Secure Wrike access for AI agents
Tasks, projects, folders, and spaces via Wrike's official MCP server
Through Wrike, agents can search and read tasks, projects, and folders, and create or update them when you allow it – every call runs through your policies and is logged for audit.
Server URL: https://mcp.wrike.com/app/mcp/stream
Credential modes
Wrike supports bring your own app only. It does not support dynamic client registration, so your organization registers its own OAuth app in the Wrike App Console and supplies the client ID and secret. See Credential modes for how the modes compare.
Before you begin
- A Wrike account that can create API applications in the Wrike App Console.
- Administrator access to your Agent Authority workspace, to add the resource.
Setup moves between two consoles. You copy a redirect URI in the Agent Authority console, register an OAuth app in Wrike, then return to the console and paste the credentials. Keep both tabs open as you work.
Setup
1. Copy the redirect URI
In the Agent Authority console, go to Resources → Add Resource and select Wrike. Wrike is bring-your-own-app only, so the credentials form opens as soon as you select it, with no mode to pick.
Copy the Redirect URI shown on the form. It includes your tenant's region, so copy it rather than typing it. It takes the form https://oauth.aisecurity.services.<region>.connect.secureauth.com/auth/callback.
Leave this page open. You come back to it in step 3.
2. Register an OAuth app in Wrike
Open the Wrike App Console and go to its API section. Wrike calls the object you create here an API application.
- Click + App and enter a name, for example
<your-company> Agent Authority. - Under Redirect URLs, add the Redirect URI from the form in the Agent Authority console, using the Copy button next to it. It must use HTTPS.
- Copy the Client ID and Client Secret.
3. Finish in the console
Back on the Wrike form in the Agent Authority console, paste the Client ID and Client Secret. Leave Token Endpoint Authentication on Auto-detect. Then click Add.
The gateway sends you to Wrike to sign in, through your SSO if configured, and authorize the app. Review the requested access and click Allow. You return to the console with your Wrike account connected.
Verify the connection
The gateway syncs the Wrike tools automatically. To check the connection end to end, ask your agent to run a request:
List my Wrike tasksIf your tasks come back, the connection is working.
How users connect
Access is per user. Each additional user connects their own Wrike account the first time their agent calls a Wrike tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.
Sign-in goes through your SSO when configured, and Wrike's own role-based access controls what each user can reach. Wrike stores account data in regional data centers, and users on EU-hosted accounts (app-eu.wrike.com) sign in to their own Wrike region during authorization. No per-region configuration is needed.
Available tools
| Tool | Description |
|---|---|
wrike_get_tasks | Get complete information about one or more tasks by exact IDs |
wrike_search_tasks | Search tasks with filters across the whole account, a folder, a project, or a space |
wrike_create_task | Create a Wrike task in a folder |
wrike_update_task | Update a Wrike task by exact ID |
wrike_batch_update_tasks | Update up to 100 Wrike tasks at once, including custom fields, assignments, and subtask relationships |
wrike_get_task_comments | Get task comments by exact task ID |
wrike_get_folder_project | Get complete information about one or more folders or projects by exact IDs |
wrike_search_folder_project | Search folders and projects with filtering and response shaping |
wrike_create_folder_project | Create a folder or project |
wrike_update_folder_project | Update a project or folder |
wrike_get_spaces | Get the available spaces |
wrike_get_contacts | Get contacts from Wrike |
wrike_get_my_contact_id | Get the current user's contact ID |
wrike_get_approvals | Get approvals by filter |
wrike_get_custom_fields | Get complete information about custom fields |
wrike_search_custom_types | Search custom item types with filters |
wrike_get_workflows | Get workflows with custom statuses |
wrike_convert_numeric_id | Convert a numeric ID to a Wrike ID |
Required scopes
Wrike grants this app its Default permission set: full user-level API access, bounded by each user's own Wrike role. You do not select scopes when you register the app, and the Wrike resource page has no scope setting.
Narrow what agents can do with gateway policies instead. See the examples below.
Policy examples
Every org is created with a seeded Allow all rule at the bottom of the list, so any call your own rules don't match stays allowed. Express restrictions as deny rules above it – new rules are added at the top, so a fresh deny outranks it automatically. See Rule order.
- Read-only access: deny
wrike_create_task,wrike_update_task,wrike_batch_update_tasks,wrike_create_folder_project, andwrike_update_folder_project– every write Wrike exposes - Task work without account metadata: allow
wrike_search_tasks,wrike_get_tasks, andwrike_get_task_comments, denywrike_get_contacts - Block bulk changes: deny
wrike_batch_update_tasks
Next steps
- Create a policy – start from the read-only pattern in Policy examples above.
- Connections – manage the Wrike accounts your users have linked.