 tokens) - Slim: https://www.anchorterminal.com/tools/grist.min.md (~2,130 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/grist.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-08 ## Overview **Grade D · 50.1/100 · rank #597 of 722 · #10 in Spreadsheets & operational tables · not agent-ready · confidence medium** ## Assessment OAuth tokens carry seven scopes, can be limited to chosen documents and expire after an hour, and the REST API has a public OpenAPI file with an add-or-update call. No status page, SLA terms, DPA or security.txt was found, and the docs say the hosted service has no SOC 2 or ISO 27001 audit. ## Facts | Field | Value | | --- | --- | | Vendor | Grist Labs Inc. (https://www.getgrist.com) | | Kind | HTTP API | | Category | Spreadsheets & operational tables (https://www.anchorterminal.com/categories/spreadsheets) | | Transport | HTTP, Streamable HTTP | | Endpoint | `https://docs.getgrist.com/api` | | Auth | OAuth or key · Self-serve. A signed-in user creates an API key on the Developer page of account settings and sends it as `Authorization: Bearer`. The key carries its owner's full account access, and each account has one. The alternative is OAuth 2.0 with PKCE, used by the MCP server and by registered apps. The user approves any of seven scopes (`doc:read`, `doc:write`, `doc.schema:write`, `doc:download`, `doc:webhooks`, `user.profile:read`, `offline_access`) and can limit the grant to chosen sites, workspaces or documents. Access tokens last 1 hour and refresh tokens 60 days, and a grant can be revoked per app. Clients can register themselves by Client ID Metadata Document. Not every REST endpoint accepts an OAuth token. | | Pricing | Freemium ($10 / seat-mo) · Free plan with 5,000 rows a document and 3,000 API calls a month per site, REST and MCP calls together, so an agent can start without a contract. Pro is $10 a user a month ($8 billed yearly) and Business $30 ($24 yearly, minimum 5 users), Enterprise through sales. API calls aren't priced, the MCP server is on every plan for now, and there's no separate sandbox. The self-hosted community edition is free (checked 2026-10-08). | | x402 | No · No x402, MPP or L402 in the API docs, the OpenAPI file, the MCP docs or the pricing page (checked 2026-10-08). | | Licence | Apache-2.0 for the community edition in gristlabs/grist-core. The full edition, which adds the MCP server, the OAuth server and audit log streaming, is proprietary and needs an activation key after a 30-day trial. Docs are CC BY-SA 4.0 | | Tools exposed | 34 | | Packages | npm: `grist-api`; pypi: `grist-api` | | Source | https://github.com/gristlabs/grist-core | | Docs | https://support.getgrist.com/rest-api/ | | llms.txt | not found | | Last release | 2026-09-28 | | GitHub stars | 11,900 (as of 2026-10-08) | | npm downloads / week | 341 | | PyPI downloads / week | 240 | | Surfaces graded | Hosted Grist's REST API at https://docs.getgrist.com/api (or https://.getgrist.com/api) and its MCP server at https://docs.getgrist.com/api/mcp. The same API can be self-hosted, and the MCP server needs the full edition there | | Free tier | 5,000 rows a document, 10 team members, 1 GB of attachments a document, 3,000 API calls a month per site with REST and MCP calls sharing the pool | | Rate limits | Free 3,000 calls a month per site and 5 requests a second per document. Pro 40,000 and Business 60,000 calls per document per day. 10 concurrent requests per document on all plans, 429 beyond that. 1 MB per request body, 50 MB per upload | | Auth and scopes | API key (`Authorization: Bearer`), one per account, full account access. OAuth 2.0 with PKCE and scopes `doc:read`, `doc:write`, `doc.schema:write`, `doc:download`, `doc:webhooks`, `user.profile:read`, `offline_access`, limited to chosen sites, workspaces or documents | | Tokens | Access tokens prefixed `grist_at_` last 1 hour, refresh tokens prefixed `grist_rt_` last 60 days and rotate. Revocation at `/oidc/revocation` or from the Authorised apps page | | Read and write | Records (list, add, modify, add or update, delete), tables and columns, attachments, webhooks, read-only SQL, downloads as CSV, TSV, XLSX or the whole document, plus sites, workspaces, access and service accounts | | Filtering | `filter` (JSON object of column to allowed values), `sort`, `limit`, `hidden` and `cellFormat` on list records, also as `X-Sort` and `X-Limit` headers. No offset or cursor. `/sql` runs a SELECT with parameters and a timeout | | MCP server | Remote, streamable HTTP, 34 tools listed in the docs for discovery, reading, writing, schema, pages and widgets, and attachments. OAuth, API key or service account. Tool schemas aren't public | | Change events | Webhooks per table on rows added or updated, with a ready column as a condition, an optional `Authorization` header, a batched queue and periodic retries | | SDKs | `grist-api` on npm (0.1.7, February 2022) and PyPI (0.1.1, October 2024), both by Grist Labs. Community clients for Go, Rust, R and others are linked from the docs | | Deprecations | No policy found. The OpenAPI file marks the four `/data` operations deprecated in favour of `/records`, and release notes list API changes | | Certifications | None. The data security page says hosted Grist has not gone through SOC 2, ISO 27001, HIPAA or GDPR certification. No bug bounty or security.txt found | | Advisories | 10 published on GitHub, 5 in the last 12 months, 2 of them critical (21 January and 13 September 2026), all fixed | | Status and SLA | No status page found. SLAs are named among Enterprise services on the pricing page, with no terms published | | Data location | AWS in the United States, with S3 for encrypted storage. A dedicated server in a chosen AWS region on Enterprise. Deleted documents stay 30 days in the trash | | Open source | Community edition under Apache-2.0 with the REST API, webhooks and access rules. The MCP server, OAuth server, AI Assistant and audit log streaming are in the proprietary full edition | | Capabilities | sheets.records, sheets.read, sheets.write, sheets.tables, sheets.formulas | | Tags | official, hosted, self-hosted, open-source, mcp, free-tier, oauth, api-key, openapi, webhooks, python, javascript | | JSON | https://www.anchorterminal.com/api/v1/tools/grist.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 39 | 7.8 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 63 | 10.2 | | Agent ergonomics | 13% | 16.2 | 57 | 9.3 | | Security & auth | 14% | 17.5 | 62 | 10.8 | | Payments & pricing | 10% | 12.5 | 30 | 3.8 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 78 | 6.8 | | Transparency & trust (editorial 50, provenance 71) | 7% | 8.8 | 61 | 5.3 | | Negative events | up to −15 | up to −15 | 2026-09-13. GHSA-9x4j-4rw5-3vmq, critical (CVSS 10.0), remote code execution through prototype pollution from an imported crafted document, affecting Docker images before 1.7.19 and fixed in 1.7.19. Four more advisories were published in the last 12 months, among them GHSA-7xvx-8pf2-pv5g (CVE-2026-24002, critical, 21 January 2026) on the pyodide sandbox option, fixed in 1.7.9. All five are fixed and published and none says whether hosted Grist was affected, so the deduction is reduced (https://github.com/gristlabs/grist-core/security/advisories) | -4 | | **Total** | | | | **50.1 → D** | ### Why each score - Reliability 39: Graded on hosted Grist's REST API and MCP server at docs.getgrist.com, with the hosted lines. No status page was found. status.getgrist.com redirects to a signup form, and the site footer and help centre link to none (0). With no page there is no readable incident history (5). Limits are published with numbers, 3,000 calls a month on Free, 40,000 and 60,000 per document per day on Pro and Business, 5 requests a second per document on Free and 10 concurrent requests per document on every plan (15). The limits page says an eleventh concurrent request gets 429 and that a client sending one request at a time won't hit it. No Retry-After header or backoff guidance was found, and `PUT` on `/records` with `require` gives a retry-safe write (9 of 15). The pricing page names SLAs among Enterprise services and publishes no terms (0). The REST API is generally available and the MCP server, live since June 2026, carries no beta label (10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 63: The OpenAPI 3.0.0 file in the public docs repository has 101 paths and 120 operations and is rendered at support.getgrist.com/api. The MCP server is in the proprietary full edition and its endpoint answers 401 without a token, so we couldn't read its tool schemas (22 of 25). No llms.txt on www.getgrist.com or support.getgrist.com. The docs source is Markdown in a public repository (3 of 10). Parameter descriptions are detailed, but the four `/records` operations carry a summary and no description. The MCP docs group 34 tools with one line each (13 of 20). Path and query parameters are typed with 16 enums. Record fields depend on the table, `filter` is a JSON string and `/apply` takes arrays in Grist's internal action format (8 of 15). The file has examples throughout, but only 36 of 120 operations document an error response (400, 403 or 404) and none documents 429 (8 of 15). The file is versioned 1.0.1 with no version in the path. GitHub release notes and monthly newsletters record API changes, and four `/data` operations are marked deprecated (9 of 15). - Agent ergonomics 57: The MCP docs list 34 tools, more than 30, which earns 5. We added 8 because OAuth scopes limit a connection to reading and the client can ask for fewer scopes (13 of 25). List records takes `filter`, `sort` and `limit` with no offset or cursor, and the read-only `/sql` endpoint takes a SELECT with parameters and a timeout (15 of 20). OAuth errors follow the standard `error` and `error_description` shape, and the MCP docs explain the missing scope and doc not found errors. The REST reference documents few error bodies (10 of 20). `PUT` on `/records` adds or updates by `require` keys, with `onmany`, `noadd` and `noupdate` to control it. No idempotency key was found, and we couldn't read whether the MCP tools carry readOnlyHint or destructiveHint (10 of 20). Few required parameters. Grist Labs maintains `grist-api` for JavaScript and Python, last published in February 2022 and October 2024 (9 of 15). - Security & auth 62: OAuth 2.0 authorisation code flow with PKCE, seven scopes, grants limited to chosen sites, workspaces or documents, access tokens of 1 hour, refresh tokens of 60 days and revocation per app. The alternative API key carries its owner's full access, with one key per account, and travels only in the `Authorization` header (28 of 30). A connection can hold `doc:read` alone, and schema changes need a separate scope. No server-side confirmation for `remove_records` or `remove_table` was found, and the docs leave approval to the client (15 of 20). Cells can hold text written by others. The MCP docs warn that anything read is visible to the client's AI provider, and no prompt-injection guidance was found (3 of 15). The Authorised apps page shows each app's scopes, resources and last use, and document history records changes. Audit log streaming is an Enterprise capability (7 of 15). SECURITY.md gives security@getgrist.com with acknowledgement in three working days, and 10 advisories are published on GitHub. No security.txt or bug bounty, and the docs say hosted Grist has no SOC 2 or ISO 27001 audit (9 of 20). - Payments & pricing 30: Graded on hosted Grist. No x402, MPP or L402 found (0). Plan prices are public, Pro at $10 and Business at $30 a user a month ($8 and $24 billed yearly), with no per-call price (10). A Free plan with 5,000 rows a document and 3,000 API calls a month. The pricing page doesn't mention a card for it, and we didn't complete a signup (20). A person signs up in a browser and creates the key or approves the OAuth consent screen. A client can register itself by Client ID Metadata Document, but that doesn't remove the sign-in (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 78: Release v1.7.20 was tagged on 28 September 2026, 10 days before the check (30). Four releases in the last 90 days, v1.7.17 on 29 July, v1.7.18 on 28 August, v1.7.19 on 5 September and v1.7.20 (20). The repository shows 636 open issues, with 15 updated between 9 September and 5 October 2026, and the community forum had posts on the day of the check. We didn't read maintainers' reply times (15 of 25). The only Grist entry in the official MCP registry is a third party's. The official `grist-api` clients exist but date from February 2022 (npm 0.1.7) and October 2024 (PyPI 0.1.1) (5 of 15). The CI workflow runs lint, server, browser and Python test groups on every push to main, and v1.7.20 updated a dependency for a security fix. We didn't read the current CI result (8 of 10). - Transparency & trust 61: The core in gristlabs/grist-core is Apache-2.0. The MCP server, the OAuth server and audit log streaming are in the proprietary full edition, which is what hosted Grist runs (24 of 30). The privacy policy is dated 1 April 2019 and names no retention periods. The data security page adds AWS in the United States, encrypted S3 storage, a 30-day trash and logs kept only as long as needed, and the two don't conflict. No DPA was found (12 of 30). No deprecation policy was found, and the terms allow changes and withdrawal without notice. The OpenAPI file marks the four `/data` operations deprecated, and release notes list API changes (5 of 20). AWS in the United States is stated, OpenAI is named for the AI Assistant, and the privacy policy names Amazon, Google and MailChimp. No sub-processor list was found (9 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (21 items): https://www.anchorterminal.com/fixes/grist.md (JSON https://www.anchorterminal.com/fixes/grist.json) ### What we couldn't check - unchecked: the MCP server's tool definitions, input schemas and annotations. The server is in the proprietary full edition and `https://docs.getgrist.com/api/mcp` answers 401 without a token. The count of 34 tools is from the docs page, and the September 2026 newsletter names 6 layout tools the page doesn't list - unchecked: whether signup on hosted Grist asks for a card, an email confirmation or a captcha. We didn't create an account, and the pricing page doesn't mention a card for the Free plan - unchecked: maintainers' reply times on GitHub issues and the current CI result. The GitHub API refused us, and the counts of 11,900 stars and 636 open issues are read from the repository pages - unchecked: whether hosted Grist was affected by the five advisories of the last 12 months. None of the advisories read says - No status page, published SLA terms, DPA, sub-processor list, retention period, security.txt, bug bounty, llms.txt, Retry-After header, idempotency key, deprecation policy or prompt-injection guidance was found in the reviewed pages - The terms page is an End-User Licence Agreement with no date. It covers Grist Labs' products, software, services and websites, so it is recorded as the governing terms. The privacy policy is dated 1 April 2019 - The pricing page names SLAs among Enterprise services. No points were given because no terms are published - List records has `limit` with no offset or cursor in the OpenAPI file. Paging beyond that needs the `/sql` endpoint - The lead was right on vendor, URL and the REST interface. It missed the MCP server at `https://docs.getgrist.com/api/mcp` and OAuth, both launched in June 2026, and the legal entity is Grist Labs Inc. ### Sources - MCP server docs: (seen 2026-10-08) - REST API usage and client libraries: (seen 2026-10-08) - API reference: (seen 2026-10-08) - OpenAPI file (docs repository cloned at commit b047726, 30 September 2026): (seen 2026-10-08) - OAuth apps: (seen 2026-10-08) - connected apps: (seen 2026-10-08) - limits: (seen 2026-10-08) - data security: (seen 2026-10-08) - webhooks: (seen 2026-10-08) - telemetry overview: (seen 2026-10-08) - AI Assistant data use policy: (seen 2026-10-08) - newsletters (June to September 2026): (seen 2026-10-08) - pricing: (seen 2026-10-08) - security page: (seen 2026-10-08) - terms (End-User Licence Agreement): (seen 2026-10-08) - privacy policy: (seen 2026-10-08) - home page navigation and footer: (seen 2026-10-08) - OAuth authorisation server metadata: (seen 2026-10-08) - OAuth protected resource metadata: (seen 2026-10-08) - MCP endpoint (401 without a token): (seen 2026-10-08) - status.getgrist.com (redirects to signup): (seen 2026-10-08) - security.txt (404): (seen 2026-10-08) - repository (cloned at commit c08ec70, 7 October 2026): (seen 2026-10-08) - releases: (seen 2026-10-08) - security policy: (seen 2026-10-08) - security advisories: (seen 2026-10-08) - advisory GHSA-9x4j-4rw5-3vmq: (seen 2026-10-08) - advisory GHSA-7xvx-8pf2-pv5g: (seen 2026-10-08) - open issues: (seen 2026-10-08) - npm package grist-api: (seen 2026-10-08) - PyPI package grist-api: (seen 2026-10-08) - official MCP registry search: (seen 2026-10-08) - community forum, latest topics: (seen 2026-10-08) - RDAP for getgrist.com: (seen 2026-10-08) ## Who's behind it (provenance 71/100, checked 2026-10-08) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Grist Labs Inc. | 20/20 | | Domain age | getgrist.com, registered 2014-05-12 (12 years) | 15/15 | | Endpoint on the vendor's domain | docs.getgrist.com | 15/15 | | Terms of service | read, states 3 of the 7 things a reader expects, and has 1 clause that costs points | 4.6/10 | | Privacy policy | read, states 3 of the 8 things a reader expects | 6.3/10 | | Status page | not found | 0/10 | | Changelog | published | 10/10 | | security.txt | not found | 0/10 | The terms page is an End-User Licence Agreement between the user and Grist Labs Inc., covering its products, software, services and websites, governed by New York State law, with legal notices to 93 4th Ave, #1127, New York, NY 10003. It carries no date. The privacy policy has an effective date of 1 April 2019 and covers the websites, products and services. It names no retention periods. The REST API and MCP server answer at docs.getgrist.com and .getgrist.com, and OAuth at login.getgrist.com, all getgrist.com subdomains. No status page was found. status.getgrist.com redirects to a signup form because every subdomain is treated as a team site. www.getgrist.com/.well-known/security.txt and docs.getgrist.com/.well-known/security.txt return 404. SECURITY.md in the repository gives security@getgrist.com. RDAP for getgrist.com gives a registration date of 2014-05-12. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://www.getgrist.com/terms/), read 2026-10-08, gives no date, states 3 of the 7 things a reader expects. - To know. Says the terms or the service can change without notice (costs points). "You acknowledge and agree that the form and nature of the Software which Grist Labs provides may change from time to time without prior notice to you." - To know. Says access can be ended without notice or for any reason. "Grist Labs reserves the right to suspend or terminate this EULA, the License and the rights afforded to you hereunder at any time at our discretion and without notice." - Not found in the text. Gives the date it was last updated. - Names the governing law or courts. The law of New York, with disputes in the courts of New York County. - Not found in the text. States a limit on its liability. - Not found in the text. Says how the agreement or account can be ended. - Says how changes to the terms are announced. Changes are posted, with no other notice named. - Not found in the text. Refers to a service level or uptime commitment. - Also in the text (2026-10-08). Grist Labs excludes liability for all damages, direct damages included, however caused. "YOU EXPRESSLY UNDERSTAND AND AGREE THAT GRIST LABS SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES WHICH MAY BE INCURRED BY YOU, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY." **Privacy policy** (https://www.getgrist.com/privacy/), read 2026-10-08, dated 2019-04-01, states 3 of the 8 things a reader expects. - To know. Has not been updated for three years or more. "Effective Date: April 1, 2019" - Gives the date it was last updated. Last updated 2019-04-01. - Not found in the text. Says how long data is kept. - Not found in the text. Says whether personal data is sold or shared for advertising. - Not found in the text. Says what rights people have over their data. - Not found in the text. Gives a privacy contact. - Not found in the text. Says where data is transferred or stored. ## Live (updated 2026-10-08 21:53 UTC) - Right now: up, HTTP 404, 262 ms, checked 2026-10-08 21:53 UTC (get on `https://docs.getgrist.com/api`) - Uptime 24h 100.0% (28 probes) · 30 days 100.0% (28 probes) · p50 256 ms · p95 311 ms - Always current: https://www.anchorterminal.com/api/v1/live/grist.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | Pro (hosted) | $10 | per seat per month | billed monthly, $8 billed yearly, 100,000 rows a document, 40,000 API calls per document per day | | Business (hosted) | $30 | per seat per month | billed monthly, $24 billed yearly, minimum 5 users, 150,000 rows a document, 60,000 API calls per document per day | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - OAuth 2.0 with PKCE and seven scopes, with `doc:read`, `doc:write` and `doc.schema:write` granted separately and the grant limited to chosen sites, workspaces or documents - Access tokens last 1 hour, refresh tokens 60 days, and a user can revoke one app's grant from the Authorised apps page - Public OpenAPI 3.0.0 file with 101 paths and 120 operations, including a read-only SQL endpoint and `PUT` on `/records` to add or update by key columns - Limits are published with numbers per plan, with 10 concurrent requests per document and a 1 MB request body on every plan - The core is Apache-2.0 and four releases were tagged between 29 July and 28 September 2026 ## Weaknesses - No status page was found. status.getgrist.com redirects to a signup form, and the site footer and help centre link to none - An API key carries its owner's full account access, and each account has one key, so it can't be limited to a document or revoked per integration - The data security page says hosted Grist has no SOC 2, ISO 27001, HIPAA or GDPR certification, and no DPA, sub-processor list or security.txt was found - The MCP server and OAuth server are in the proprietary full edition, so the Apache-2.0 community edition has neither and the tool definitions aren't public - Five security advisories were published in the last 12 months, two rated critical, the latest on 13 September 2026 with CVSS 10.0 - The Free plan allows 3,000 API calls a month across a site, with REST and MCP calls sharing the pool ## Before you call it (notes for agents) 1. Connect through OAuth, not an API key. Ask for `doc:read` alone for reading, and have the user pick Selected resources on the consent screen 2. Keep `doc.schema:write` off unless needed. The docs say formula editing lets its holder read any data in the document whatever the access rules 3. Send requests for one document one at a time. The eleventh concurrent request gets 429, and no Retry-After header is documented 4. Use `PUT /api/docs/{docId}/tables/{tableId}/records` with `require` to add or update by key, so a retried write doesn't create a duplicate row 5. Use the `/records` endpoints, not the deprecated `/data` ones, and split large writes to stay under the 1 MB body limit ## Connect Install: ```bash pip install grist-api ``` First request: ```bash curl -H "Authorization: Bearer " https://docs.getgrist.com/api/orgs ``` Claude Code: ```bash claude mcp add --transport http grist https://docs.getgrist.com/api/mcp ``` Through letme (picks today, calling later): https://letme.dev/grist. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | NocoDB | BB | 75.7 | 37 | sheets.records, sheets.read, sheets.write, sheets.tables, sheets.formulas | no | https://www.anchorterminal.com/tools/nocodb.md | | Airtable | BB | 70.9 | 124 | sheets.records, sheets.read, sheets.write, sheets.tables, sheets.formulas | no | https://www.anchorterminal.com/tools/airtable.md | | SeaTable | B | 66.3 | 241 | sheets.records, sheets.read, sheets.write, sheets.tables, sheets.formulas | no | https://www.anchorterminal.com/tools/seatable.md | | Coda (Superhuman Docs) | B | 64.8 | 270 | sheets.read, sheets.write, sheets.tables, sheets.records, sheets.formulas | no | https://www.anchorterminal.com/tools/coda.md | | Baserow | B | 63.6 | 306 | sheets.records, sheets.read, sheets.write, sheets.tables, sheets.formulas | no | https://www.anchorterminal.com/tools/baserow.md | | Teable | C | 61 | 379 | sheets.read, sheets.write, sheets.records, sheets.tables, sheets.formulas | no | https://www.anchorterminal.com/tools/teable.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The MCP server at https://docs.getgrist.com/api/mcp went live in June 2026 on every hosted plan and on the full edition of self-hosted Grist, and the docs say plan availability may change (source: ) - The docs list 34 MCP tools in six groups, each prefixed `grist_`, from `list_orgs` and `query_document` to `remove_table` and `add_page_widget` (source: ) - OAuth grants can be limited to chosen sites, workspaces or documents, and a request for a document outside the grant returns 403 (source: ) - The docs warn that `doc.schema:write` lets its holder obtain any data in the document through formulas, whatever the access rules (source: ) - Free plans are limited to 3,000 API calls a month per site, Pro to 40,000 and Business to 60,000 per document per day, and every plan to 10 concurrent requests per document (source: ) - The OpenAPI 3.0.0 file has 101 paths and 120 operations, with a read-only SQL endpoint and `PUT` on `/records` to add or update by key columns (source: ) - The data security page says hosted Grist runs on AWS in the United States and has not gone through SOC 2, ISO 27001, HIPAA or GDPR certification (source: ) - Advisory GHSA-9x4j-4rw5-3vmq of 13 September 2026, rated critical at CVSS 10.0, covers remote code execution from an imported crafted document and was fixed in 1.7.19 (source: ) ## Compare - [Coda (Superhuman Docs) vs Grist](https://www.anchorterminal.com/compare/coda-vs-grist.md): B 64.8 vs D 50.1 - [Google Sheets API vs Grist](https://www.anchorterminal.com/compare/google-sheets-api-vs-grist.md): BB 76.3 vs D 50.1 - [Grist vs Microsoft Excel (Microsoft Graph workbook API)](https://www.anchorterminal.com/compare/grist-vs-microsoft-excel-graph.md): D 50.1 vs C 58.5 - [Airtable vs Grist](https://www.anchorterminal.com/compare/airtable-vs-grist.md): BB 70.9 vs D 50.1 - [Baserow vs Grist](https://www.anchorterminal.com/compare/baserow-vs-grist.md): B 63.6 vs D 50.1 - [Grist vs NocoDB](https://www.anchorterminal.com/compare/grist-vs-nocodb.md): D 50.1 vs BB 75.7 - [Grist vs SeaTable](https://www.anchorterminal.com/compare/grist-vs-seatable.md): D 50.1 vs B 66.3 - [Grist vs Smartsheet API + MCP](https://www.anchorterminal.com/compare/grist-vs-smartsheet.md): D 50.1 vs B 67.6 - [Grist vs Teable](https://www.anchorterminal.com/compare/grist-vs-teable.md): D 50.1 vs C 61 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on getgrist.com or one of its subdomains, or the README of github.com/gristlabs/grist-core. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "grist", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html Grist on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![Grist on Anchor Terminal](https://www.anchorterminal.com/badges/grist.svg)](https://www.anchorterminal.com/tools/grist) ``` Plain link: ```html Grist on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Grist is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/grist-dark.png - Light: https://www.anchorterminal.com/assets/share/grist-light.png