{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/nocodb.json", "name": "NocoDB", "score": 75.7, "shared": [ "sheets.records", "sheets.read", "sheets.write", "sheets.formulas" ], "slug": "nocodb" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/airtable.json", "name": "Airtable", "score": 70.9, "shared": [ "sheets.records", "sheets.read", "sheets.write", "sheets.formulas" ], "slug": "airtable" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/coda.json", "name": "Coda (Superhuman Docs)", "score": 64.8, "shared": [ "sheets.read", "sheets.write", "sheets.records", "sheets.formulas" ], "slug": "coda" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/baserow.json", "name": "Baserow", "score": 63.6, "shared": [ "sheets.records", "sheets.read", "sheets.write", "sheets.formulas" ], "slug": "baserow" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/google-sheets-api.json", "name": "Google Sheets API", "score": 76.3, "shared": [ "sheets.read", "sheets.write", "sheets.formulas" ], "slug": "google-sheets-api" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/microsoft-excel-graph.json", "name": "Microsoft Excel (Microsoft Graph workbook API)", "score": 58.5, "shared": [ "sheets.read", "sheets.write", "sheets.formulas" ], "slug": "microsoft-excel-graph" } ], "tool": { "slug": "smartsheet", "name": "Smartsheet API + MCP", "vendor": "Smartsheet Inc.", "vendorUrl": "https://www.smartsheet.com", "kind": "http-api", "category": "spreadsheets", "summary": "Smartsheet is a hosted work management product built on sheets with typed columns, rows, formulas, reports and dashboards. Agents reach it through a REST API (187 operations) and a hosted MCP server, both limited to Business plans and above.", "url": "https://www.anchorterminal.com/tools/smartsheet", "markdownUrl": "https://www.anchorterminal.com/tools/smartsheet.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/smartsheet.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/smartsheet.json", "repo": "https://github.com/smartsheet/smartsheet-python-sdk", "license": "Proprietary service under Smartsheet's User Agreement and Developer Agreement. The SDKs on GitHub are Apache-2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.smartsheet.com/2.0", "packages": [ { "registry": "pypi", "name": "smartsheet-python-sdk" }, { "registry": "npm", "name": "smartsheet" } ], "auth": "mixed", "authNotes": "Access needs a licensed user on a Business plan or higher. A user makes a raw API token in Personal Settings and sends it as a Bearer token. It has no scopes and carries all of that user's access. Apps acting for other users register in Developer Tools (Smartsheet approves the registration request) and use the OAuth 2.0 authorisation code grant with any of 17 scopes such as READ_SHEETS and WRITE_SHEETS. Access tokens last about 7 days and refresh. Scopes can't exceed the user's sharing level on a sheet. The MCP server takes OAuth from ChatGPT, Claude, Gemini Enterprise Plus and Microsoft 365 Copilot, and a Bearer API token from other clients. A System Admin's token can act as any user through the `Assume-User` header.", "pricing": "paid", "pricingNotes": "API and MCP access start at the Business plan, $24 a member a month billed monthly or $19 billed yearly, with a minimum of three members. Pro ($12, or $9 yearly) has no API calls. Enterprise and Advanced Work Management are priced through sales. API calls carry no separate charge. A 30-day trial needs no card, but we couldn't confirm that a trial account can make API tokens. No developer sandbox was found in the reviewed documentation (https://www.smartsheet.com/pricing, checked 2026-10-08).", "priceSummary": "$19 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the OpenAPI spec or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 83, "popularity": { "githubStars": 82, "npmWeekly": 47484, "pypiWeekly": 311787, "asOf": "2026-10-08" }, "docsUrl": "https://developers.smartsheet.com", "llmsTxt": "https://developers.smartsheet.com/llms.txt", "openapi": "https://developers.smartsheet.com/_bundle/api/smartsheet/openapi.yaml", "capabilities": [ "sheets.read", "sheets.write", "sheets.records", "sheets.formulas", "automation.workflows" ], "tags": [ "official", "hosted", "closed-source", "mcp", "oauth", "openapi", "llms-txt", "webhooks", "python", "typescript", "java", "csharp", "status-page", "soc2", "sla" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 67.6, "grade": "B", "agentReady": false, "rank": 190, "ranked": true, "rankOf": 629, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 80, "payments": 20, "reliability": 65, "schema": 88, "security": 66, "transparency": 82 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 65, "points": 13, "reason": "Graded on the hosted API and MCP server. Statuspage at status.smartsheet.com with components for the REST API, Webhooks, Sheets and API Access Tokens (20). Ten incidents since 15 July 2026, eight marked major or critical. Post-incident reports put API timeouts at about five hours on 30 July, sheet and report failures on 11 August and 26 to 28 August, and a 51-minute US outage on 11 September (0). 300 requests a minute per token, 30 for attachments and cell history (15). Error 4003 on 429 with advice to wait 60 seconds or back off, and SDK retries, but no Retry-After header or idempotency keys documented (10). A 99.9 per cent SLA for Enterprise plans (10). GA, with no beta label on the API or the MCP server (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 88, "points": 14.3, "reason": "OpenAPI 3.0.3 spec with 187 operations, downloadable without login. The MCP docs describe the server as self-describing, which we couldn't confirm without an account (25). llms.txt and a Markdown copy of each docs page (10). The MCP reference gives each tool best practices, limitations and use cases, such as calling `get_columns` before filtering. We read the reference, not the live tool definitions (16). 472 schemas and 668 enums in the spec, though toolset executors take a tool name and a free-form arguments object (11). Code samples on 180 of 187 operations and a numbered error code page (14). Dated changelogs for the API and the MCP server. The API stays at 2.0 and changes arrive within that version (12)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "The MCP reference lists 83 tools, which scores 5, plus 10 for toolsets with `search_tools` and a read or write filter. The API narrows a sheet read with columnIds, rowIds, rowsModifiedSince, include and exclude (15). Token and offset pagination, with unbounded includeAll results removed on 15 June 2026, and filters, sorting and column selection on `get_sheet_summary` (18). Numbered error codes with messages, and per-item failures on bulk writes (17). No idempotency keys. Partial success on bulk writes, a version check on sheet reads and separate read and write executors in MCP help. MCP annotations couldn't be read (9). Four official SDKs with retries built in, and few required parameters (15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 66, "points": 11.55, "reason": "OAuth 2.0 authorisation code grant with 17 scopes and tokens that expire in about 7 days. No PKCE or dynamic client registration appears in the docs or the server's OAuth metadata, and the raw API token most coding clients use has no scopes (22). READ_SHEETS gives a read-only grant and sharing levels cap what a token can touch. The MCP docs flag destructive tools and ask the agent to confirm, with no enforced approval step (12). Cells, comments and attachments are written by other people and no injection guidance was found (3). Activity log on Business and above, an Event Reporting API with over 100 event types, and a `smartsheet-integration-source` header that labels AI traffic (12). SOC 2, ISO 27001, ISO 27701, FedRAMP and a bug bounty form. security.txt expired on 1 July 2026 (17)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "No x402, MPP or L402 found in the docs, the OpenAPI spec or the pricing page (0). Plan prices are public for Pro and Business, per member per month, with Enterprise through sales and no per-call price (10). A 30-day trial with no card is advertised. We scored it at half because the API needs a Business plan and we couldn't confirm that trial accounts can make tokens, and there's no free tier afterwards (10). A person signs up in a browser and creates the token or approves OAuth (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 80, "points": 7, "reason": "API changelog entries on 2 and 6 October 2026 and MCP changelog entries on 2 October (30). Nine API and ten MCP changelog entries since 10 July 2026 (20). Closed service with dated changelogs, a developer community and a Stack Overflow tag. We didn't measure response times (10). SDKs for Python, JavaScript, Java and C# all released on 12 August 2026. The hosted MCP server isn't in the official MCP registry, where the only Smartsheet entry is a third-party Resource Management server (12). SDK repositories have CI workflows and commits in September and October 2026 (8)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 82, "points": 7.18, "note": "editorial 72, provenance 92", "reason": "Closed service with a public User Agreement (3 April 2026) and Developer Agreement (1 July 2021). SDKs are Apache-2.0 (17). Privacy notice of 20 May 2026, a DPA built into the User Agreement, deletion of customer content within 180 days of termination, and a statement that customer data isn't used to train third-party foundation models. Personal data retention has no stated periods (22). A written deprecation process with DEPRECATION and SUNSET changelog entries, such as the `home` destination type ending on or after 30 October 2026, announced 22 September. No minimum notice period is promised (15). Sub-processor list with purposes, locations and a revision history, and US, EU and Australian regions (18)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "The MCP reference lists 83 tools, which scores 5, plus 10 for toolsets with `search_tools` and a read or write filter. The API narrows a sheet read with columnIds, rowIds, rowsModifiedSince, include and exclude (15). Token and offset pagination, with unbounded includeAll results removed on 15 June 2026, and filters, sorting and column selection on `get_sheet_summary` (18). Numbered error codes with messages, and per-item failures on bulk writes (17). No idempotency keys. Partial success on bulk writes, a version check on sheet reads and separate read and write executors in MCP help. MCP annotations couldn't be read (9). Four official SDKs with retries built in, and few required parameters (15).", "maintenance": "API changelog entries on 2 and 6 October 2026 and MCP changelog entries on 2 October (30). Nine API and ten MCP changelog entries since 10 July 2026 (20). Closed service with dated changelogs, a developer community and a Stack Overflow tag. We didn't measure response times (10). SDKs for Python, JavaScript, Java and C# all released on 12 August 2026. The hosted MCP server isn't in the official MCP registry, where the only Smartsheet entry is a third-party Resource Management server (12). SDK repositories have CI workflows and commits in September and October 2026 (8).", "payments": "No x402, MPP or L402 found in the docs, the OpenAPI spec or the pricing page (0). Plan prices are public for Pro and Business, per member per month, with Enterprise through sales and no per-call price (10). A 30-day trial with no card is advertised. We scored it at half because the API needs a Business plan and we couldn't confirm that trial accounts can make tokens, and there's no free tier afterwards (10). A person signs up in a browser and creates the token or approves OAuth (0).", "reliability": "Graded on the hosted API and MCP server. Statuspage at status.smartsheet.com with components for the REST API, Webhooks, Sheets and API Access Tokens (20). Ten incidents since 15 July 2026, eight marked major or critical. Post-incident reports put API timeouts at about five hours on 30 July, sheet and report failures on 11 August and 26 to 28 August, and a 51-minute US outage on 11 September (0). 300 requests a minute per token, 30 for attachments and cell history (15). Error 4003 on 429 with advice to wait 60 seconds or back off, and SDK retries, but no Retry-After header or idempotency keys documented (10). A 99.9 per cent SLA for Enterprise plans (10). GA, with no beta label on the API or the MCP server (10).", "schema": "OpenAPI 3.0.3 spec with 187 operations, downloadable without login. The MCP docs describe the server as self-describing, which we couldn't confirm without an account (25). llms.txt and a Markdown copy of each docs page (10). The MCP reference gives each tool best practices, limitations and use cases, such as calling `get_columns` before filtering. We read the reference, not the live tool definitions (16). 472 schemas and 668 enums in the spec, though toolset executors take a tool name and a free-form arguments object (11). Code samples on 180 of 187 operations and a numbered error code page (14). Dated changelogs for the API and the MCP server. The API stays at 2.0 and changes arrive within that version (12).", "security": "OAuth 2.0 authorisation code grant with 17 scopes and tokens that expire in about 7 days. No PKCE or dynamic client registration appears in the docs or the server's OAuth metadata, and the raw API token most coding clients use has no scopes (22). READ_SHEETS gives a read-only grant and sharing levels cap what a token can touch. The MCP docs flag destructive tools and ask the agent to confirm, with no enforced approval step (12). Cells, comments and attachments are written by other people and no injection guidance was found (3). Activity log on Business and above, an Event Reporting API with over 100 event types, and a `smartsheet-integration-source` header that labels AI traffic (12). SOC 2, ISO 27001, ISO 27701, FedRAMP and a bug bounty form. security.txt expired on 1 July 2026 (17).", "transparency": "Closed service with a public User Agreement (3 April 2026) and Developer Agreement (1 July 2021). SDKs are Apache-2.0 (17). Privacy notice of 20 May 2026, a DPA built into the User Agreement, deletion of customer content within 180 days of termination, and a statement that customer data isn't used to train third-party foundation models. Personal data retention has no stated periods (22). A written deprecation process with DEPRECATION and SUNSET changelog entries, such as the `home` destination type ending on or after 30 October 2026, announced 22 September. No minimum notice period is promised (15). Sub-processor list with purposes, locations and a revision history, and US, EU and Australian regions (18)." }, "sources": [ { "what": "Developer docs index (llms.txt)", "url": "https://developers.smartsheet.com/llms.txt", "seen": "2026-10-08" }, { "what": "OpenAPI spec", "url": "https://developers.smartsheet.com/_bundle/api/smartsheet/openapi.yaml", "seen": "2026-10-08" }, { "what": "MCP server introduction and plan requirement", "url": "https://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server.md", "seen": "2026-10-08" }, { "what": "MCP tools reference", "url": "https://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server-tools.md", "seen": "2026-10-08" }, { "what": "MCP toolsets", "url": "https://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server-toolsets.md", "seen": "2026-10-08" }, { "what": "MCP install guide and region URLs", "url": "https://developers.smartsheet.com/ai-mcp/smartsheet/install-the-smartsheet-mcp-server.md", "seen": "2026-10-08" }, { "what": "MCP changelog", "url": "https://developers.smartsheet.com/ai-mcp/smartsheet/changelog.md", "seen": "2026-10-08" }, { "what": "MCP OAuth metadata", "url": "https://mcp.smartsheet.com/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "API changelog", "url": "https://developers.smartsheet.com/api/smartsheet/changelog.md", "seen": "2026-10-08" }, { "what": "Rate limits and bulk operations", "url": "https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/scalability-options.md", "seen": "2026-10-08" }, { "what": "Authentication guide", "url": "https://developers.smartsheet.com/api/smartsheet/guides/basics/authentication.md", "seen": "2026-10-08" }, { "what": "OAuth guide and scopes", "url": "https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/oauth.md", "seen": "2026-10-08" }, { "what": "API limitations", "url": "https://developers.smartsheet.com/api/smartsheet/guides/limitations.md", "seen": "2026-10-08" }, { "what": "Deprecation process", "url": "https://developers.smartsheet.com/api/smartsheet/guides/deprecation-process.md", "seen": "2026-10-08" }, { "what": "Error codes", "url": "https://developers.smartsheet.com/api/smartsheet/error-codes.md", "seen": "2026-10-08" }, { "what": "Status incidents", "url": "https://status.smartsheet.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "Pricing and plan comparison", "url": "https://www.smartsheet.com/pricing", "seen": "2026-10-08" }, { "what": "Service Level Agreement", "url": "https://www.smartsheet.com/legal/sla", "seen": "2026-10-08" }, { "what": "Trust page", "url": "https://www.smartsheet.com/trust", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.smartsheet.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "Bug bounty page", "url": "https://www.smartsheet.com/legal/bugbounty", "seen": "2026-10-08" }, { "what": "User Agreement", "url": "https://www.smartsheet.com/legal/user-agreement", "seen": "2026-10-08" }, { "what": "Developer Agreement", "url": "https://www.smartsheet.com/legal/developer-program-agreement", "seen": "2026-10-08" }, { "what": "Privacy notice", "url": "https://www.smartsheet.com/legal/privacy", "seen": "2026-10-08" }, { "what": "Sub-processors", "url": "https://www.smartsheet.com/legal/subprocessors", "seen": "2026-10-08" }, { "what": "Python SDK repository and tags", "url": "https://github.com/smartsheet/smartsheet-python-sdk", "seen": "2026-10-08" }, { "what": "Deprecated stdio MCP server", "url": "https://github.com/smartsheet-platform/smar-mcp", "seen": "2026-10-08" }, { "what": "Official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=smartsheet", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the live MCP tool definitions, their JSON Schemas and any readOnlyHint or destructiveHint annotations. The server returns 401 without a token, so the tool count and descriptions come from the docs reference", "unchecked: whether a 30-day trial account can create API tokens or connect to the MCP server", "unchecked: the bug bounty's scope and rewards. The page is an embedded report form", "Whether raw API tokens expire or can be limited by an admin. Not found in the reviewed documentation", "Whether 429 responses carry a Retry-After header. The docs and the spec don't mention one", "How quickly Smartsheet staff answer in the developer community. Not measured" ] }, "negative": 0, "verdict": "The REST API has a public OpenAPI 3.0.3 spec with 187 operations, Markdown docs and llms.txt, and the hosted MCP server loads its 83 documented tools by toolset. API access needs a Business plan or higher, and the status page lists eight incidents marked major or critical between 15 July and 21 September 2026.", "bestFor": "An agent working inside a company that already runs projects in Smartsheet on a Business plan or above, especially row-level reads and batched writes, workflows and dashboards.", "strengths": [ "Public OpenAPI 3.0.3 spec with 187 operations, code samples on 180 of them, plus llms.txt and a Markdown copy of every docs page", "Hosted MCP server in three regions (US, EU, Australia) with toolsets, so a client loads tools by domain through `search_tools`", "OAuth 2.0 with 17 scopes, including READ_SHEETS for a read-only grant, and sheet sharing levels that scopes can't override", "Bulk row writes of up to 500 rows a call with optional partial success and per-row failure details", "Dated API changelog (latest 6 October 2026) with DEPRECATION and SUNSET entries and migration guides" ], "weaknesses": [ "API and MCP access need a Business plan or higher, from $19 a member a month billed yearly with a three-member minimum", "Eight status incidents marked major or critical between 15 July and 21 September 2026, four of them stopping sheets from loading in the US region", "A raw API token carries all of its user's access with no scopes, and it's the credential the docs give for Claude Code, Cursor, Codex and Gemini CLI", "No idempotency keys, and 429 responses carry no documented Retry-After header", "security.txt expired on 1 July 2026, and no prompt-injection guidance was found in the MCP docs" ], "agentNotes": [ "Send writes to one sheet one at a time. Parallel updates with the same token return error 4004", "Batch row changes, up to 500 rows a call, and add `allowPartialSuccess=true` to get per-row failures instead of a failed batch", "On error 4003 (HTTP 429) wait at least 60 seconds before retrying. The limit is 300 requests a minute per token, 30 for attachments and cell history", "Through MCP, call `get_columns` before filtering or writing. Column names are case-sensitive and guesses fail validation", "Use the regional host that matches the account (api.smartsheet.com, .eu or .au). Tokens don't work across regions" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.6 } ], "editorialScores": { "ergonomics": 74, "maintenance": 80, "payments": 20, "reliability": 65, "schema": 88, "security": 66, "transparency": 72 }, "provenanceScore": 92 }, "connect": { "install": "pip install smartsheet-python-sdk", "http": "curl \"https://api.smartsheet.com/2.0/workspaces?maxItems=100\" \\\n -H \"Authorization: Bearer $SMARTSHEET_API_TOKEN\"", "claudeCode": "claude mcp add --transport http smartsheet-mcp https://mcp.smartsheet.com -H \"Authorization:Bearer ${SMARTSHEET_API_TOKEN}\"", "config": { "mcpServers": { "smartsheet-mcp": { "headers": { "Authorization": "Bearer ${SMARTSHEET_API_TOKEN}" }, "httpUrl": "https://mcp.smartsheet.com" } } } }, "letme": { "capability": "https://letme.dev/sheets.read", "tool": "https://letme.dev/smartsheet" }, "notable": [ "The hosted MCP server answers at https://mcp.smartsheet.com, https://mcp.smartsheet.eu and https://mcp.smartsheet.au, with OAuth for ChatGPT, Claude, Gemini Enterprise Plus and Microsoft 365 Copilot and a Bearer API token for other clients (https://developers.smartsheet.com/ai-mcp/smartsheet/install-the-smartsheet-mcp-server.md)", "The MCP tools reference documents 83 tools in 17 groups, from sheets, rows and columns to workflows, dashboards, portfolios and scenario planning, each with its OAuth scope (https://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server-tools.md)", "Toolsets load tools on demand. The client calls `search_tools` with a toolset and an optional read or write filter, then runs a tool through that toolset's read or write executor (https://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server-toolsets.md)", "The API is limited to Business, Enterprise and Advanced Work Management plans, and the pricing table marks API calls as absent on Pro (https://www.smartsheet.com/pricing)", "Rate limit of 300 requests a minute per token, 30 for file attachments and cell history, with error 4003 on HTTP 429 (https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/scalability-options.md)", "The status page published post-incident reports for outages on 30 July, 11 August, 26 to 28 August and 11 September 2026 (https://status.smartsheet.com/history)", "The older stdio server smartsheet-platform/smar-mcp was marked deprecated on 1 April 2026 and points to the hosted server (https://github.com/smartsheet-platform/smar-mcp)" ], "area": "business", "details": [ { "label": "API", "value": "REST, version 2.0, OpenAPI 3.0.3 with 187 operations and 472 schemas. Hosts api.smartsheet.com, api.smartsheet.eu, api.smartsheet.au and api.smartsheetgov.com" }, { "label": "MCP server", "value": "Hosted, streamable HTTP at https://mcp.smartsheet.com (also .eu and .au). 83 documented tools, loaded by toolset through `search_tools` and read or write executors. Launched with the Claude integration on 2 March 2026" }, { "label": "Plan needed", "value": "Business, Enterprise or Advanced Work Management for the API and the MCP server. Portfolio and scenario planning tools need Enterprise or above" }, { "label": "Credentials", "value": "OAuth 2.0 authorisation code grant with 17 scopes, access tokens lasting about 7 days and refresh tokens, or a raw API token made in Personal Settings that carries all of the user's access" }, { "label": "Rate limits", "value": "300 requests a minute per token. 30 a minute for file attachments and cell history, which count ten times" }, { "label": "Batch limits", "value": "500 rows per add or update call, 500,000 cells a sheet, 4,000 characters a cell, 10,000 report rows a request" }, { "label": "Formulas", "value": "Read on every Cell object and written with Update Rows. Filters can be read but not created or changed through the API" }, { "label": "Change events", "value": "Webhooks on sheets with event filtering and custom headers, signed with HMAC SHA-256 in the Smartsheet-Hmac-SHA256 header. An Event Reporting API for account activity" }, { "label": "SDKs", "value": "Python 4.4.0, JavaScript 5.3.0, Java 4.4.0 and C# 7.4.0, all released 12 August 2026, with retry and backoff built in" }, { "label": "SLA", "value": "99.9 per cent monthly availability of the Core Application, Enterprise plans only, with fee credits of 10 to 50 per cent" }, { "label": "Certifications", "value": "SOC 2, ISO 27001, ISO 27701 and FedRAMP per smartsheet.com/trust. A bug bounty with a report form at smartsheet.com/legal/bugbounty" }, { "label": "Data", "value": "Customer content deleted within 180 days of termination per the User Agreement. Sub-processor list with locations and a revision history. US, EU and Australian regions" } ], "unitPrices": [ { "item": "Business plan (lowest plan with API and MCP access)", "unit": "seat-month", "usd": 19, "note": "billed yearly, $24 monthly, 3 members minimum" }, { "item": "Pro plan (no API calls)", "unit": "seat-month", "usd": 9, "note": "billed yearly, $12 monthly, up to 10 members" } ], "provenance": { "legalEntity": "Smartsheet Inc.", "domain": "smartsheet.com", "domainRegistered": "2001-04-15", "endpointOnVendorDomain": true, "terms": "https://www.smartsheet.com/legal/developer-program-agreement", "privacy": "https://www.smartsheet.com/legal/privacy", "statusPage": "https://status.smartsheet.com", "changelog": "https://developers.smartsheet.com/api/smartsheet/changelog", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The User Agreement (last updated 3 April 2026) and the privacy notice (20 May 2026) give Smartsheet Inc., 500 108th Ave NE, Suite 200, Bellevue, WA 98004.", "The Developer Agreement governing the API and SDKs was last updated 1 July 2021. Revisions take effect 15 days after posting.", "www.smartsheet.com/.well-known/security.txt names security@smartsheet.com and the bug bounty page, with Expires 2026-07-01, three months before this check.", "The API answers at api.smartsheet.com and the MCP server at mcp.smartsheet.com, with regional hosts on smartsheet.eu and smartsheet.au.", "RDAP for smartsheet.com gives a registration date of 2001-04-15." ], "score": 92, "checks": [ { "check": "Legal entity named", "value": "Smartsheet Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "smartsheet.com, registered 2001-04-15 (25 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.smartsheet.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.smartsheet.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "published but past its Expires date", "points": 5, "max": 10, "state": "part" } ], "policies": [ { "kind": "terms", "url": "https://www.smartsheet.com/legal/developer-program-agreement", "state": "read", "readAt": "2026-10-08", "statedDate": "2021-07-01", "words": 3929, "points": 8, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: July 1, 2021", "says": "Last updated 2021-07-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement is governed by the laws of the State of Washington, without regard to its conflicts of law rules, and each party hereby consents to exclusive jurisdiction and venue in the state and federal courts located in Seattle, Washington for any dispute arising out of this Agreement.", "says": "The law of the State of Washington, with disputes in the courts of Seattle, Washington" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…assigns and agents from and against any claim, action, proceeding or cause of action, including but not limited to those brought by End Users, and all resulting loss, damages, settlement, penalty, cost, expense or liability (including but not limited to reasonable attorney fees and expenses), arising out of or related…" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Smartsheet may suspend or revoke Developer’s access to the Smartsheet Properties at any time if Smartsheet reasonably believes, in its sole discretion, that the Developer Application violates this Agreement or is harmful to Smartsheet, End Users, or the Program or is using the Smartsheet Properties in violation of the…" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Smartsheet reserves the right to modify this Agreement by posting a revised version on the Smartsheet website.", "says": "Changes are posted, with no other notice named" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "…Properties is subject to the applicable restrictions in its Subscription Agreement, Smartsheet’s Acceptable Use Policy and Limits Policy (collectively, the \"Policies\", each as available at www.smartsheet.com/legal), and any other agreement between the Parties, including any applicable addendums to this Agreement." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Service Level Agreement" } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "DEVELOPER SHALL NOT ACCESS OR USE THE DEVELOPER TOOLS WITHOUT PRIOR WRITTEN CONSENT OF SMARTSHEET IF DEVELOPER IS OR BECOMES A DIRECT COMPETITOR TO SMARTSHEET OR ITS AFFILIATES.", "costsPoints": true }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last Updated: July 1, 2021" } ], "notes": [ { "date": "2026-10-08", "text": "Smartsheet's entire liability under the developer agreement is capped at 100 US dollars.", "quote": "SMARTSHEET’S ENTIRE LIABILITY UNDER THIS AGREEMENT WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS ($100)." }, { "date": "2026-10-08", "text": "A developer application may be made available to end users only after Smartsheet reviews it and gives written approval.", "quote": "only after Smartsheet reviews and provides its written approval of the Developer Application, to make the Developer Application available to End Users." }, { "date": "2026-10-08", "text": "Smartsheet may audit a developer application for compliance, and the developer agrees to cooperate and supply requested information.", "quote": "Smartsheet reserves the right to audit the Developer Application to ensure compliance with this Agreement and Developer agrees to cooperate with any such audit and provide information as requested by Smartsheet." } ] }, { "kind": "privacy", "url": "https://www.smartsheet.com/legal/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-05-20", "words": 3264, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: May 20, 2026", "says": "Last updated 2026-05-20" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The Smartsheet Privacy Notice (“Privacy Notice”) consists of this page and the specific notices which describe how we collect, use, and share personal data and explain your related rights and choices." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We keep your personal data for as long as reasonably necessary for the purposes set out in our notices (see \"How We Use Personal Data\" in the applicable notice) or, if applicable, in accordance with the relevant terms in an agreement between you and Smartsheet.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Personal data we collect will be transferred to, used, and stored in the United States or other jurisdictions in which Smartsheet, our affiliates, or service providers are located;" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You have certain rights relating to your personal data under applicable data protection laws (e.g., the General Data Protection Regulation, the California Consumer Privacy Act, etc.) or based on your use of our Services." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "You may contact us using this form or by reaching out to our Data Protection Officer (\"DPO\") at:", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "or (ii) the transfer is made pursuant to appropriate safeguards, such as the applicable standard contractual clauses.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "To opt out of the sharing of your personal data for all of our advertising and marketing activities, please complete this form." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/smartsheet.json", "live": { "slug": "smartsheet", "probe": { "target": "https://api.smartsheet.com/2.0", "method": "get", "lastAt": "2026-10-08T19:08:58.685508125Z", "lastOk": true, "lastStatus": 404, "lastMs": 407, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 410, "p95ms24h": 442, "samples24h": 42, "samples30d": 42, "days": [ { "date": "2026-10-08", "probes": 42, "ok": 42 } ] }, "vendorStatus": { "page": "https://status.smartsheet.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:06:59.318094261Z" }, "versions": [ { "registry": "github", "name": "smartsheet/smartsheet-python-sdk", "version": "v4.4.0", "released": "2026-08-12", "seenAt": "2026-10-08T16:29:43.071236352Z" }, { "registry": "npm", "name": "smartsheet", "version": "5.3.0", "seenAt": "2026-10-08T16:29:42.658666425Z" }, { "registry": "pypi", "name": "smartsheet-python-sdk", "version": "4.4.0", "released": "2026-08-12", "seenAt": "2026-10-08T16:29:42.474478981Z" } ], "githubStars": 82, "npmWeekly": 47484, "pypiWeekly": 311787, "securityTxt": { "url": "https://smartsheet.com/.well-known/security.txt", "state": "expired", "expires": "2026-07-01T04:00:00.000Z", "checkedAt": "2026-10-08T15:38:51.088332618Z" }, "pages": [ { "url": "https://developers.smartsheet.com/api/smartsheet/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:18:00.810328989Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "295f068fdad5" }, { "url": "https://www.smartsheet.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:30:35.945478338Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "15466e0b403d" }, { "url": "https://www.smartsheet.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:30:35.349940575Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b189b00ce573" }, { "url": "https://www.smartsheet.com/legal/developer-program-agreement", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:30:31.7907332Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ae127c8430bb" } ], "updatedAt": "2026-10-08T19:08:58.685508125Z" } }, "verify": { "accepts": "a page on smartsheet.com or one of its subdomains, or the README of github.com/smartsheet/smartsheet-python-sdk", "badgeUrl": "https://www.anchorterminal.com/badges/smartsheet.svg", "body": { "slug": "smartsheet", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/smartsheet", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/smartsheet\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/smartsheet.svg\" alt=\"Smartsheet API + MCP on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Smartsheet API + MCP on Anchor Terminal](https://www.anchorterminal.com/badges/smartsheet.svg)](https://www.anchorterminal.com/tools/smartsheet)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/smartsheet\"\u003eSmartsheet API + MCP on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/smartsheet", "json": "https://www.anchorterminal.com/tools/smartsheet.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/smartsheet.md", "slim": "https://www.anchorterminal.com/tools/smartsheet.min.md" }, "markdown": "## Overview\n\n**Grade B · 67.6/100 · rank #190 of 629 · #4 in Spreadsheets \u0026 operational tables · not agent-ready · confidence medium**\n\n\n## Assessment\n\nThe REST API has a public OpenAPI 3.0.3 spec with 187 operations, Markdown docs and llms.txt, and the hosted MCP server loads its 83 documented tools by toolset. API access needs a Business plan or higher, and the status page lists eight incidents marked major or critical between 15 July and 21 September 2026.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Smartsheet Inc. (https://www.smartsheet.com) |\n| Kind | HTTP API |\n| Category | Spreadsheets \u0026 operational tables (https://www.anchorterminal.com/categories/spreadsheets) |\n| Transport | HTTP, Streamable HTTP |\n| Endpoint | `https://api.smartsheet.com/2.0` |\n| Auth | OAuth or key · Access needs a licensed user on a Business plan or higher. A user makes a raw API token in Personal Settings and sends it as a Bearer token. It has no scopes and carries all of that user's access. Apps acting for other users register in Developer Tools (Smartsheet approves the registration request) and use the OAuth 2.0 authorisation code grant with any of 17 scopes such as READ_SHEETS and WRITE_SHEETS. Access tokens last about 7 days and refresh. Scopes can't exceed the user's sharing level on a sheet. The MCP server takes OAuth from ChatGPT, Claude, Gemini Enterprise Plus and Microsoft 365 Copilot, and a Bearer API token from other clients. A System Admin's token can act as any user through the `Assume-User` header. |\n| Pricing | Paid ($19 / seat-mo) · API and MCP access start at the Business plan, $24 a member a month billed monthly or $19 billed yearly, with a minimum of three members. Pro ($12, or $9 yearly) has no API calls. Enterprise and Advanced Work Management are priced through sales. API calls carry no separate charge. A 30-day trial needs no card, but we couldn't confirm that a trial account can make API tokens. No developer sandbox was found in the reviewed documentation (https://www.smartsheet.com/pricing, checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the developer docs, the OpenAPI spec or the pricing page (checked 2026-10-08). |\n| Licence | Proprietary service under Smartsheet's User Agreement and Developer Agreement. The SDKs on GitHub are Apache-2.0 |\n| Tools exposed | 83 |\n| Packages | pypi: `smartsheet-python-sdk`; npm: `smartsheet` |\n| Source | https://github.com/smartsheet/smartsheet-python-sdk |\n| Docs | https://developers.smartsheet.com |\n| llms.txt | https://developers.smartsheet.com/llms.txt |\n| Last release | 2026-10-06 |\n| GitHub stars | 82 (as of 2026-10-08) |\n| npm downloads / week | 47,484 |\n| PyPI downloads / week | 311,787 |\n| API | REST, version 2.0, OpenAPI 3.0.3 with 187 operations and 472 schemas. Hosts api.smartsheet.com, api.smartsheet.eu, api.smartsheet.au and api.smartsheetgov.com |\n| MCP server | Hosted, streamable HTTP at https://mcp.smartsheet.com (also .eu and .au). 83 documented tools, loaded by toolset through `search_tools` and read or write executors. Launched with the Claude integration on 2 March 2026 |\n| Plan needed | Business, Enterprise or Advanced Work Management for the API and the MCP server. Portfolio and scenario planning tools need Enterprise or above |\n| Credentials | OAuth 2.0 authorisation code grant with 17 scopes, access tokens lasting about 7 days and refresh tokens, or a raw API token made in Personal Settings that carries all of the user's access |\n| Rate limits | 300 requests a minute per token. 30 a minute for file attachments and cell history, which count ten times |\n| Batch limits | 500 rows per add or update call, 500,000 cells a sheet, 4,000 characters a cell, 10,000 report rows a request |\n| Formulas | Read on every Cell object and written with Update Rows. Filters can be read but not created or changed through the API |\n| Change events | Webhooks on sheets with event filtering and custom headers, signed with HMAC SHA-256 in the Smartsheet-Hmac-SHA256 header. An Event Reporting API for account activity |\n| SDKs | Python 4.4.0, JavaScript 5.3.0, Java 4.4.0 and C# 7.4.0, all released 12 August 2026, with retry and backoff built in |\n| SLA | 99.9 per cent monthly availability of the Core Application, Enterprise plans only, with fee credits of 10 to 50 per cent |\n| Certifications | SOC 2, ISO 27001, ISO 27701 and FedRAMP per smartsheet.com/trust. A bug bounty with a report form at smartsheet.com/legal/bugbounty |\n| Data | Customer content deleted within 180 days of termination per the User Agreement. Sub-processor list with locations and a revision history. US, EU and Australian regions |\n| Capabilities | sheets.read, sheets.write, sheets.records, sheets.formulas, automation.workflows |\n| Tags | official, hosted, closed-source, mcp, oauth, openapi, llms-txt, webhooks, python, typescript, java, csharp, status-page, soc2, sla |\n| JSON | https://www.anchorterminal.com/api/v1/tools/smartsheet.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 65 | 13.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 88 | 14.3 |\n| Agent ergonomics | 13% | 16.2 | 74 | 12.0 |\n| Security \u0026 auth | 14% | 17.5 | 66 | 11.6 |\n| Payments \u0026 pricing | 10% | 12.5 | 20 | 2.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 80 | 7.0 |\n| Transparency \u0026 trust (editorial 72, provenance 92) | 7% | 8.8 | 82 | 7.2 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **67.6 → B** |\n\n### Why each score\n\n- Reliability 65: Graded on the hosted API and MCP server. Statuspage at status.smartsheet.com with components for the REST API, Webhooks, Sheets and API Access Tokens (20). Ten incidents since 15 July 2026, eight marked major or critical. Post-incident reports put API timeouts at about five hours on 30 July, sheet and report failures on 11 August and 26 to 28 August, and a 51-minute US outage on 11 September (0). 300 requests a minute per token, 30 for attachments and cell history (15). Error 4003 on 429 with advice to wait 60 seconds or back off, and SDK retries, but no Retry-After header or idempotency keys documented (10). A 99.9 per cent SLA for Enterprise plans (10). GA, with no beta label on the API or the MCP server (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 88: OpenAPI 3.0.3 spec with 187 operations, downloadable without login. The MCP docs describe the server as self-describing, which we couldn't confirm without an account (25). llms.txt and a Markdown copy of each docs page (10). The MCP reference gives each tool best practices, limitations and use cases, such as calling `get_columns` before filtering. We read the reference, not the live tool definitions (16). 472 schemas and 668 enums in the spec, though toolset executors take a tool name and a free-form arguments object (11). Code samples on 180 of 187 operations and a numbered error code page (14). Dated changelogs for the API and the MCP server. The API stays at 2.0 and changes arrive within that version (12).\n- Agent ergonomics 74: The MCP reference lists 83 tools, which scores 5, plus 10 for toolsets with `search_tools` and a read or write filter. The API narrows a sheet read with columnIds, rowIds, rowsModifiedSince, include and exclude (15). Token and offset pagination, with unbounded includeAll results removed on 15 June 2026, and filters, sorting and column selection on `get_sheet_summary` (18). Numbered error codes with messages, and per-item failures on bulk writes (17). No idempotency keys. Partial success on bulk writes, a version check on sheet reads and separate read and write executors in MCP help. MCP annotations couldn't be read (9). Four official SDKs with retries built in, and few required parameters (15).\n- Security \u0026 auth 66: OAuth 2.0 authorisation code grant with 17 scopes and tokens that expire in about 7 days. No PKCE or dynamic client registration appears in the docs or the server's OAuth metadata, and the raw API token most coding clients use has no scopes (22). READ_SHEETS gives a read-only grant and sharing levels cap what a token can touch. The MCP docs flag destructive tools and ask the agent to confirm, with no enforced approval step (12). Cells, comments and attachments are written by other people and no injection guidance was found (3). Activity log on Business and above, an Event Reporting API with over 100 event types, and a `smartsheet-integration-source` header that labels AI traffic (12). SOC 2, ISO 27001, ISO 27701, FedRAMP and a bug bounty form. security.txt expired on 1 July 2026 (17).\n- Payments \u0026 pricing 20: No x402, MPP or L402 found in the docs, the OpenAPI spec or the pricing page (0). Plan prices are public for Pro and Business, per member per month, with Enterprise through sales and no per-call price (10). A 30-day trial with no card is advertised. We scored it at half because the API needs a Business plan and we couldn't confirm that trial accounts can make tokens, and there's no free tier afterwards (10). A person signs up in a browser and creates the token or approves OAuth (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 80: API changelog entries on 2 and 6 October 2026 and MCP changelog entries on 2 October (30). Nine API and ten MCP changelog entries since 10 July 2026 (20). Closed service with dated changelogs, a developer community and a Stack Overflow tag. We didn't measure response times (10). SDKs for Python, JavaScript, Java and C# all released on 12 August 2026. The hosted MCP server isn't in the official MCP registry, where the only Smartsheet entry is a third-party Resource Management server (12). SDK repositories have CI workflows and commits in September and October 2026 (8).\n- Transparency \u0026 trust 82: Closed service with a public User Agreement (3 April 2026) and Developer Agreement (1 July 2021). SDKs are Apache-2.0 (17). Privacy notice of 20 May 2026, a DPA built into the User Agreement, deletion of customer content within 180 days of termination, and a statement that customer data isn't used to train third-party foundation models. Personal data retention has no stated periods (22). A written deprecation process with DEPRECATION and SUNSET changelog entries, such as the `home` destination type ending on or after 30 October 2026, announced 22 September. No minimum notice period is promised (15). Sub-processor list with purposes, locations and a revision history, and US, EU and Australian regions (18).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (16 items): https://www.anchorterminal.com/fixes/smartsheet.md (JSON https://www.anchorterminal.com/fixes/smartsheet.json)\n\n### What we couldn't check\n\n- unchecked: the live MCP tool definitions, their JSON Schemas and any readOnlyHint or destructiveHint annotations. The server returns 401 without a token, so the tool count and descriptions come from the docs reference\n- unchecked: whether a 30-day trial account can create API tokens or connect to the MCP server\n- unchecked: the bug bounty's scope and rewards. The page is an embedded report form\n- Whether raw API tokens expire or can be limited by an admin. Not found in the reviewed documentation\n- Whether 429 responses carry a Retry-After header. The docs and the spec don't mention one\n- How quickly Smartsheet staff answer in the developer community. Not measured\n\n### Sources\n\n- Developer docs index (llms.txt): \u003chttps://developers.smartsheet.com/llms.txt\u003e (seen 2026-10-08)\n- OpenAPI spec: \u003chttps://developers.smartsheet.com/_bundle/api/smartsheet/openapi.yaml\u003e (seen 2026-10-08)\n- MCP server introduction and plan requirement: \u003chttps://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server.md\u003e (seen 2026-10-08)\n- MCP tools reference: \u003chttps://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server-tools.md\u003e (seen 2026-10-08)\n- MCP toolsets: \u003chttps://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server-toolsets.md\u003e (seen 2026-10-08)\n- MCP install guide and region URLs: \u003chttps://developers.smartsheet.com/ai-mcp/smartsheet/install-the-smartsheet-mcp-server.md\u003e (seen 2026-10-08)\n- MCP changelog: \u003chttps://developers.smartsheet.com/ai-mcp/smartsheet/changelog.md\u003e (seen 2026-10-08)\n- MCP OAuth metadata: \u003chttps://mcp.smartsheet.com/.well-known/oauth-authorization-server\u003e (seen 2026-10-08)\n- API changelog: \u003chttps://developers.smartsheet.com/api/smartsheet/changelog.md\u003e (seen 2026-10-08)\n- Rate limits and bulk operations: \u003chttps://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/scalability-options.md\u003e (seen 2026-10-08)\n- Authentication guide: \u003chttps://developers.smartsheet.com/api/smartsheet/guides/basics/authentication.md\u003e (seen 2026-10-08)\n- OAuth guide and scopes: \u003chttps://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/oauth.md\u003e (seen 2026-10-08)\n- API limitations: \u003chttps://developers.smartsheet.com/api/smartsheet/guides/limitations.md\u003e (seen 2026-10-08)\n- Deprecation process: \u003chttps://developers.smartsheet.com/api/smartsheet/guides/deprecation-process.md\u003e (seen 2026-10-08)\n- Error codes: \u003chttps://developers.smartsheet.com/api/smartsheet/error-codes.md\u003e (seen 2026-10-08)\n- Status incidents: \u003chttps://status.smartsheet.com/api/v2/incidents.json\u003e (seen 2026-10-08)\n- Pricing and plan comparison: \u003chttps://www.smartsheet.com/pricing\u003e (seen 2026-10-08)\n- Service Level Agreement: \u003chttps://www.smartsheet.com/legal/sla\u003e (seen 2026-10-08)\n- Trust page: \u003chttps://www.smartsheet.com/trust\u003e (seen 2026-10-08)\n- security.txt: \u003chttps://www.smartsheet.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- Bug bounty page: \u003chttps://www.smartsheet.com/legal/bugbounty\u003e (seen 2026-10-08)\n- User Agreement: \u003chttps://www.smartsheet.com/legal/user-agreement\u003e (seen 2026-10-08)\n- Developer Agreement: \u003chttps://www.smartsheet.com/legal/developer-program-agreement\u003e (seen 2026-10-08)\n- Privacy notice: \u003chttps://www.smartsheet.com/legal/privacy\u003e (seen 2026-10-08)\n- Sub-processors: \u003chttps://www.smartsheet.com/legal/subprocessors\u003e (seen 2026-10-08)\n- Python SDK repository and tags: \u003chttps://github.com/smartsheet/smartsheet-python-sdk\u003e (seen 2026-10-08)\n- Deprecated stdio MCP server: \u003chttps://github.com/smartsheet-platform/smar-mcp\u003e (seen 2026-10-08)\n- Official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0.1/servers?search=smartsheet\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 92/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Smartsheet Inc. | 20/20 |\n| Domain age | smartsheet.com, registered 2001-04-15 (25 years) | 15/15 |\n| Endpoint on the vendor's domain | api.smartsheet.com | 15/15 |\n| Terms of service | read, states 7 of the 7 things a reader expects, and has 1 clause that costs points | 8/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | status.smartsheet.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | published but past its Expires date | 5/10 |\n\nThe User Agreement (last updated 3 April 2026) and the privacy notice (20 May 2026) give Smartsheet Inc., 500 108th Ave NE, Suite 200, Bellevue, WA 98004.\n\nThe Developer Agreement governing the API and SDKs was last updated 1 July 2021. Revisions take effect 15 days after posting.\n\nwww.smartsheet.com/.well-known/security.txt names security@smartsheet.com and the bug bounty page, with Expires 2026-07-01, three months before this check.\n\nThe API answers at api.smartsheet.com and the MCP server at mcp.smartsheet.com, with regional hosts on smartsheet.eu and smartsheet.au.\n\nRDAP for smartsheet.com gives a registration date of 2001-04-15.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.smartsheet.com/legal/developer-program-agreement), read 2026-10-08, dated 2021-07-01, states 7 of the 7 things a reader expects.\n\n- To know. Restricts benchmarking or competitive use (costs points). \"DEVELOPER SHALL NOT ACCESS OR USE THE DEVELOPER TOOLS WITHOUT PRIOR WRITTEN CONSENT OF SMARTSHEET IF DEVELOPER IS OR BECOMES A DIRECT COMPETITOR TO SMARTSHEET OR ITS AFFILIATES.\"\n- To know. Has not been updated for three years or more. \"Last Updated: July 1, 2021\"\n- Gives the date it was last updated. Last updated 2021-07-01.\n- Names the governing law or courts. The law of the State of Washington, with disputes in the courts of Seattle, Washington.\n- Says how changes to the terms are announced. Changes are posted, with no other notice named.\n- Also in the text (2026-10-08). Smartsheet's entire liability under the developer agreement is capped at 100 US dollars. \"SMARTSHEET’S ENTIRE LIABILITY UNDER THIS AGREEMENT WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS ($100).\"\n- Also in the text (2026-10-08). A developer application may be made available to end users only after Smartsheet reviews it and gives written approval. \"only after Smartsheet reviews and provides its written approval of the Developer Application, to make the Developer Application available to End Users.\"\n- Also in the text (2026-10-08). Smartsheet may audit a developer application for compliance, and the developer agrees to cooperate and supply requested information. \"Smartsheet reserves the right to audit the Developer Application to ensure compliance with this Agreement and Developer agrees to cooperate with any such audit and provide information as requested by Smartsheet.\"\n\n**Privacy policy** (https://www.smartsheet.com/legal/privacy), read 2026-10-08, dated 2026-05-20, states 7 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"To opt out of the sharing of your personal data for all of our advertising and marketing activities, please complete this form.\"\n- Gives the date it was last updated. Last updated 2026-05-20.\n- Says how long data is kept. For as long as needed, with no period named.\n- Not found in the text. Says whether personal data is sold or shared for advertising.\n- Gives a privacy contact. Names a data protection officer.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n\n## Live (updated 2026-10-08 19:08 UTC)\n\n- Right now: up, HTTP 404, 407 ms, checked 2026-10-08 19:08 UTC (get on `https://api.smartsheet.com/2.0`)\n- Uptime 24h 100.0% (42 probes) · 30 days 100.0% (42 probes) · p50 410 ms · p95 442 ms\n- Vendor status page: none, All Systems Operational\n- github `smartsheet/smartsheet-python-sdk` v4.4.0, released 2026-08-12\n- npm `smartsheet` 5.3.0\n- pypi `smartsheet-python-sdk` 4.4.0, released 2026-08-12\n- security.txt: expired, expires 2026-07-01T04:00:00.000Z\n- Watching changelog \u003chttps://developers.smartsheet.com/api/smartsheet/changelog\u003e\n- Watching pricing \u003chttps://www.smartsheet.com/pricing\u003e\n- Watching privacy \u003chttps://www.smartsheet.com/legal/privacy\u003e\n- Watching terms \u003chttps://www.smartsheet.com/legal/developer-program-agreement\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/smartsheet.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Business plan (lowest plan with API and MCP access) | $19 | per seat per month | billed yearly, $24 monthly, 3 members minimum |\n| Pro plan (no API calls) | $9 | per seat per month | billed yearly, $12 monthly, up to 10 members |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Public OpenAPI 3.0.3 spec with 187 operations, code samples on 180 of them, plus llms.txt and a Markdown copy of every docs page\n- Hosted MCP server in three regions (US, EU, Australia) with toolsets, so a client loads tools by domain through `search_tools`\n- OAuth 2.0 with 17 scopes, including READ_SHEETS for a read-only grant, and sheet sharing levels that scopes can't override\n- Bulk row writes of up to 500 rows a call with optional partial success and per-row failure details\n- Dated API changelog (latest 6 October 2026) with DEPRECATION and SUNSET entries and migration guides\n\n## Weaknesses\n\n- API and MCP access need a Business plan or higher, from $19 a member a month billed yearly with a three-member minimum\n- Eight status incidents marked major or critical between 15 July and 21 September 2026, four of them stopping sheets from loading in the US region\n- A raw API token carries all of its user's access with no scopes, and it's the credential the docs give for Claude Code, Cursor, Codex and Gemini CLI\n- No idempotency keys, and 429 responses carry no documented Retry-After header\n- security.txt expired on 1 July 2026, and no prompt-injection guidance was found in the MCP docs\n\n## Before you call it (notes for agents)\n\n1. Send writes to one sheet one at a time. Parallel updates with the same token return error 4004\n2. Batch row changes, up to 500 rows a call, and add `allowPartialSuccess=true` to get per-row failures instead of a failed batch\n3. On error 4003 (HTTP 429) wait at least 60 seconds before retrying. The limit is 300 requests a minute per token, 30 for attachments and cell history\n4. Through MCP, call `get_columns` before filtering or writing. Column names are case-sensitive and guesses fail validation\n5. Use the regional host that matches the account (api.smartsheet.com, .eu or .au). Tokens don't work across regions\n\n## Connect\n\nInstall:\n\n```bash\npip install smartsheet-python-sdk\n```\n\nFirst request:\n\n```bash\ncurl \"https://api.smartsheet.com/2.0/workspaces?maxItems=100\" \\\n -H \"Authorization: Bearer $SMARTSHEET_API_TOKEN\"\n```\n\nClaude Code:\n\n```bash\nclaude mcp add --transport http smartsheet-mcp https://mcp.smartsheet.com -H \"Authorization:Bearer ${SMARTSHEET_API_TOKEN}\"\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"smartsheet-mcp\": {\n \"headers\": {\n \"Authorization\": \"Bearer ${SMARTSHEET_API_TOKEN}\"\n },\n \"httpUrl\": \"https://mcp.smartsheet.com\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/smartsheet. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| NocoDB | BB | 75.7 | 37 | sheets.records, sheets.read, sheets.write, sheets.formulas | no | https://www.anchorterminal.com/tools/nocodb.md |\n| Airtable | BB | 70.9 | 118 | sheets.records, sheets.read, sheets.write, sheets.formulas | no | https://www.anchorterminal.com/tools/airtable.md |\n| Coda (Superhuman Docs) | B | 64.8 | 247 | sheets.read, sheets.write, sheets.records, sheets.formulas | no | https://www.anchorterminal.com/tools/coda.md |\n| Baserow | B | 63.6 | 276 | sheets.records, sheets.read, sheets.write, sheets.formulas | no | https://www.anchorterminal.com/tools/baserow.md |\n| Google Sheets API | BB | 76.3 | 33 | sheets.read, sheets.write, sheets.formulas | no | https://www.anchorterminal.com/tools/google-sheets-api.md |\n| Microsoft Excel (Microsoft Graph workbook API) | C | 58.5 | 399 | sheets.read, sheets.write, sheets.formulas | no | https://www.anchorterminal.com/tools/microsoft-excel-graph.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The hosted MCP server answers at https://mcp.smartsheet.com, https://mcp.smartsheet.eu and https://mcp.smartsheet.au, with OAuth for ChatGPT, Claude, Gemini Enterprise Plus and Microsoft 365 Copilot and a Bearer API token for other clients (source: \u003chttps://developers.smartsheet.com/ai-mcp/smartsheet/install-the-smartsheet-mcp-server.md\u003e)\n- The MCP tools reference documents 83 tools in 17 groups, from sheets, rows and columns to workflows, dashboards, portfolios and scenario planning, each with its OAuth scope (source: \u003chttps://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server-tools.md\u003e)\n- Toolsets load tools on demand. The client calls `search_tools` with a toolset and an optional read or write filter, then runs a tool through that toolset's read or write executor (source: \u003chttps://developers.smartsheet.com/ai-mcp/smartsheet/mcp-server-toolsets.md\u003e)\n- The API is limited to Business, Enterprise and Advanced Work Management plans, and the pricing table marks API calls as absent on Pro (source: \u003chttps://www.smartsheet.com/pricing\u003e)\n- Rate limit of 300 requests a minute per token, 30 for file attachments and cell history, with error 4003 on HTTP 429 (source: \u003chttps://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/scalability-options.md\u003e)\n- The status page published post-incident reports for outages on 30 July, 11 August, 26 to 28 August and 11 September 2026 (source: \u003chttps://status.smartsheet.com/history\u003e)\n- The older stdio server smartsheet-platform/smar-mcp was marked deprecated on 1 April 2026 and points to the hosted server (source: \u003chttps://github.com/smartsheet-platform/smar-mcp\u003e)\n\n## Compare\n\n- [Coda (Superhuman Docs) vs Smartsheet API + MCP](https://www.anchorterminal.com/compare/coda-vs-smartsheet.md): B 64.8 vs B 67.6\n- [Google Sheets API vs Smartsheet API + MCP](https://www.anchorterminal.com/compare/google-sheets-api-vs-smartsheet.md): BB 76.3 vs B 67.6\n- [Microsoft Excel (Microsoft Graph workbook API) vs Smartsheet API + MCP](https://www.anchorterminal.com/compare/microsoft-excel-graph-vs-smartsheet.md): C 58.5 vs B 67.6\n- [Airtable vs Smartsheet API + MCP](https://www.anchorterminal.com/compare/airtable-vs-smartsheet.md): BB 70.9 vs B 67.6\n- [Baserow vs Smartsheet API + MCP](https://www.anchorterminal.com/compare/baserow-vs-smartsheet.md): B 63.6 vs B 67.6\n- [NocoDB vs Smartsheet API + MCP](https://www.anchorterminal.com/compare/nocodb-vs-smartsheet.md): BB 75.7 vs B 67.6\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on smartsheet.com or one of its subdomains, or the README of github.com/smartsheet/smartsheet-python-sdk. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"smartsheet\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/smartsheet\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/smartsheet.svg\" alt=\"Smartsheet API + MCP on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Smartsheet API + MCP on Anchor Terminal](https://www.anchorterminal.com/badges/smartsheet.svg)](https://www.anchorterminal.com/tools/smartsheet)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/smartsheet\"\u003eSmartsheet API + MCP on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Smartsheet API + MCP is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/smartsheet-dark.png\n- Light: https://www.anchorterminal.com/assets/share/smartsheet-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Spreadsheets \u0026 operational tables", "url": "https://www.anchorterminal.com/categories/spreadsheets" }, { "name": "Smartsheet API + MCP", "url": "" } ], "description": "Smartsheet is a hosted work management product built on sheets with typed columns, rows, formulas, reports and dashboards. Agents reach it through a REST API (187 operations) and a hosted MCP server, both limited to Business plans and above.", "facts": [ "rank #190 of 629", "OAuth or key auth", "0 desk reviews" ], "h1": "Smartsheet API + MCP", "image": "https://www.anchorterminal.com/assets/og/tools-smartsheet.png", "path": "/tools/smartsheet", "published": "2026-10-01", "section": "tools", "title": "Smartsheet API + MCP review for AI agents, grade B (67.6/100)", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/smartsheet" }, "tokens": { "markdown": 7450, "slim": 1730 }, "version": 1 }