Asana MCP Server: Setup, Tools and Auth

Asana runs its own hosted MCP server at https://mcp.asana.com/v2/mcp. An agent that connects can search tasks and projects, read status updates, create and update tasks in batches, comment and post project status updates. Sign-in is OAuth, and for coding agents you first register an MCP app and get a client ID and secret. We checked the docs on 31 October 2026.

Quick facts

Do not confuse this with community servers on GitHub. Asana's own page describes this one as "the official Asana MCP server". If you see a package called asana-mcp-server on npm, check who published it before you give it a token.

What it does

Asana says the server allows AI assistants "to access the Asana Work Graph". In practice you get natural-language access to the things you would click through: your tasks, projects, portfolios, goals, notifications and status reports. Asana's own example requests are good indicators of the intended use:

• "Find all my incomplete tasks due this week"
• "Create a new task in the Marketing project assigned to me"
• "List all sections in the Product Launch project"
• "Show me the status of the Q2 Planning project"

For a coding agent the most useful jobs are a little different. An agent finishing a feature can find the matching task, add a comment with the pull request link, mark it complete and post a status update. An agent planning a sprint can read a project and create tasks with subtasks and dependencies. Those need writes, so read the security section before you allow them.

The tools

Asana's reference page groups tools into read, write and interactive. It also warns that the list changes, and tells you to call tools/list in your client for current schemas. Treat the tables as a snapshot.

Read tools

Write tools

Interactive tools

create_task_preview, create_project_preview and search_tasks_preview show a draft or results in an interactive view, in clients that support interactive apps. Coding agents mostly will not. For clients that differ on features such as this, see MCP clients.

Batch behavior

Asana warns that task creation, task updates, project creation and project updates can partly succeed. Ask your agent to read the result and list failures before it retries, or it may repeat changes that already went through.

What it costs

We found no separate charge for MCP use on the pages we read. You pay for whatever Asana plan you already have. Two plan facts do show up:

• Asana's Enterprise+ and Legacy Enterprise tiers can allow or block MCP clients through app management, per client for V2.
• Other tiers have to ask Asana Support to block the beta V1 app, and the request must come from a super admin.

The MCP guide names no plan requirement. It says Enterprise+ and Legacy Enterprise customers can allow or block MCP clients through app management. The Command MCP server is different. It needs a Command license for each user, according to its docs.

Set it up

The V2 server does not support dynamic client registration, which is why a pre-registered app is needed. Asana's steps:

1. Open the developer console at app.asana.com/0/my-apps.
2. Create a new app and choose MCP app as the type.
3. In the OAuth section, add the redirect URL your client needs. It must match exactly.
4. In Manage distribution, allow the workspace where the app will run.
5. Copy the client ID and client secret.
6. Put them in environment variables, ASANA_CLIENT_ID and ASANA_CLIENT_SECRET, or in your client's secret store.

Redirect URLs by client, from Asana's guide:

Asana advises a separate set of credentials per developer, regular rotation, never committing them, and a secrets manager for sensitive environments.

If you only use Claude or ChatGPT as an end user, you can skip all that. Asana has an app in each, with setup in its Help Center, and the developer page links to both.

Install it in each agent

Asana documents Claude Code, Cursor, VS Code, Codex, Windsurf and Kiro. Antigravity and OpenCode are not on its list, so those lines are our adaptation.

Claude Code

From Asana's guide:

claude mcp add --transport http \
  --client-id YOUR_CLIENT_ID \
  --client-secret \
  --callback-port 8080 \
  asana https://mcp.asana.com/v2/mcp

Claude Code then prompts for the secret, stores it in the system keychain and opens your browser to approve. Asana says it "strongly recommends" Claude Code because it supports pre-configured OAuth credentials natively, with no third-party helper. The config files hold only the URL, transport and client ID, not the secret.

Cursor

From Asana's guide, in Cursor's MCP settings:

{
  "mcpServers": {
    "asana": {
      "url": "https://mcp.asana.com/v2/mcp",
      "auth": {
        "CLIENT_ID": "${env:ASANA_CLIENT_ID}",
        "CLIENT_SECRET": "${env:ASANA_CLIENT_SECRET}"
      }
    }
  }
}

Then click Connect next to the server in settings to start OAuth.

Codex

Asana's route uses the community mcp-remote proxy. Create a credentials file such as ~/.asana/mcp_oauth_client.json with client_id and client_secret, restrict it with chmod 600, then add this to ~/.codex/config.toml, with an absolute path:

[mcp_servers.asana]
command = "npx"
args = [
  "-y", "mcp-remote@latest",
  "https://mcp.asana.com/v2/mcp", "3334",
  "--static-oauth-client-info",
  "@/Users/YOU/.asana/mcp_oauth_client.json",
  "--resource", "https://mcp.asana.com/v2"
]

Asana calls mcp-remote experimental and unsupported by Asana, and says to review its source yourself. Codex's own MCP docs now support pre-registered OAuth clients for HTTP servers (codex mcp add <name> --url <url> --oauth-client-id <id>, plus --oauth-client-secret for confidential clients), so you can try that route before the proxy.

VS Code

Run MCP: Add Server from the Command Palette, choose HTTP, enter the URL and a name, then supply the client ID and secret when VS Code says the server has no dynamic registration. Asana flags that the copied localhost redirect may lack its trailing slash, so check it.

Antigravity

Our adaptation. Antigravity reads ~/.gemini/config/mcp_config.json with an mcpServers key and uses serverUrl for Streamable HTTP. For servers without dynamic registration, Antigravity's docs let you add clientId and an optional clientSecret in an oauth object and register https://antigravity.google/oauth-callback as the redirect URI. We did not test that against Asana. Gemini CLI is now Code Assist enterprise only, so we skip it.

OpenCode

Our adaptation. OpenCode's mcp key accepts a remote entry with url and an oauth block, so a starting point is:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "asana": {
      "type": "remote",
      "url": "https://mcp.asana.com/v2/mcp",
      "oauth": {
        "clientId": "{env:ASANA_CLIENT_ID}",
        "clientSecret": "{env:ASANA_CLIENT_SECRET}"
      }
    }
  }
}

OpenCode's docs list clientId, clientSecret and scope as the oauth fields, and opencode mcp auth asana starts the browser sign-in. See MCP clients for how these agents differ.

The Command MCP server

Asana also runs a second server, https://mcp.asana.com/v2/command/mcp, for Command by Asana. It handles Teamspaces, tickets and releases: search, create and update tickets, add comments, manage blocking dependencies and read release status. Each user needs a Command license and access to the Teamspace. It uses the same MCP app route and OAuth. We only cover it briefly because it is a separate product.

Security notes

• No scopes. Asana's reference states MCP apps do not use permission scopes. Authorizing a client requests full access to every tool, including delete_task. Your only fine-grained control is which workspace you pick and which apps your admin allows.
• Prompt injection. Task names, descriptions and comments can be written by other people. A hostile comment could try to steer your agent. Do not run an agent with write tools over untrusted projects without confirmation prompts.
• Deletes. Turn on approval prompts for delete_task and for batch updates in your agent's settings.
• Secrets. Keep the client secret in a keychain or secrets manager. Never commit it. Asana's guide says the same.
• Proxy risk. mcp-remote sits between your agent and Asana and handles tokens. Asana says it cannot support it.
• Workspace scope. One session is tied to one workspace. To work in another, authorize again.
• MCP tokens are MCP only. They do not work with the Asana REST API.
• Admin control. Enterprise+ admins can block individual clients through app management.

Limits and known issues

• Clients without OAuth pre-registration, such as Replit and JetBrains at the time of Asana's note, cannot use V2 yet and rely on V1 until it shuts down.
• The V1 beta server at /sse is deprecated. Asana writes the shutdown date as 05/11/2026 and does not say whether that is 5 November or 11 May, so check Asana's note before you rely on V1.
• The tool list changes. Use tools/list.
• Batch calls can partly succeed.
• "Client not found" errors: Asana suggests removing and re-adding the integration, or testing the V1 URL.
• Asana's MCP guide does not state rate limits for MCP calls.

Alternatives

Which agents it suits

Claude Code is the cleanest fit, because Asana designed the instructions around its native OAuth pre-registration. Cursor and VS Code also have native routes. Codex, Windsurf and Kiro go through mcp-remote in Asana's guide. Chat clients like Claude and ChatGPT have first-party Asana apps that skip the setup.

Our take

The official server is a sensible choice if Asana is your tracker. The tool set covers what an agent needs, and batch create and update with 50 tasks per call keeps the number of calls low. The weakness is access control. With no scopes, a connected agent can do anything you can, and Asana's own docs say so.

Setup is heavier than most hosted servers, because V2 needs a pre-registered app. That is a trade for better security and admin control, and Asana explains the reason. Expect ten minutes of console work the first time, and a rough edge or two on clients that rely on mcp-remote.

Our advice: start with Claude Code or Cursor, ask for read-only jobs first, and set your agent to ask before every write. This is our reading of the documentation, not a hands-on test.

A short setup checklist

1. Check app management in your workspace does not block the client.
2. Create an MCP app in the developer console and allow your workspace.
3. Add the exact redirect URL for your client.
4. Store the client ID and secret outside any repository.
5. Add the server with the command or config for your agent.
6. Authorize in the browser and ask for your tasks due this week.
7. Set approval prompts for writes and deletes.
8. Call tools/list to see what your version exposes.

More options are in the MCP server list and best MCP servers.

Frequently asked questions

What is the Asana MCP server URL?

https://mcp.asana.com/v2/mcp. The older beta at /sse is deprecated.

Is the Asana MCP server open source?

We found no public repository. Asana hosts it.

Do I need to create an Asana app?

For most coding agents, yes. V2 needs a pre-registered OAuth client ID and secret.

Can the agent delete tasks?

Yes, through delete_task. MCP apps have no permission scopes, so an authorized client gets all tools.

Can I use the MCP token with the Asana REST API?

No. MCP tokens work only with the MCP server.