smartsuite-mcp-server (SmartSuiteFoundry/smartsuite-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 85 tools. No publisher has claimed this listing.
Local MCP server for governed AI access to SmartSuite
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
SmartSuiteFoundry
Source: Glama · also listed on github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
smartsuite_diagnosticsValidate SmartSuite MCP server configuration and connectivity. Returns server version, mode, and account info. Does not return the API key.
smartsuite_list_workspacesList the SmartSuite workspaces (accounts) the configured API key can access. Only available when SMARTSUITE_ENABLE_CROSS_WORKSPACE=true. Returns slim records: id, slug, name, solutionsCount, status, plan, isPrimary, isAllowed. Use the slug or name with the `workspace` parameter on read tools to targ…
smartsuite_list_solutionsList SmartSuite solutions (workspaces) accessible to the authenticated user.
smartsuite_get_solutionGet details for a specific SmartSuite solution.
smartsuite_create_solutionCreate a new solution. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Only a name is required; the server assigns a slug, a default logo, and private-to-you permissions. Optionally set logoIcon and logoColor. Add tables to it with smartsuite_create_application. Dry-run previe…
smartsuite_list_applicationsList SmartSuite applications (tables). Optionally filter by solution. Returns full table objects by default (heavy — includes each table's field structure); set slim:true to return only {id, name, slug, solution, fieldCount}, which is the safe way to inventory a multi-table solution without exceedin…
smartsuite_create_applicationCreate a new table (application) in a solution. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Supply a name and the solutionId. The table is created with a default "Title" primary field and a record term ("what each record is called", default "Record") — the record term is a…
smartsuite_describe_applicationDescribe a SmartSuite application schema, including field slugs, types, and options, plus the record term (custom record terminology). Always call this before creating or updating records so you know field slugs and valid values. Set includeLayout:true to also return the record-view layout (sections…
smartsuite_list_deleted_applicationsList soft-deleted applications (tables) in a solution's trash (read-only). Returns id, name, and recordTerm for each. Note: SmartSuite exposes no public endpoint to restore a deleted application, so this is listing only (restore a table from the SmartSuite UI).
smartsuite_list_fieldsList a SmartSuite application's fields as a token-lean column list: slug, label, type, choice options (value+label), and linked-app targets — omitting help text and false flags. Cheapest way to learn a table's fields; prefer this over smartsuite_describe_application when you just need field slugs/ty…
smartsuite_describe_fieldGet detailed metadata for a single field in a SmartSuite application, including help text, choice options, linked-record targets, and — for formula fields — the formula expression and its computed return type.
smartsuite_analyze_formulasReview and analyze formula fields in a SmartSuite application. Without fieldSlug: returns every formula field with its return type, validity (valid:false = broken formula), native complexity score + tier, and structural metrics (function count, nesting depth, reference counts) — sortable by name or …
smartsuite_validate_formulaValidate a SmartSuite formula expression against an application WITHOUT writing anything (safe in any mode). Returns {valid, safe, warnings} when valid, or a descriptive error message when not (syntax errors, unknown functions, missing field references). Field references use [slug] and chain across …
smartsuite_create_formula_fieldCreate a new formula field in a SmartSuite application. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. The expression is validated first — an invalid formula is never created. Without confirm:true returns a dry-run preview (validation result + what would be created); set conf…
smartsuite_update_formula_fieldUpdate an existing formula field's expression, label, and/or return type. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. The current definition is fetched and only the supplied fields are changed (other params preserved). The new expression is validated first. Without confirm…
smartsuite_set_field_help_textSet or modify a field's help text (any field type). Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. helpText is lightweight markdown — paragraphs (blank-line separated), bullet lists (-/*), ordered lists (1.), and inline **bold** / *italic* — converted to SmartSuite's rich hel…
smartsuite_create_fieldCreate a field of any type in an application (including rollup and lookup fields — not just formulas). Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. You supply fieldType + label and an OPTIONAL sparse params object; SmartSuite fills type defaults, so most fields need no para…
smartsuite_update_fieldUpdate a field's label and/or params (any type). Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. params is a PATCH — only the keys you pass are changed (shallow-merged onto the existing params); everything else (choices, nested, links) is preserved. Read the field first with s…
smartsuite_delete_fieldDelete a field from a table by slug. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true AND SMARTSUITE_ENABLE_DELETE=true. Destructive — removes the field and its data (system fields are refused). Useful e.g. to replace a formula field with a rollup: create the rollup, then delete…
smartsuite_list_deleted_fieldsList soft-deleted fields in a solution (read-only). Returns each deleted field's slug, label, and fieldType. Solution-scoped — the API does not attribute deleted fields to their source application, so results are not app-filtered. Restore one with smartsuite_restore_field (supplying the applicationI…
smartsuite_restore_fieldRestore a soft-deleted field back into its application. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Supply the applicationId the field belonged to and its slug (from smartsuite_list_deleted_fields). Dry-run preview unless confirm:true.
smartsuite_list_recordsList records from a SmartSuite application. Use smartsuite_describe_application first to learn field slugs. For large result sets, pass format:"compact" and a fields projection to cut token usage substantially.
smartsuite_get_recordGet a single SmartSuite record by ID.
smartsuite_search_recordsSearch records using a text query across specified fields.
smartsuite_query_recordsQuery records using a structured SmartSuite filter. Use smartsuite_describe_application first to learn field slugs and valid values for choice fields.
smartsuite_create_recordCreate a new record in a SmartSuite application. Requires readwrite or admin mode. Call smartsuite_describe_application first to learn field slugs.
smartsuite_create_recordsBatch-create multiple records in one call. Requires readwrite or admin mode. Supports dry-run (default) then confirm. Respects the server batch-size cap (SMARTSUITE_MAX_BATCH_WRITES). Returns created record IDs and any per-row failures. Call smartsuite_describe_application first to learn field slugs…
smartsuite_update_recordUpdate an existing record. Requires readwrite or admin mode. Only supply fields you want to change.
smartsuite_update_recordsBatch update multiple records. Supports dry-run mode. Requires readwrite or admin mode.
smartsuite_delete_recordsDelete records (soft-delete to the trash). Requires readwrite or admin mode AND SMARTSUITE_ENABLE_DELETE=true. Supports dry-run. The response returns the deleted recordIds; they can be recovered with smartsuite_restore_records (when SMARTSUITE_ENABLE_RESTORE=true) or listed via smartsuite_list_delet…
smartsuite_list_deleted_recordsList soft-deleted records in a solution's trash (read-only). Solution-scoped — spans all applications in the solution; pass applicationId to filter to one. Returns id, title, applicationId, applicationName, deletedBy (member id), and deletedAt. Use the returned ids with smartsuite_restore_records. R…
smartsuite_restore_recordsRestore soft-deleted records from the trash. Requires readwrite or admin mode AND SMARTSUITE_ENABLE_RESTORE=true. Without confirm:true returns a preview; pass confirm:true to restore. Get record IDs from the smartsuite_delete_records response, the audit log, or smartsuite_list_deleted_records.
smartsuite_list_commentsList comments on a SmartSuite record.
smartsuite_create_commentAdd a comment to a SmartSuite record. Requires readwrite or admin mode.
smartsuite_list_viewsList views for a SmartSuite application (grid, kanban, calendar, timeline, gantt, map, chart, form). Dashboards are excluded — use smartsuite_list_dashboards for those. Returns a slim list by default: id, name, type, description, order, and isDefault (the lowest-order view, inferred since SmartSuite…
smartsuite_describe_viewGet the full configuration for a single SmartSuite view: filters, sort, group-by, visible/collapsed fields, sharing/permission settings, and the raw view state. Use smartsuite_list_views to find view IDs.
smartsuite_create_viewCreate a view (report) in an application. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Supply applicationId, label (must be unique — the tool checks and suggests an alternative if taken), and viewMode (grid, card, kanban, calendar, timeline, gantt, chart, map). Optionally s…
smartsuite_update_viewUpdate a view (report): rename it (label), change its description, and/or change its configuration — visibleFields, filters (+filterOperator), sort, groupBy. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Only the parts you pass are changed; each provided config window replac…
smartsuite_delete_viewDelete a view (report). Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true AND SMARTSUITE_ENABLE_DELETE=true. Refuses to delete the only remaining view of an application, and refuses forms/dashboards (use their own tools). Without confirm:true returns a preview; pass confirm:true …
smartsuite_list_dashboardsList dashboards for a SmartSuite application. Returns id, name, description, order, tab count, and the tab list (id/name/order) for each dashboard. Use smartsuite_describe_dashboard for branding and widget detail.
smartsuite_describe_dashboardGet the full configuration for a single SmartSuite dashboard: tabs, footer/branding, style, and sharing settings. Set includeWidgets:true to also fetch every widget on every tab (type, name, position, size, and parsed params). Widget types include content widgets (hero, simple-banner, heading, faq, …
smartsuite_create_dashboardCreate a dashboard in an application. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Supply applicationId and a unique label (checked; suggests an alternative if taken). Optionally pass tabs (array of tab names, or {name, order} objects) — otherwise one default tab is created…
smartsuite_update_dashboardUpdate a dashboard: rename (label), change description, and/or edit tabs, footer, and style. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. tabs REPLACES the tab set — pass the full desired list as {id?, name, order?}; include a tab's existing id to rename/reorder it (get ids…
smartsuite_delete_dashboardDelete a dashboard and all its widgets. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true AND SMARTSUITE_ENABLE_DELETE=true. Refuses non-dashboard reports. Without confirm:true returns a preview; pass confirm:true to permanently delete. Destructive — cannot be undone.
smartsuite_add_dashboard_widgetAdd a widget to a dashboard tab. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Supply dashboardId, widgetType, and optionally tabId (defaults to the first tab), name, position {x,y}, size {width,height}, and params. VALID widgetType values — content: text-block-widget, headi…
smartsuite_update_dashboard_widgetUpdate a dashboard widget's settings and/or layout. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Change position {x,y} and size {width,height} to move/resize (x/width columns, y/height pixels), rename (name), toggle showName/collapsedByDefault, set color/description, move t…
smartsuite_remove_dashboard_widgetRemove a widget from a dashboard. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true AND SMARTSUITE_ENABLE_DELETE=true. Without confirm:true returns a preview; pass confirm:true to permanently delete. Destructive — cannot be undone.
smartsuite_normalize_dashboard_widgetsRepair a dashboard's widgets: reset them to their natural per-type size and/or re-stack them to remove overlaps. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Fixes dashboards built with wrong sizes (e.g. metric cards left too tall — which re-saving in the UI does not correc…
smartsuite_list_formsList forms (form-type report views) for a SmartSuite application. Returns each form's id, name, description, page count, bound-field count, sharing state, and public form URL (when sharing is enabled). Forms are how external/internal users submit records; in ITSM dashboards they are launched from bu…
smartsuite_describe_formGet the full structure of a SmartSuite form for review: settings (title, description, submit label, redirect, branding, logo), sharing (enabled, public URL, password protection), and the page-by-page layout. Each page is an input (form), review, or submission page. Input-page items are parsed into b…
smartsuite_create_formCreate a new form for a SmartSuite application. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. The label is checked for uniqueness and any supplied field slugs are validated against the application schema first. Without confirm:true returns a dry-run preview; set confirm:true…
smartsuite_update_formUpdate a form's settings and/or structure. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Provide any of: settings (title/description/submitLabel/redirectToUrl/displaySmartSuiteBranding) to merge; `fields` to replace the first input page's fields (slugs validated against the …
smartsuite_submit_formSubmit a SmartSuite form — creates a record through the form's submission pipeline, exactly as a user filling out the form would. Two-step: call WITHOUT `values` to get the form's input spec (fields to collect, with type and choice hints); then call WITH `values` (keyed by field slug, using normal S…
smartsuite_list_automationsList automations for a solution. Automations are scoped per solution (not per table). Returns each automation's id, name, enabled state, trigger reference, action count/types, and generated description.
smartsuite_describe_automationGet the full configuration for one automation: trigger config and all action groups, plus name, enabled state, and timezone. Use smartsuite_list_automations to find automation IDs.
smartsuite_describe_automation_stepResolve the full schema of one automation step — its trigger (default) or a chosen action — by calling the automation engine's dynamic description. For a trigger: returns label, inputs (with dropdown options), context outputs, the fields the trigger exposes to downstream actions, and the fields usab…
smartsuite_get_automation_limitsGet the workspace's automation run usage and plan limit (account-wide). Returns plan category (e.g. enterprise), the automation run limit, runs used, remaining, percent used, and whether the limit is enforced. Use this for "how much of our automation quota are we using?" and plan-type questions.
smartsuite_list_automation_credentialsList the integration credentials configured for a solution's automations (e.g. Gmail, Slack, Microsoft Teams, webhooks, SmartSuite). Returns each credential's id, integration, auth method, and label. Use this to review which external integrations a solution's automations connect to.
smartsuite_list_solution_membersList the members available to a solution (id, name, email, job title, status). These are the members automations can assign work to or run as. Also useful for resolving member ids seen in records, assignments, and credentials.
smartsuite_create_automationCreate an automation in a solution. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. You supply the trigger (an object with trigger_reference.trigger_id and inputs) and the actions; use smartsuite_describe_automation_step on a similar existing automation to learn the exact trig…
smartsuite_update_automationUpdate an existing automation. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Fetches the current automation and applies only the fields you provide — label, trigger, actionGroups/actions, automaticDescription, timezone — preserving the rest (including first_created and the u…
smartsuite_delete_automationDelete an automation. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true AND SMARTSUITE_ENABLE_DELETE=true. Without confirm:true it returns a preview of what would be deleted; pass confirm:true to permanently delete. Destructive — cannot be undone.
smartsuite_set_automation_ai_promptSet the dynamic prompt on an automation's AI ("AI Workflow Agent" / ai-custom-prompt) action. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE=true. Supply promptTemplate as plain text where `{{field_slug}}` inserts a live reference to a field (resolved against applicationId — the ta…
smartsuite_validate_automationCheck an automation for the errors SmartSuite shows inline in the automation list — most importantly "Trigger output with id <id> not found", which means an action still references a trigger output (a field) that no longer exists (the field was deleted or its slug changed), so the automation is brok…
smartsuite_list_my_workList the authenticated user's assigned work ("My Work") — comment mentions, assigned checklist items, and records assigned via people fields — for answering questions like "what's on my plate?", "how many open items are overdue?", or "what's assigned to me in this solution?". Returns a summary (tota…
smartsuite_update_my_workUpdate one of the authenticated user's My Work items: mark it resolved/open and/or set its due date. Requires readwrite or admin mode. Use smartsuite_list_my_work to find the item id. Returns the updated item.
smartsuite_get_smartdoc_contentRetrieve the content of a SmartDoc field as plain text and raw value.
smartsuite_get_file_urlsmartsuite_upload_fileUpload a file from the local filesystem to a SmartSuite file field. Requires readwrite or admin mode. The file is read from the local path and posted as multipart form data.
smartsuite_append_smartdoc_contentAppend markdown content to a SmartDoc field. Requires readwrite or admin mode. Does not replace existing content.
smartsuite_add_layout_sectionAdd a section (a labeled grouping) to an application's record-view layout. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE. A section groups the fields that follow it (until the next section) in the record detail view. By default edits the top-level layout; pass tabId to edit a spec…
smartsuite_update_layout_sectionUpdate an existing record-view layout section (title, description, collapsed, hidden) by its section__… slug. Requires schema-write. Pass description:"" to clear it. Dry-run preview unless confirm:true.
smartsuite_remove_layout_sectionRemove a section from an application's record-view layout by its section__… slug. Requires schema-write. Removes only the section grouping; fields that were under it are preserved (they just rejoin the surrounding layout). Dry-run preview unless confirm:true.
smartsuite_add_layout_tabAdd a tab to an application's record-view layout. Requires readwrite/admin mode AND SMARTSUITE_ENABLE_SCHEMA_WRITE. Enables tabs if not already on (the first tab mirrors the current top-level layout so existing fields stay visible; later tabs start empty). Optional description, position (0-based; de…
smartsuite_update_layout_tabUpdate a record-view tab (name, description, position) by its tab id, and/or the tab-bar style/align. Requires schema-write. Pass description:"" to clear it. Dry-run preview unless confirm:true.
smartsuite_remove_layout_tabRemove a tab from an application's record-view layout by its tab id. Requires schema-write. Fields remain in the top-level layout (not deleted). Removing the last tab disables tabs. Dry-run preview unless confirm:true.
smartsuite_move_layout_fieldMove/arrange a field in the record-view layout — reorder it, place it under a section, or move it to a different tab. Requires readwrite/admin + SMARTSUITE_ENABLE_SCHEMA_WRITE. To move a field to ANOTHER tab, pass toTab = the destination tab id: the field is removed from its current tab and added to…
smartsuite_update_applicationUpdate table (application) attributes — rename the table (name) and/or change its record term (e.g. "record" → "invoice"). Requires readwrite/admin + SMARTSUITE_ENABLE_SCHEMA_WRITE. Dry-run preview unless confirm:true. (This is the table rename tool; for field renames use smartsuite_update_field.)
smartsuite_set_field_visibilityHide or show a field in the record view. Requires readwrite/admin + SMARTSUITE_ENABLE_SCHEMA_WRITE. hidden:true hides the field (adds it to the layout's record-wide hidden_fields list); hidden:false shows it. Hidden fields stay in the layout structure but aren't displayed; this is record-wide (not p…
smartsuite_set_display_logicAdd, modify, or remove display (visibility) logic on a field, section, or tab — show it only when conditions on other fields are met. Requires readwrite/admin + SMARTSUITE_ENABLE_SCHEMA_WRITE. Set target ("field"|"section"|"tab") + targetId (field slug / section__ slug / tab id) and conditions: an a…
smartsuite_move_attachmentsMove attachments (files) from one file field to another. Requires readwrite/admin mode. Copies the source field's files into the target field (handles reference existing storage — no re-upload) and clears the source. Target one record with recordId, or every record that has source files with allReco…
smartsuite_match_solutionsStep 1 of solution migration: match solutions in a lower-environment workspace to those in your primary (production) workspace by exact name, since object ids differ across workspaces. Set your primary workspace to production (the migration target). Requires SMARTSUITE_ENABLE_CROSS_WORKSPACE. Withou…
smartsuite_match_applicationsStep 2 of solution migration: for one confirmed solution pair, match its tables (applications) by exact name (table ids AND slugs both regenerate across workspaces, so name is the only handle). Same confirm/overrides flow as match_solutions. Persists the lower→prod table-id map into the project.
smartsuite_diff_schemasStep 3 of solution migration: compare table/field schemas (lower → prod) for confirmed mappings and write the diff package. Fields match by slug (stable across cloned workspaces); cross-table references are remapped via the table map and system-generated values are ignored, so only real differences …
smartsuite_export_diffStep 4 of solution migration: render the project diff as a human-readable XLSX (summary tab + per-change detail) alongside the JSON. Run smartsuite_diff_schemas first. Returns the written file paths.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
All four hints declared on every tool
85/85 tools missing one or more hints — smartsuite_diagnostics (missing: destructiveHint, idempotentHint); smartsuite_list_workspaces (missing: destructiveHint, idempotentHint, openWorldHint); smartsuite_list_solutions (missing: destructiveHint, idempotentHint, openWorldHint), +82 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
41/85 tools referenced in tests (48%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
4 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.10.0 (high), @modelcontextprotocol/sdk@1.10.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/smartsuitefoundry/smartsuite-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check