How to Connect Smartsheet to Microsoft Copilot via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Smartsheet, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Smartsheet + Microsoft Copilot

Smartsheet API 2.0 with a personal access token (US, EU, AU or Gov): search and read sheets, rows, columns, sheet summaries and cell history, comments and attachments, workspaces, folders, reports and dashboards, users and shares; add and update rows and columns, comment, create sheets, share and send update requests. Deleting rows installs switched off.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

SMARTSHEET_API_URL, SMARTSHEET_ACCESS_TOKEN

Step 1 — Get credentials

Setting up takes about 2 minutes. You need a Smartsheet plan with API access (Pro, Business, Enterprise or Advanced Work Management).

1. Sign in to Smartsheet, click your account icon at the bottom left and open Apps & Integrations (or Personal Settings), then API Access.
2. Click Generate new access token, give it a name such as AnythingMCP and copy the token. It is shown only once.
3. Paste it into SMARTSHEET_ACCESS_TOKEN, without the word Bearer.
4. Set SMARTSHEET_API_URL to the host of your account's region: https://api.smartsheet.com/2.0 for app.smartsheet.com (US), https://api.smartsheet.eu/2.0 for app.smartsheet.eu, https://api.smartsheet.au/2.0 for app.smartsheet.au or https://api.smartsheetgov.com/2.0 for Smartsheet Gov. A token only works on the host of its own region; anywhere else Smartsheet answers 401 "invalid access token".
5. Install the connector and run smartsheet_get_current_user: it shows whose token it is and confirms it.

Whose access: every call runs as the user who owns the token, with that user's access to each sheet, and the token can do whatever its user can do in Smartsheet. When that matters, generate the token as a dedicated user who only has access to the sheets the AI should see.

What it reads: a search across everything the user can open (names of sheets, reports, dashboards, folders, workspaces and templates, cell data, comments, attachments and summary fields), narrowed with scopes such as sheetNames; sheets with their columns (type, dropdown options, primary flag) and rows, each with row number, parent row for the hierarchy and cells as value and displayValue; a single row; a text search inside one sheet; sheet summary fields; the change history of a cell with who changed it and when; comment threads on sheets and rows; attachments, with a download link valid for about 2 minutes; workspaces and folders with what they contain; reports with rows gathered from several sheets, cells keyed by virtualColumnId; dashboards (called sights in the API) with their widgets; the users of the organisation account (system admins see everyone, other users a limited view) and who an item is shared with.

Big sheets: the AI first lists the columns for their ids and types, then reads a page of rows or only some rows with row_numbers, row_ids, column_ids or rows_modified_since.

What it writes: smartsheet_add_rows and smartsheet_update_rows (only the given cells change; a location field moves a row), smartsheet_add_columns and smartsheet_update_column (changing a column's type can convert or drop cell values), new comment threads on sheets and rows and replies to them, new sheets in a workspace or folder with your own columns or as a copy of a template or sheet, smartsheet_share_asset and smartsheet_create_update_request. These tools are on at install. Shares and update requests with send_email send emails, and followers of a sheet may be notified of new comments, so the AI shows you the recipients, access level and content first and waits for your yes.

Writing cells: a cell is {"columnId": <id>, "value": <value>}. DATE takes YYYY-MM-DD, CHECKBOX true or false, PICKLIST one of its options (other values are refused unless strict is false), CONTACT_LIST an email address, numbers are sent as numbers. A formula goes into "formula": "=..." instead of value. New rows need a location: toBottom, toTop, parentId or siblingId. Columns with a column formula, system columns (auto number, created date, modified by) and locked columns cannot be written.

Switched off at install: smartsheet_delete_rows, because deleted rows, together with their child rows, attachments and comments, cannot be restored through the API. An admin switches it on when the team needs it.

Data formats: sheets, rows, columns, workspaces, folders, reports and users have long numeric ids (up to 16 digits), which the AI passes as text exactly as returned. Dates and times are ISO 8601 in UTC; date cells are YYYY-MM-DD. Multi-contact and multi-picklist cells come back as text unless level (2 or 3) and include=objectValue are passed. accessLevel is VIEWER, COMMENTER, EDITOR, EDITOR_SHARE, ADMIN or OWNER. Write calls answer {"message": "SUCCESS", "resultCode": 0, "result": ...}; resultCode 3 means partial success.

Paging: sheets, columns, discussions, attachments, users and cell history page with page and page_size (100 by default; the answer carries totalPages and totalCount) or include_all. Workspaces, workspace and folder contents, dashboards and shares page with a token: the AI passes lastKey from the answer as last_key until it is missing.

Limits: 300 requests per minute per token, 30 per minute for cell history. A 429 answer (error code 4003) means waiting a minute. A bulk row call counts as one request; keep it under a few hundred rows.

Common errors: 401 (codes 1002, 1003, 1004) means an invalid or expired token, or the host of another region. 403 (1004) means the token's user may not open that item: share it with that user or use a token of a user who has access. 404 (1006) means the id does not exist or is not visible to the user. 400 comes with an errorCode and a message naming the problem, for example a value that is not in the dropdown list, a new row without a location or a write to a column that holds a column formula.

The connector does not upload files, does not delete sheets or columns and does not create workspaces or folders.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Microsoft Copilot

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Microsoft Copilot uses MCP servers through agents built in Copilot Studio: you add AnythingMCP to an agent as a tool, then publish the agent to Microsoft 365 Copilot and Teams. Copilot Studio connects from Microsoft's cloud over Streamable HTTP, which AnythingMCP supports.

1. In Copilot Studio, open your agent (or create one), go to Tools and choose Add a tool → New tool → Model Context Protocol.
2. Enter a Server name (for example AnythingMCP), a Server description that says what the connector does, and the Server URL https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID. Copilot Studio uses the description to decide when to call the server.
3. Under authentication, choose API key, set Type to Header and the header name to X-API-Key, then select Create.
4. In Add tool, choose Create a new connection, paste an MCP API key from AnythingMCP (MCP Servers → your server → API keys) and select Add to agent.
5. Try it in the agent's Test pane: ask for something that needs the Smartsheet tools.
6. Select Publish, then Channels → Microsoft 365 and Microsoft Teams, keep Make agent available in Microsoft Copilot selected and choose Add channel. See agent in Teams installs it for you; in Microsoft 365 Copilot, type @ and pick the agent.

Prefer per-user sign-in? Choose OAuth 2.0 → Dynamic discovery instead of an API key: each user then signs in to AnythingMCP the first time the agent calls it.

Self-hosting? Use your instance's public HTTPS address instead of https://cloud.anythingmcp.com. Copilot Studio connects from Microsoft's cloud, so localhost does not work.

Available tools

Example prompts

• "Show every row in the Project Tracker sheet whose status is At Risk, with owner and due date."
• "Add a row at the bottom of the Marketing Calendar sheet: Webinar, 2026-11-20, owner [email protected], status Planned."
• "Who changed the budget cell in row 14 of the Q4 Budget sheet, and what were the earlier values?"
• "Find every sheet, comment or attachment that mentions Project Apollo."
• "Read the sheet summary of Website Relaunch and tell me the overall status and percent complete."

FAQ

Which Copilot is this for? Microsoft 365 Copilot at work, through agents built in Copilot Studio. The Microsoft Copilot app for personal accounts has no option to add your own MCP server.

What do I need? A work account with access to Copilot Studio (a license or a trial) to build the agent. People who use it in Microsoft 365 Copilot or Teams need access to the agent: share it with them, or ask an admin to publish it to the organization. If your organization applies data policies to Power Platform connectors, they cover MCP servers too.

The agent doesn't call the tools. Check that the header name is exactly X-API-Key and that the key belongs to the same MCP server as the URL, and make the server description specific: Copilot Studio uses it to decide when to call the server. Publish the agent again after each change; in an open chat, type "start over" to get the new version.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Cursor
• Connect to Gemini
• Connect to Meta Muse