Smartsheet's AWS-powered MCP server: AI meets enterprise data

Smartsheet has tackled a critical challenge in enterprise AI adoption: giving AI agents structured access to work management data. Their solution? A Model Context Protocol (MCP) server built on AWS that acts as a bridge between AI assistants and Smartsheet's platform. This isn't just a neat tech demo, it's already enabling AI to analyze projects, update tasks, and manage workspaces through natural language.

But the real story here isn't just what the server does; it's how Smartsheet built it to be secure, scalable, and smart about AI's unique demands.

Architecture: One server, many agents

Smartsheet made a crucial decision: one MCP layer serves both internal and external AI agents. This means their in-house AI and external assistants like Amazon Quick use the same infrastructure and optimizations. Build once, benefit everywhere.

The AWS backbone of this system is deceptively simple:

• AWS Fargate runs stateless server containers
• Kinesis and Apache Flink handle real-time data ingestion
• Bedrock and Neptune power LLM inference and knowledge graphs

This architecture isn't just about connecting dots. It's designed to minimize token usage, reduce hallucinations, and make LLMs play nice with enterprise data. Smartsheet claims this approach has saved over 3 billion tokens since launch, a significant efficiency gain.

Scaling for AI's bursty nature

AI traffic isn't like human traffic. It comes in intense bursts as agents work, then goes quiet. Smartsheet's scaling strategy on AWS Fargate uses target-tracking policies that consider both traffic spikes and sustained load. This ensures the system can handle an AI agent's rapid-fire requests without choking.

Deployment is equally critical. Smartsheet uses a layered approach:

1. Container images stored in Amazon ECR
2. ECS deployment circuit breakers to catch failures
3. Region-by-region rollout, starting small
4. Automated tests after each regional deployment
5. Canary tests every 15 minutes

This strategy means updates roll out smoothly, without disrupting active AI sessions or requiring constant human oversight.

Governance: The enterprise gatekeeper

For many enterprises, governance is the make-or-break factor for AI adoption. Smartsheet baked it into the foundation:

• Tiered access control at the organization level
• Built-in error handling and audit trails
• Tool annotations to guide AI behavior (e.g., read-only vs. destructive actions)

Every tool invocation is logged with rich context, feeding into a comprehensive observability stack. This isn't just about compliance, it's about understanding how AI agents actually behave in production.

Security: Defense in depth

Smartsheet didn't reinvent the wheel for security. The MCP server sits behind the same defenses as their production APIs:

• AWS WAF and Shield at the edge
• Private subnets in a VPC
• mTLS for service-to-service communication
• OAuth2 proxy to reject unauthenticated requests early

Crucially, the MCP server respects existing permissions. If a user can't access a sheet normally, neither can an AI agent on their behalf.

The real test: Adoption and impact

Smartsheet has built a technically impressive system. But the true measure of success will be widespread adoption and tangible productivity gains. Can AI agents truly compress weeks-long workflows into hours? Will enterprises trust AI to autonomously manage their projects?

The infrastructure is in place. Now it's up to Smartsheet's customers to put it to the test in the real world of enterprise work management.