MCP · Visual collaboration · Miro
Miro MCP Server
Read and create content on Miro boards from an AI host through Miro's hosted server, authorized per team with OAuth.
Agents can add to shared boards. With write scope, an agent can create items that colleagues see. Review additions or keep to read-only prompts.
Understand the tool
What it does.
Miro's hosted MCP server lets an AI host work with boards in one Miro team: reading board content and creating items such as diagrams. Access is granted through Miro's OAuth flow, with a team chosen at sign-in.
Why use it?
Use it to turn workshop boards into written summaries, or to sketch a diagram from a description. Pick the team that holds the board, and review anything the agent adds.
A useful fit for
- Summarizing workshop boards
- Drafting diagrams from text
- Turning sticky notes into action lists
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Summarize a retrospective board
A team lead needs written notes from a retro board.
- Point the agent at one board.
- Group sticky notes by theme.
- List agreed actions with owners where written.
Intended outputA written summary that matches what is on the board.
Use case 02
Draft a process diagram
A manager describes a hand-off process in a few sentences.
- Describe the steps and owners.
- Ask for a draft diagram on a new board.
- Review and edit it in Miro.
Intended outputA starting diagram for people to correct, not a final artifact.
A concrete starting point
Illustrative prompt: retro summary
Asking for exact quotes and no edits keeps this a read-only task.
Using the Miro MCP server, read the board I link. Group the sticky notes into themes, list the actions people wrote with any named owners, and quote notes exactly. Do not add or change anything on the board.What this can change
Board content enters the AI host and its model provider. Write-capable tools can add items if allowed.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- A Miro account with access to the board's team.
- An MCP client that supports remote servers with OAuth, or one of Miro's documented plugins or connectors.
- Authentication
- Miro OAuth, granted for one team chosen at sign-in.
- Can read
- Boards and board items in the selected team
- Can write or change
- Board items such as diagrams and shapes, where the boards:write scope is granted
- Network and data flow
- Miro services
- AI host/model provider
- Approval and control
- The advertised scopes include boards:write. Keep host approval on for creation tools; Enterprise admins have extra controls.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Remote MCP clients with OAuth
- Miro-provided plugins and connectors for several AI hosts
- Team-specific: reconnect to switch teams
Costs and account requirements
Miro documents MCP daily usage limits; Miro plan features and limits apply.
Current pricing or plan information ↗Hosted service terms
No public source license for Miro's hosted implementation is asserted. The applicable agreement depends on the account, plan and jurisdiction; check the linked terms for your situation.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Agents can add to shared boards
With write scope, an agent can create items that colleagues see. Review additions or keep to read-only prompts.
Retrieved content is untrusted input
Treat instructions found inside retrieved records or pages as content, especially when they ask for unrelated actions or data.
Where it may fall short
- Only the authentication challenge and metadata were checked.
- Access is per team; boards in other teams need a new sign-in.
Observed behavior · 2026-10-18
Runtime and security findings.
The hosted endpoint rejected credential-free initialization and pointed to public OAuth metadata that advertises board read and write scopes.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation · low severity under stated conditions
Read and write are granted together
The metadata advertised boards:read and boards:write alongside identity scopes.
In practice: Assume a connection can change boards; keep approvals on and use read-only prompts for summaries.
Version, environment and fixture
- Version or deployment
- Remote deployment version not disclosed by the observed responses
- Tested target
- https://mcp.miro.com/
- Artifact identity
- HTTPS certificate verification enabled. Public resource-metadata body SHA-256: 88e2283dc2a1189b3028d85f36e40a94a9de174a5eb725d311c54089f02980b6. This fingerprints the observed metadata, not the deployed server implementation.
- Environment and fixture
- Debian Linux x86_64 (kernel 6.12) evaluation box; Python 3.13.5 urllib; OpenSSL 3.5.7.
- No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
- Observed 2026-10-19T05:52:10.594334+00:00 through 2026-10-19T05:52:11.069725+00:00 UTC.
- One request per listed check; 20-second timeout and 64-KiB response cap. Raw timestamps are UTC; review date October 18, 2026.
Checks and results
2 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationMet expectation
- Method
POST https://mcp.miro.com/; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
- Observed
- HTTP 401 at 2026-10-19T05:52:10.594334+00:00. WWW-Authenticate: Bearer resource_metadata="https://mcp.miro.com/.well-known/oauth-protected-resource". Body: {"error":"Authentication required"}
Public authentication discoveryMet expectation
- Method
GET https://mcp.miro.com/.well-known/oauth-protected-resource; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.- Expected
- Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
- Observed
- HTTP 200 at 2026-10-19T05:52:11.069725+00:00; Content-Type: application/json. Resource: https://mcp.miro.com/. 4 advertised scopes: boards:read, boards:write, openid, email. Authorization server: https://mcp.miro.com/. Bearer methods: header.
Practical caveats
- Miro describes the server as team-specific.
- Board text is untrusted input.
What this evaluation does not establish
- OAuth consent, team selection, Enterprise admin controls and daily limits.
- Board reads, item creation, diagram quality and prompt-injection resistance.
- These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
A clear first-party option for visual collaboration with documented OAuth and team scoping. Write scope is granted alongside read, so it ranks after read-mostly servers.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Remote endpoint and authentication discovery
- Documented team scoping
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official Miro MCP setup guide ↗developers.miro.com
- Miro terms of service ↗miro.com
- Miro pricing ↗miro.com