Secure Asana access for AI agents

Through Asana, agents can search and read tasks, projects, portfolios, status updates, and workspace members, and create or update them when you allow it — every call runs through your policies and is logged for audit.

Server URL: https://mcp.asana.com/v2/mcp

Setup

Navigate to Resources and click Add Resource
Select Asana from the catalog
Provide your Asana OAuth app credentials (see Bring your own app)
Click Add

Each user connects their own Asana account via OAuth when they first use an Asana tool; there is no shared service account. Sign-in goes through your SSO when configured, and Asana's own permissions bound what each user can reach. Navigate to Connections to manage linked accounts.

Credential modes

Asana supports one mode:

Bring your own app: an Asana OAuth app owned by your organization, registered in the Asana developer console. Asana does not support dynamic client registration, so an app registered in your Asana account is required.

See Credential modes for the full comparison.

Bring your own app

An Asana admin registers an OAuth app in the Asana developer console, then returns to SecureAuth with the Client ID and Client Secret.

In the Agent Authority console, go to Resources → Add Resource → Asana → Bring your own app and copy the redirect URI shown on the page.

In the Asana developer console, create an app, then open the OAuth section:

Under Redirect URLs, add the redirect URI you copied; it must use HTTPS
Copy the Client ID and Client Secret from the app's basic information

Paste both back into the Asana resource page in the Agent Authority console, then click Add.

Asana issues user-level tokens, so each user authorizes with their own Asana account and only reaches the workspaces and objects their Asana membership allows.

Available tools

Tool	Description
`get_me`	Get the current authenticated user's details
`get_user`	Get user details by ID, email, or "me"
`get_users`	List users, optionally filtered by team
`get_teams`	List teams in the workspace
`search_objects`	Quick search across Asana objects (tasks, projects, portfolios, etc.)
`search_tasks`	Advanced task search with full-text and complex filters (Premium)
`search_tasks_preview`	Task search that renders a visual preview of the results
`get_task`	Get full task details by ID
`get_tasks`	List tasks filtered by workspace, project, tag, section, or user list
`get_my_tasks`	Get the current user's assigned tasks
`create_tasks`	Create one or more tasks
`create_task_preview_v4`	Preview a single task and confirm before creating it
`update_tasks`	Update one or more tasks
`delete_task`	Delete a task
`add_comment`	Add a comment to a task
`get_attachments`	List attachments for a project, project brief, or task
`get_project`	Get detailed project data
`get_projects`	List projects in a workspace
`create_project`	Create a project, optionally with sections and tasks
`create_project_preview_v3`	Preview a project structure before creating it
`create_project_status_update`	Post a status update to a project or portfolio
`get_status_overview`	Get status overview and progress reports for initiatives/projects
`get_portfolios`	List portfolios owned by the current user
`get_portfolio`	Get detailed portfolio data by ID
`get_items_for_portfolio`	List projects, goals, and other items in a portfolio
`get_workspace_agents`	List the AI Teammate agents configured in a workspace
`get_agent`	Get the full record for a single AI Teammate agent

Required scopes

Asana OAuth apps issue a user-level token with the default scope, which grants full user-level API access bounded by each user's Asana permissions. No additional scopes need to be configured.

Asana write access is controlled with gateway policies rather than narrower OAuth scopes; see the examples below.

Policy examples

Every org is created with a seeded Allow all rule at the bottom of the list, so any call your own rules don't match stays allowed. Express restrictions as deny rules above it — new rules are added at the top, so a fresh deny outranks it automatically. See Rule order.

Read-only access: deny create_*, update_*, delete_*, and add_comment. The wildcards matter — they also catch create_task_preview_v4 and create_project_preview_v3, the preview-then-create flows that naming the tools individually would miss.
Task work without project administration: deny create_project, create_project_preview_v3, and delete_task, leaving the task reads, add_comment, and task creation allowed.
Block destructive changes: deny delete_task

Next steps

Create a policy — start from the read-only pattern in Policy examples above.
Credential modes — see why Asana requires bringing your own app.