Secure Miro access for AI agents
Boards, diagrams, docs, tables, images, and prototypes via Miro's official MCP server.
Miro boards are where plans, diagrams, and product thinking live — a natural surface for an agent to read a board, generate a diagram from a spec, or sync a table of work items. It is also a workspace full of unreleased plans and internal designs. Adding Miro here means every call runs through your policies and lands in the audit log, so you know which agent touched which board.
Server URL: https://mcp.miro.com/
Setup
- Navigate to Resources and click Add Resource.
- Select Miro from the catalog.
- Click the Per-org dynamic registration card. Miro is DCR-only, so this is the single option shown — and picking it installs the resource immediately.
No app needs creating on Miro's side, and no client ID or secret is required. Each user then authorizes their own Miro account the first time an agent calls a Miro tool; manage linked accounts in Connections.
Dynamic client registration
Miro's remote MCP server supports OAuth 2.0 dynamic client registration, so the gateway registers a fresh OAuth client per org during install. No scopes are requested at registration — each connection is bounded by the authorizing user's own Miro permissions.
See Credential modes for how this compares to the other modes catalog resources use.
Available tools
Miro exposes 33 tools spanning boards, board context, diagrams, tables, docs, images, comments, layouts, code widgets, and prototypes.
| Area | Tools |
|---|---|
| Identity | user_who_am_i |
| Boards | board_search_boards, board_list_items, board_create |
| Context | context_explore, context_get |
| Diagrams | diagram_get_dsl, diagram_create |
| Tables | table_create, table_list_rows, table_get_latest_update_history, table_sync_rows, table_update_view |
| Docs | doc_get, doc_update, doc_create |
| Images | image_get_url, image_get_data, image_get_upload_url, image_create |
| Comments | comment_list_comments, comment_create |
| Layouts | layout_get_dsl, layout_create, layout_read, layout_update |
| Code widgets | code_widget_create, code_widget_get, code_widget_update, code_widget_delete, code_widget_list_items |
| Prototypes | prototype_get_upload_url, prototype_create |
Policy examples
Read-only Miro for an agent
An allow rule by itself restricts nothing: every org is seeded with an Allow all rule, so anything your allow doesn't match simply falls through to it. Confining an agent takes a pair of rules:
- Create the deny rule first: effect Deny, MCP scope Miro, Agent scope your agent, tool pattern
*. - Then create the allow rule: effect Allow, MCP scope Miro, the same Agent scope, tool patterns
user_who_am_i,board_*,context_*,*_get,*_get_dsl,*_list_*,table_get_latest_update_history,image_get_*,layout_read.
The agent can explore boards and read content, but every create, update, sync, and delete falls through to the deny rule.
Block deletes everywhere
The only destructive tool Miro exposes is code_widget_delete. To take it off the table for every agent:
- In Access Policies, click Add Rule and name it "Miro: no deletes."
- Set the effect pill to Deny and the MCP scope pill to Miro.
- Add the tool pattern
*_delete. - Set the status to Active and click Create.