io.github.christianclaudioPublished by GitHub account christianclaudiov2.2.0Updated Oct 30, 2026
MCP server for Smartsheet Resource Management (10,000ft API) time tracking and scheduling.
MCP server for Smartsheet Resource Management (10,000ft API) that lets an assistant read and change timesheets, projects, assignments and admin data.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Follow the launch instructions in the repository.
[CI] [PyPI] [Python] [License: Apache-2.0] [Coverage] [CodeRabbit Reviews]
Enterprise Model Context Protocol (MCP) server for Resource Management by Smartsheet (10,000ft API).
Enables AI coding agents, planners, and assistants (Claude, Cortex, Antigravity, VS Code) to work with the Smartsheet RM public REST API: time tracking & timesheet reconciliation, resource scheduling & allocations, capacity planning, project & phase management, leaves/holidays, expense tracking, and custom fields.
create_server mounts the time, projects, and admin sub-servers with FastMCP 4 namespace=, so tools/list names are time_*, projects_*, and admin_*. Legacy rm_* names are not registered on the gateway.
root.mount(..., namespace=...)):
namespace="time" → time_* (19 tools, including the bulk-gated time_bulk_delete_time_entries).namespace="projects" → projects_* (36 tools, including the bulk-gated projects_bulk_delete_assignments).namespace="admin" → admin_* (60 tools).ParentAuditMiddleware (timing, lifecycle logs, secret redaction) and ReadOnlyGateMiddleware (annotation-driven read-only gate, see below).TimeDomainGuardMiddleware (logged hours must be 0–24; bulk gate), ProjectsDomainGuardMiddleware (project names must be non-empty; bulk gate), AdminDomainGuardMiddleware (per_page must be ≤ 1000).Pick a profile with --profile or SMARTSHEET_RM_PROFILE (default full). An unknown profile name fails at startup with ValueError. There are two kinds:
full, time, projects, admin, and readonly.readonly; the domain-mount profiles time, projects and admin carry only their own domain's prompts and resources. Each listed name is checked against the full catalog when the server builds, so a typo fails at startup.Seven tools are in no job profile and are reachable only in full (or their domain-mount profile): time_bulk_delete_time_entries, projects_bulk_delete_assignments, admin_delete_client, admin_delete_client_contact, admin_create_expense_category, admin_delete_expense_category, and admin_delete_tag.
readOnlyHint annotation is the only thing that decides whether a tool is read-only. Every tool declares it explicitly: true on the 50 reads and false on the 65 writes. A tool with no annotation or no readOnlyHint counts as a write.--profile readonly or SMARTSHEET_RM_READONLY=1 (on any profile) lists only the read-only tools, and ReadOnlyGateMiddleware refuses any call to a real tool that is not read-only, including a write the filter hid. A refusal comes back as a tool result with isError: true.Unknown tool error, directly or through call_tool, so a typo is never reported as a blocked tool.call_tool wraps. Reads through call_tool work and writes are refused. Without Tool Search, call_tool is not a tool on the server, so a call to it gets Unknown tool: 'call_tool'.time_bulk_delete_time_entries and projects_bulk_delete_assignments are listed in full, time and projects. The domain guards refuse them at call time (isError: true) unless SMARTSHEET_RM_ALLOW_BULK_DESTRUCTIVE=1, and the handlers still require confirm=True. Read-only mode hides and refuses them.
tools/list is flat by default. Discovery is opt-in and attaches only on full:
--enable-tool-search / SMARTSHEET_RM_ENABLE_TOOL_SEARCH=1 replaces tools/list with search_tools and call_tool. The backend is regex (default) or bm25 (--tool-search-backend / SMARTSHEET_RM_TOOL_SEARCH_BACKEND).--enable-code-mode / SMARTSHEET_RM_ENABLE_CODE_MODE=1 attaches FastMCP's experimental Code Mode (search, get_schema, execute). Code Mode needs the sandbox from the package's code-mode extra (fastmcp[code-mode], which ships pydantic-monty): pip install "mcp-server-smartsheet-rm[code-mode]" or uvx --from "mcp-server-smartsheet-rm[code-mode]" smartsheet-rm-mcp --enable-code-mode. Without it, Code Mode is skipped with a warning and the flat catalog is served.ValueError. Asking for either on another profile logs a warning and keeps the flat list.search_tools, search and get_schema only read the catalog and are annotated readOnlyHint=True. Under read-only, Code Mode execute is refused.The server exposes tools covering projects, resources, timesheets, and capacity. Call the namespaced names below:
full (the 2 bulk-destructive tools are listed and refused at call time unless SMARTSHEET_RM_ALLOW_BULK_DESTRUCTIVE=1).readOnlyHint=true).confirm=True (19 standard + 2 bulk).idempotentHint=true (the 50 read-only tools, plus time_update_time_approval_status, time_lock_timesheet, admin_set_custom_field_values, and admin_set_user_status).Agents call these tools/list names. Counts for time and projects include the bulk-gated tool.
time_*, 19 tools): time_list_time_entries, time_get_time_entry, time_create_time_entry, time_create_user_time_entry, time_create_project_time_entry, time_update_time_entry, time_delete_time_entry, time_list_user_suggestions, time_update_time_approval_status, time_lock_timesheet, time_fill_weekly_timesheet, time_confirm_suggested_hours, time_reconcile_and_submit_week, time_list_approvals, time_create_approval, time_delete_approval, time_list_time_entry_categories, time_list_project_time_entry_categories. Bulk-gated: time_bulk_delete_time_entries.projects_*, 36 tools): projects_list_projects, projects_get_project, projects_create_project, projects_update_project, projects_delete_project, projects_list_project_users, projects_list_project_phases, projects_get_project_phase, projects_create_project_phase, projects_update_project_phase, projects_delete_project_phase, projects_list_assignments, projects_get_assignment, projects_create_assignment, projects_create_project_assignment, projects_create_user_assignment, projects_update_assignment, projects_delete_assignment, projects_clone_project_schedule, projects_list_status_options, projects_list_placeholder_resources, projects_create_placeholder_resource, projects_delete_placeholder_resource, projects_list_assignment_subtasks, projects_create_assignment_subtask, projects_delete_assignment_subtask, projects_list_assignables, projects_get_assignable, projects_list_project_budget_items, projects_get_budget_item, projects_get_project_budget_item, projects_list_project_members, projects_list_relationships_project_members, projects_list_relationships_project_memberships, projects_list_user_project_memberships. Bulk-gated: projects_bulk_delete_assignments.admin_*, 60 tools):
admin_list_users, admin_get_user, admin_create_user, admin_update_user, admin_delete_user, admin_list_user_bill_rates, admin_create_user_bill_rate, admin_get_user_availability, admin_get_user_utilization, admin_list_roles, admin_create_role, admin_update_role, admin_delete_role, admin_list_disciplines, admin_create_discipline, admin_update_discipline, admin_delete_discipline.admin_list_clients, admin_get_client, admin_create_client, admin_update_client, admin_delete_client, admin_list_client_contacts, admin_create_client_contact, admin_delete_client_contact.admin_list_leave_types, admin_get_leave_type, admin_create_leave_type, admin_update_leave_type, admin_delete_leave_type, admin_list_holidays, admin_get_holiday, admin_create_holiday, admin_update_holiday, admin_delete_holiday.admin_list_expenses, admin_get_expense, admin_create_expense, admin_update_expense, admin_delete_expense, admin_list_expense_categories, admin_create_expense_category, admin_delete_expense_category.admin_list_tags, admin_create_tag, admin_delete_tag, admin_list_custom_fields, admin_get_custom_field, admin_create_custom_field, admin_update_custom_field, admin_delete_custom_field, admin_list_custom_field_values, admin_set_custom_field_values.admin_get_user_statuses, admin_set_user_status, admin_get_report_rows, admin_get_report_totals, admin_list_webhooks, admin_create_webhook, admin_delete_webhook.The tools below call routes that are in neither Smartsheet's Resource Management API reference (OpenAPI JSON) nor the archived 10,000ft API docs. There are 46 such method and path pairs. They are kept, and not re-pointed, because some documented equivalents take different request shapes, so moving a tool would change what it sends. Smartsheet may change or remove an undocumented route without notice, and each of these tools says so in its description. Prefer a tool on a documented route when one fits: for example, time_create_user_time_entry or time_create_project_time_entry instead of time_create_time_entry. Each of these client calls carries # drift-ignore: undocumented route, and scripts/check_openapi_drift.py fails on any other call that is not in the published spec.
uvxConsole scripts in [project.scripts] both call smartsheet_rm_mcp.server:main: smartsheet-rm-mcp (used below) and mcp-server-smartsheet-rm. Install examples stay unpinned. To freeze a release, pin the version from Releases.
After an upgrade, reload the MCP host so the live process start time is after the new binary mtime (stale process ≠ new package).
Smartsheet Gov is opt-in; the default base URL and allowlist do not change. Per Smartsheet's RM API Introduction and Authentication pages, the Gov base URL is https://app.smartsheetgov.com/2.0/rm/api/v1 and every request needs both the RM token in auth and a Smartsheet API token as Authorization: Bearer. To use it:
The Gov host goes through the same HTTPS, SSRF, allowlist and DNS-pinning checks as any other base URL. The client refuses to start against the Gov host without the Smartsheet token, and sends that token to no other host. On HTTP transports, a caller that sends its own auth or x-smartsheet-rm-token header must also send its own x-smartsheet-gov-api-token header; the environment Gov token is never paired with a caller's RM token.
~/.gemini/antigravity-cli/mcp_config.json)~/.snowflake/cortex/mcp.json)claude_desktop_config.json)Prefer Streamable HTTP. --transport sse is deprecated (MCP spec SEP-2577); main() logs a migration warning and does not advertise /sse as the client path.
Connect clients to http://127.0.0.1:8000/mcp (FastMCP's default Streamable HTTP path). run(transport="streamable-http") does not set a custom path. Binding to 0.0.0.0 or :: requires an explicit --allowed-host (a wildcard * is rejected).
In the default (stateful) HTTP mode, a session idle for 30 minutes expires: its next request gets HTTP 404 and the client must start a new session. Change this with FastMCP's session_idle_timeout (on http_app()) or FASTMCP_HTTP_SESSION_IDLE_TIMEOUT (seconds, or none to never expire); see the FastMCP 4.1.0 release and #5229.
HTTP authentication. Set SMARTSHEET_RM_MCP_AUTH_TOKEN to require Authorization: Bearer <token> on every HTTP request; a missing or wrong token gets 401. The token is stripped, and a blank value counts as unset. It is attached when the server is built, so smartsheet-rm-mcp, fastmcp run and an ASGI host mounting mcp.http_app() all enforce it. stdio never uses it.
With no token, an HTTP bind to 127.0.0.1, ::1 or localhost still starts, unauthenticated, and logs a warning. A tokenless bind to any other host exits with code 2. Set the token, bind to localhost, or set SMARTSHEET_RM_MCP_ALLOW_UNAUTHENTICATED_BIND to 1, true, yes or on to accept an unauthenticated public bind (any other value refuses). To serve the image over HTTP, pass the tokens from your environment or an env file, not on the command line:
confirm: bool = False and makes no change unless the caller explicitly passes confirm=True. Without it the tool returns a normal result (isError: false) with "status": "confirmation_required" and a message to re-call with confirm=true; that is the designed two-step, not an error.isError: true, "type": "invalid_request") the model can correct, as the MCP spec describes for input validation errors.time_fill_weekly_timesheet, time_confirm_suggested_hours, time_bulk_delete_time_entries and projects_bulk_delete_assignments share one shape: "status": "success" or "partial_success", a success count (filled_count / confirmed_count / deleted_count), failed_count, results and errors. Each success is {id|date, status, result}; each failure is {id|date, status: "failed", error} where error always has a message (API errors via to_dict(); other exceptions as "type": "internal" with a redacted message). The field names from earlier releases stay alongside: time_fill_weekly_timesheet also returns days_filled, created_count and entries (the created entries), and time_confirm_suggested_hours returns confirmed_entries. When every item fails, the call is a tool error (isError: true, "type": "batch_failed").timesheets, staffing, org_setup, portfolio) or one domain (time, projects, admin).readOnlyHint decides; anything else is refused with isError: true.Source: README.md at commit 7fb1f31
Time List Time Entries
List time entries across organization or filtered by project, user, or date range (YYYY-MM-DD).
pageto_dateuser_idper_pagefrom_dateproject_idwith_suggestionsTime Get Time Entry
Get details for a specific time entry by its ID.
entry_idrequiredTime Create Time Entry
Create a new time entry for a user on a project (date format: YYYY-MM-DD). Undocumented route: `POST /time_entries` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented routes: `POST /users/{user_id}/time_entries` (time_create_user_time_entry) and `POST /projects/{project_id}/time_entries` (time_create_project_time_entry).
daterequiredhoursrequirednotesuser_idrequiredphase_idproject_idrequiredis_billablecustom_field_valuesTime Create User Time Entry
Create a time entry for a user on the documented route `POST /users/{user_id}/time_entries`. assignable_id is the project, phase or leave type ID; date is YYYY-MM-DD. task, notes and bill_rate_id are optional; the reference limits task and notes to 256 characters. The body repeats user_id, which the reference says must match the URL.
daterequiredtaskhoursrequirednotesuser_idrequiredbill_rate_idassignable_idrequiredTime Create Project Time Entry
Create a time entry on a project on the documented route `POST /projects/{project_id}/time_entries`. date is YYYY-MM-DD. The body's assignable_id is project_id, which the reference says must match the URL; to log time to a phase or leave type, use time_create_user_time_entry. task, notes and bill_rate_id are optional; the reference limits task and notes to 256 characters.
daterequiredtaskhoursrequirednotesuser_idrequiredproject_idrequiredbill_rate_idTime Update Time Entry
Update an existing time entry. Undocumented route: `PUT /time_entries/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented route: `PUT /users/{user_id}/time_entries/{id}`.
datehoursnotesentry_idrequiredis_billableTime Delete Time Entry
Delete a time entry (Destructive: requires confirm=True). Undocumented route: `DELETE /time_entries/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented route: `DELETE /users/{user_id}/time_entries/{id}`.
confirmentry_idrequiredTime List User Suggestions
Read unconfirmed scheduled time suggestions for a user.
to_dateuser_idrequiredfrom_dateTime Update Time Approval Status
Approve or reject time entries for a user (status: 'approved', 'rejected', 'pending'). Undocumented route: `PUT /users/{user_id}/time_entries/approval_status` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
statusrequireduser_idrequiredentry_idsrequiredapprover_notesTime Lock Timesheet
Lock or unlock timesheet records for a user up to a specified lock date (YYYY-MM-DD). Undocumented route: `POST /users/{user_id}/time_entries/lock` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
unlockuser_idrequiredlock_daterequiredTime Fill Weekly Timesheet
Batch-fill weekly timesheet entries (Mon-Fri 8h default, or 7-day with include_weekends=True) for a user. start_date: Monday date of the week in YYYY-MM-DD. include_weekends: When True, logs Saturday and Sunday entries as well. weekend_hours: Specific hours for Saturday/Sunday (defaults to daily_hours if omitted). Undocumented route: `POST /time_entries` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Each entry is created there. Documented route: `POST /users/{user_id}/time_entries`.
notesuser_idrequiredproject_idstart_daterequireddaily_hoursweekend_hoursinclude_weekendsTime Confirm Suggested Hours
Auto-confirm all unconfirmed scheduled suggestions for a user within a date range. Undocumented route: `PUT /time_entries/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Each suggestion is confirmed there. Documented route: `PUT /users/{user_id}/time_entries/{id}`.
to_daterequireduser_idrequiredfrom_daterequiredTime Reconcile And Submit Week
Audit weekly logged hours against a target (40h) and optionally submit/approve timesheet. Undocumented route: `PUT /users/{user_id}/time_entries/approval_status` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Only auto_submit=True calls it. No documented equivalent was found.
user_idrequiredstart_daterequiredauto_submittarget_hoursTime Bulk Delete Time Entries
Bulk delete multiple time entries (Destructive: gated by SMARTSHEET_RM_ALLOW_BULK_DESTRUCTIVE=1 and confirm=True). Undocumented route: `DELETE /time_entries/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented route: `DELETE /users/{user_id}/time_entries/{id}`.
confirmentry_idsrequiredTime List Approvals
List submitted time entry and expense approvals across the organization.
pageper_pageTime Create Approval
Submit or approve approvable records (approvable_type: 'time_entries' or 'expense_items').
notesstatusapprovable_idsrequiredapprovable_typerequiredTime Delete Approval
Delete a pending approval record (Destructive: requires confirm=True).
confirmapproval_idrequiredProjects List Projects
List projects in Smartsheet RM with filtering, phase inclusion, and pagination.
pagearchivedper_pagesort_fieldsort_orderwith_phasesfilter_fieldfilter_valueProjects Get Project
Get project details including budget, phases, client, and dates.
project_idrequiredwith_phasesProjects Create Project
Create a new project in Smartsheet RM.
namerequiredbudgetsecureend_dateclient_idstart_datebudget_typedescriptionproject_typeproject_stateProjects Update Project
Update project metadata, state, dates, budget or archive status.
namebudgetarchivedend_dateproject_idrequiredstart_datebudget_typedescriptionproject_stateProjects Delete Project
Delete a project (Destructive: requires confirm=True).
confirmproject_idrequiredProjects List Project Users
List users associated with or assigned to a specific project.
pageper_pageproject_idrequiredProjects List Project Phases
List phases belonging to a project.
project_idrequiredProjects Get Project Phase
Get details for a specific project phase. Undocumented route: `GET /projects/{project_id}/phases/{phase_id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only PUT and DELETE on that path; `GET /projects/{project_id}/phases` lists phases.
phase_idrequiredproject_idrequiredProjects Create Project Phase
Create a new phase under a project.
namerequiredbudgetend_daterequiredproject_idrequiredstart_daterequireddescriptionProjects Update Project Phase
Update an existing project phase.
namebudgetend_datephase_idrequiredproject_idrequiredstart_datedescriptionProjects Delete Project Phase
Delete a project phase (Destructive: requires confirm=True).
confirmphase_idrequiredproject_idrequiredProjects List Assignments
List resource scheduling assignments across projects or filtered by user/project.
pageto_dateuser_idper_pagefrom_dateproject_idProjects Get Assignment
Get details for a specific assignment.
assignment_idrequiredProjects Create Assignment
Create a resource assignment on a project or phase (dates: YYYY-MM-DD).
notepercentuser_idrequiredend_daterequiredphase_idproject_idrequiredstart_daterequiredfixed_hourshours_per_dayallocation_modeProjects Create Project Assignment
Assign a user to a project on the documented route `POST /projects/{project_id}/assignments` (dates: YYYY-MM-DD). Set allocation_mode and the matching value: percent (the reference documents it as a fraction from 0 to 1), hours_per_day, or fixed_hours for the fixed mode. allocation_mode is sent as given, because the reference names the fixed mode `fixed` in its description and `fixed_hours` in its schema. Percent mode is the default and requires percent; hours_per_day and the fixed mode require hours_per_day and fixed_hours. Without the matching value the call is refused before any request.
percentuser_idrequiredend_daterequiredproject_idrequiredstart_daterequireddescriptionfixed_hoursbill_rate_idhours_per_dayallocation_modestatus_option_idProjects Create User Assignment
Assign a user to a project, phase or leave type on the documented route `POST /users/{user_id}/assignments` (dates: YYYY-MM-DD). assignable_id is the project, phase or leave type ID. Set allocation_mode and the matching value: percent (the reference documents it as a fraction from 0 to 1), hours_per_day, or fixed_hours for the fixed mode. allocation_mode is sent as given, because the reference names the fixed mode `fixed` in its description and `fixed_hours` in its schema. Percent mode is the default and requires percent; hours_per_day and the fixed mode require hours_per_day and fixed_hours. Without the matching value the call is refused before any request.
percentuser_idrequiredend_daterequiredstart_daterequireddescriptionfixed_hoursbill_rate_idassignable_idrequiredhours_per_dayallocation_modestatus_option_idProjects Update Assignment
Update dates, allocation percentage, or hours on an existing assignment.
notepercentend_datestart_datefixed_hoursassignment_idrequiredhours_per_dayProjects Delete Assignment
Delete a resource assignment (Destructive: requires confirm=True).
confirmassignment_idrequiredProjects Clone Project Schedule
Duplicate project budget settings, timeline, and phase milestone structure to a new project.
client_idnew_start_datesource_project_idrequiredtarget_project_namerequiredProjects Bulk Delete Assignments
Bulk delete multiple resource assignments (Destructive: gated by SMARTSHEET_RM_ALLOW_BULK_DESTRUCTIVE=1 and confirm=True).
confirmassignment_idsrequiredProjects List Status Options
List account-level assignment work status options.
Takes no parameters.
Projects List Placeholder Resources
List placeholder resources used for forecasting and capacity modeling.
pageper_pageProjects Create Placeholder Resource
Create a placeholder resource.
roletitlerequiredlocationdisciplineProjects Delete Placeholder Resource
Delete a placeholder resource (Destructive: requires confirm=True).
confirmplaceholder_idrequiredProjects List Assignment Subtasks
List subtasks (checklist tasks) for a project assignment.
project_idrequiredassignment_idrequiredProjects Create Assignment Subtask
Create a subtask under a project assignment.
completedproject_idrequireddescriptionrequiredassignment_idrequiredProjects Delete Assignment Subtask
Delete an assignment subtask (Destructive: requires confirm=True).
confirmproject_idrequiredsubtask_idrequiredassignment_idrequiredAdmin List Users
List users in the organization with role/discipline filtering.
pagerolearchivedper_pagedisciplineinclude_billabilityAdmin Get User
Get details for a specific user.
user_idrequiredAdmin Create User
Create a new user profile in Smartsheet RM.
roleemailrequiredlocationbill_ratecost_ratelast_namerequireddisciplinefirst_namerequireduser_type_idbillability_targetAdmin Update User
Update a user's profile, role, discipline, bill rate, or archive state.
roleemailuser_idrequiredarchivedbill_ratecost_ratelast_namedisciplinefirst_namebillability_targetAdmin Delete User
Delete or archive a user (Destructive: requires confirm=True).
confirmuser_idrequiredAdmin List User Bill Rates
List bill rate tiers for a user. Undocumented route: `GET /users/{user_id}/bill_rates` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented routes: `GET /bill_rates` and `GET /projects/{project_id}/bill_rates`.
user_idrequiredAdmin Create User Bill Rate
Add a bill rate tier with an effective date range for a user. Undocumented route: `POST /users/{user_id}/bill_rates` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents bill rates only under `/bill_rates` and `/projects/{project_id}/bill_rates`, with no create.
raterequireduser_idrequiredend_datestart_daterequiredAdmin Get User Availability
Query scheduled hours vs available capacity for a user. Undocumented route: `GET /users/{user_id}/availability` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented route: `GET /users/{user_id}/availabilities`.
to_dateuser_idrequiredfrom_dateAdmin Get User Utilization
Get billable utilization metrics for a user. Undocumented route: `GET /users/{user_id}/utilization` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
to_dateuser_idrequiredfrom_dateAdmin List Roles
List all configured user roles.
Takes no parameters.
Admin Create Role
Create a new role. Undocumented route: `POST /roles` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for roles.
namerequiredAdmin Update Role
Update an existing role. Undocumented route: `PUT /roles/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for roles.
namerequiredrole_idrequiredAdmin Delete Role
Delete a role (Destructive: requires confirm=True). Undocumented route: `DELETE /roles/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for roles.
confirmrole_idrequiredAdmin List Disciplines
List all configured disciplines.
Takes no parameters.
Admin Create Discipline
Create a new discipline. Undocumented route: `POST /disciplines` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for disciplines.
namerequiredAdmin Update Discipline
Update an existing discipline. Undocumented route: `PUT /disciplines/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for disciplines.
namerequireddiscipline_idrequiredAdmin Delete Discipline
Delete a discipline (Destructive: requires confirm=True). Undocumented route: `DELETE /disciplines/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for disciplines.
confirmdiscipline_idrequiredAdmin List Clients
List clients. Undocumented route: `GET /clients` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
pagearchivedper_pageAdmin Get Client
Get details for a specific client. Undocumented route: `GET /clients/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
client_idrequiredAdmin Create Client
Create a new client record. Undocumented route: `POST /clients` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
citynamerequiredstateaddresscountryzipcodeAdmin Update Client
Update a client record. Undocumented route: `PUT /clients/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
citynamestateaddresscountryzipcodearchivedclient_idrequiredAdmin Delete Client
Delete a client record (Destructive: requires confirm=True). Undocumented route: `DELETE /clients/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
confirmclient_idrequiredAdmin List Client Contacts
List contacts associated with a client. Undocumented route: `GET /clients/{id}/contacts` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
client_idrequiredAdmin Create Client Contact
Add a contact for a client. Undocumented route: `POST /clients/{id}/contacts` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
emailphonetitleclient_idrequiredlast_namerequiredfirst_namerequiredAdmin Delete Client Contact
Delete a client contact (Destructive: requires confirm=True). Undocumented route: `DELETE /clients/{id}/contacts/{contact_id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. No documented equivalent was found.
confirmclient_idrequiredcontact_idrequiredAdmin List Leave Types
List leave types (e.g. Vacation, Sick, Parental, PTO).
Takes no parameters.
Admin Get Leave Type
Get details for a specific leave type.
leave_type_idrequiredAdmin Create Leave Type
Create a new leave type. Undocumented route: `POST /leave_types` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for leave types.
namerequiredAdmin Update Leave Type
Update a leave type name. Undocumented route: `PUT /leave_types/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for leave types.
namerequiredleave_type_idrequiredAdmin Delete Leave Type
Delete a leave type (Destructive: requires confirm=True). Undocumented route: `DELETE /leave_types/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only GET for leave types.
confirmleave_type_idrequiredAdmin List Holidays
List company and regional holidays.
to_datefrom_dateAdmin Get Holiday
Get details for a specific holiday. Undocumented route: `GET /holidays/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only `GET /holidays`.
holiday_idrequiredAdmin Create Holiday
Create a new company holiday or non-working day. Undocumented route: `POST /holidays` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only `GET /holidays`.
daterequirednamerequiredend_dateAdmin Update Holiday
Update a holiday. Undocumented route: `PUT /holidays/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only `GET /holidays`.
datenameend_dateholiday_idrequiredAdmin Delete Holiday
Delete a holiday (Destructive: requires confirm=True). Undocumented route: `DELETE /holidays/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only `GET /holidays`.
confirmholiday_idrequiredAdmin List Expenses
List logged expenses across projects or filtered by project/user. Undocumented route: `GET /expenses`, `GET /projects/{project_id}/expenses`, `GET /users/{user_id}/expenses` are not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove them without notice. Documented routes: `GET /users/{user_id}/expense_items` and `GET /projects/{project_id}/expense_items`.
pageto_dateuser_idper_pagefrom_dateproject_idAdmin Get Expense
Get details for a specific logged expense. Undocumented route: `GET /expenses/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented routes: `GET /users/{user_id}/expense_items/{expense_item_id}` and `GET /projects/{project_id}/expense_items/{expense_item_id}`.
expense_idrequiredAdmin Create Expense
Log a project expense item. Undocumented route: `POST /expenses` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented route: `POST /users/{user_id}/expense_items`.
daterequirednotesamountrequireduser_idrequiredproject_idrequiredis_billableexpense_category_idrequiredAdmin Update Expense
Update a logged expense item. Undocumented route: `PUT /expenses/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented route: `PUT /users/{user_id}/expense_items/{expense_item_id}`.
datenotesamountexpense_idrequiredis_billableAdmin Delete Expense
Delete an expense item (Destructive: requires confirm=True). Undocumented route: `DELETE /expenses/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented route: `DELETE /users/{user_id}/expense_items/{expense_item_id}`.
confirmexpense_idrequiredAdmin List Expense Categories
List configured expense categories. Undocumented route: `GET /expense_categories` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented route: `GET /expense_item_categories`.
Takes no parameters.
Admin Create Expense Category
Create an expense category. Undocumented route: `POST /expense_categories` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only `GET /expense_item_categories`.
namerequiredAdmin Delete Expense Category
Delete an expense category (Destructive: requires confirm=True). Undocumented route: `DELETE /expense_categories/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. The reference documents only `GET /expense_item_categories`.
confirmcategory_idrequiredAdmin List Tags
List tags. Undocumented route: `GET /tags` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented routes: `GET /projects/{project_id}/tags` and `GET /users/{user_id}/tags`.
pageper_pageAdmin Create Tag
Create a tag. Undocumented route: `POST /tags` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented routes: `POST /projects/{project_id}/tags` and `POST /users/{user_id}/tags`.
namerequiredAdmin Delete Tag
Delete a tag (Destructive: requires confirm=True). Undocumented route: `DELETE /tags/{id}` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented routes: `DELETE /projects/{project_id}/tags/{tag_id}` and `DELETE /users/{user_id}/tags/{tag_id}`.
tag_idrequiredconfirmAdmin List Custom Fields
List custom field definitions.
Takes no parameters.
Admin Get Custom Field
Get details of a custom field definition.
custom_field_idrequiredAdmin Create Custom Field
Create a custom field definition (field_type: text, number, select, date; target_type: Project, User, Phase).
namerequiredoptionsfield_typerequiredtarget_typerequiredAdmin Update Custom Field
Update a custom field definition.
nameoptionscustom_field_idrequiredAdmin Delete Custom Field
Delete a custom field definition (Destructive: requires confirm=True).
confirmcustom_field_idrequiredAdmin List Custom Field Values
List custom field values, optionally filtered to one entity by target_id and target_type. Undocumented route: `GET /custom_field_values` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented routes: `GET /projects/{project_id}/custom_field_values` and `GET /users/{user_id}/custom_field_values`.
target_idtarget_typeAdmin Set Custom Field Values
Set custom field values for an entity. Undocumented route: `PUT /custom_field_values` is not in Smartsheet's Resource Management API reference or the archived 10,000ft API docs, so Smartsheet may change or remove it without notice. Documented routes: `PUT /projects/{project_id}/custom_field_values/{custom_field_value_id}` and `PUT /users/{user_id}/custom_field_values/{custom_field_value_id}`.
valuesrequiredtarget_idrequiredtarget_typerequiredAdmin Get User Statuses
Retrieve work status history for a specific user (ITO, WFH, SIC, OOO, VAC, OOF).
user_idrequiredAdmin Set User Status
Set current working status for a user (status: 'ITO', 'WFH', 'SIC', 'OOO', 'VAC', 'OOF').
notesstatusrequireduser_idrequiredAdmin Get Report Rows
Generate detailed custom report rows.
report_parametersrequiredAdmin Get Report Totals
Generate aggregated custom report totals.
report_parametersrequiredAdmin List Webhooks
List configured organization webhooks.
Takes no parameters.
Admin Create Webhook
Register a webhook subscription (e.g. 'time.entry.created', 'project.updated', 'assignment.created').
event_typerequiredcallback_urlrequiredAdmin Delete Webhook
Delete a webhook subscription (Destructive: requires confirm=True).
confirmwebhook_idrequired90% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
graph TD Client["AI Agent (Claude / Cortex / Antigravity / Cursor)"] -->|"MCP Stdio / Streamable HTTP /mcp"| Server["Root Gateway create_server()"] Server --> Middle["Parent Middleware (ParentAudit / ReadOnly Gate)"] Middle --> SubTime["time namespace (time_* — 19 tools, incl. 1 bulk-gated)"] Middle --> SubProj["projects namespace (projects_* — 36 tools, incl. 1 bulk-gated)"] Middle --> SubAdmin["admin namespace (admin_* — 60 tools)"] SubTime --> Guards["Domain Guards"] SubProj --> Guards SubAdmin --> Guards Guards --> ClientPool["SmartsheetRMClient (httpx.AsyncClient Pool)"] ClientPool -->|"auth header + 429 Jitter Retry"| API["Smartsheet RM (10,000ft API)"]uvx --from mcp-server-smartsheet-rm smartsheet-rm-mcp# Using uv (recommended)uv pip install mcp-server-smartsheet-rm
# Or standard pippip install mcp-server-smartsheet-rmexport SMARTSHEET_RM_BASE_URL='https://app.smartsheetgov.com/2.0/rm/api/v1'export SMARTSHEET_RM_ALLOWED_HOSTS='app.smartsheetgov.com'export SMARTSHEET_RM_API_TOKEN='your_rm_api_token'export SMARTSHEET_RM_GOV_SMARTSHEET_API_TOKEN='your_smartsheet_api_token'{ "mcpServers": { "smartsheet-rm": { "command": "uvx", "args": ["--from", "mcp-server-smartsheet-rm", "smartsheet-rm-mcp"], "env": { "SMARTSHEET_RM_API_TOKEN": "your-api-token" }, "lazy": true } }}{ "servers": { "smartsheet-rm": { "command": "uvx", "args": ["--from", "mcp-server-smartsheet-rm", "smartsheet-rm-mcp"], "env": { "SMARTSHEET_RM_API_TOKEN": "your-api-token" } } }}{ "mcpServers": { "smartsheet-rm": { "command": "uvx", "args": ["--from", "mcp-server-smartsheet-rm", "smartsheet-rm-mcp"], "env": { "SMARTSHEET_RM_API_TOKEN": "your-api-token" } } }}uvx --from mcp-server-smartsheet-rm smartsheet-rm-mcp --transport streamable-http --host 127.0.0.1 --port 8000# export SMARTSHEET_RM_API_TOKEN and SMARTSHEET_RM_MCP_AUTH_TOKEN first, or use --env-file .envdocker run --rm -p 8000:8000 -e SMARTSHEET_RM_API_TOKEN -e SMARTSHEET_RM_MCP_AUTH_TOKEN \ ghcr.io/christianclaudio/mcp-server-smartsheet-rm:latest \ --transport streamable-http --host 0.0.0.0 --allowed-host localhost:8000# Run tests with 100% coverage requirementpytest --cov=src/smartsheet_rm_mcp --cov-fail-under=100 -v
# Run Tool Contract verificationpython scripts/check_tool_contract.py
# Run OpenAPI Drift check against Smartsheet's published spec (or --spec-file for a local copy)python scripts/check_openapi_drift.py --spec-url https://developers.smartsheet.com/_spec/api/resource_management/openapi.json