Secure Miro access for AI agents
Boards, diagrams, docs, tables, images, and prototypes via Miro's official MCP server.
Miro boards are where plans, diagrams, and product thinking live – a natural surface for an agent to read a board, generate a diagram from a spec, or sync a table of work items. It is also a workspace full of unreleased plans and internal designs. Adding Miro here means every call runs through your policies and lands in the audit log, so you know which agent touched which board.
Server URL: https://mcp.miro.com/
Credential modes
Miro supports per-org dynamic registration only, so there is no app to create on Miro's side and no client ID or secret to enter. See Credential modes for how it compares with Use SecureAuth's app and Bring your own app.
Before you begin
- A Miro account that can reach the boards your agents need.
- Administrator access to your Agent Authority workspace, to add the resource.
Setup
- In the Agent Authority console, go to Resources and click Add Resource.
- Select Miro from the catalog.
- On Choose how to install Miro, click Per-org dynamic registration. Selecting it adds the resource right away with its tools pre-configured.
Dynamic client registration
When you add the resource, the gateway registers its own OAuth client with Miro – the credential that lets it sign users in. Miro's own team and board-level permissions still apply, so an agent can only reach what the person who signed in could already reach.
Verify the connection
The gateway syncs the Miro tools automatically. To check the connection end to end, ask your agent to run a request:
Who am I in MiroIf your Miro user details come back, the connection is working.
How users connect
Access is per user. Each additional user connects their own Miro account the first time their agent calls a Miro tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.
Available tools
Miro exposes 33 tools spanning boards, board context, diagrams, tables, docs, images, comments, layouts, code widgets, and prototypes.
| Area | Tools |
|---|---|
| Identity | user_who_am_i |
| Boards | board_search_boards, board_list_items, board_create |
| Context | context_explore, context_get |
| Diagrams | diagram_get_dsl, diagram_create |
| Tables | table_create, table_list_rows, table_get_latest_update_history, table_sync_rows, table_update_view |
| Docs | doc_get, doc_update, doc_create |
| Images | image_get_url, image_get_data, image_get_upload_url, image_create |
| Comments | comment_list_comments, comment_create |
| Layouts | layout_get_dsl, layout_create, layout_read, layout_update |
| Code widgets | code_widget_create, code_widget_get, code_widget_update, code_widget_delete, code_widget_list_items |
| Prototypes | prototype_get_upload_url, prototype_create |
Required scopes
The gateway does not request a fixed scope list for Miro. It registers the client without naming any scopes and records the ones Miro returns.
Policy examples
Read-only Miro for an agent
An allow rule by itself restricts nothing: every org is seeded with an Allow all rule, so anything your allow doesn't match simply falls through to it. Confining an agent takes a pair of rules:
- Create the deny rule first: effect Deny, MCP scope Miro, Agent scope your agent, tool pattern
*. - Then create the allow rule: effect Allow, MCP scope Miro, the same Agent scope, tool patterns
user_who_am_i,board_*,context_*,*_get,*_get_dsl,*_list_*,table_get_latest_update_history,image_get_*,layout_read.
The agent can explore boards and read content, but every create, update, sync, and delete falls through to the deny rule.
Block deletes everywhere
The only destructive tool Miro exposes is code_widget_delete. To take it off the table for every agent:
- In Access Policies, click Add Rule and name it "Miro: no deletes."
- Set the effect pill to Deny and the MCP scope pill to Miro.
- Add the tool pattern
*_delete. - Set the status to Active and click Create.
Next steps
- Create a policy – start from the read-only pattern in Policy examples above.
- Connections – manage the Miro accounts your users have linked.