Codacoda.ioCan an AI agent use Coda (coda.io)?
As of 6 Oct 2026, an AI agent gets into Coda on its own and does 70% of the core work.
Level 3 · Does the workAn agent gets in on its own and does half the core work or more.
- Find: Some docs for agents: An OpenAPI and an MCP server.
- Access: Sign-up in a browser.
- Use: 70% of the work.
- Pay: Card checkout.
- Leave: Nothing to cancel: Can't delete its account.
To reach L4 · Runs on its own: do 80% of the core work (now 70%).
What the levels meanDriven 6 Oct 20261 drive so farRules of 15 Oct 2026Claim this page
Written and checked by our agents from this drive's record. How we write.
Who gets in
- Agents on a serverGet in on their own.
- Signed agentsThe sign-up page opens.
- Agents in a person's browserNot measured yet.
Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from
What an agent can do in Coda (coda.io).
On its own
- Create documents, pages and tables and fill them with data
- Add calculations and clickable buttons to a table and use them
- Organize documents into folders, copy them, and share them with specific people
2 more
- Build and upload a small plug-in (Pack) for the product
- Clean up everything it created, with proof it was really gone
What it can't, and why
- Sign up or get an API key without a web browserthe sign-up form and the key page only exist in the browser, not as a documented API
- Publish a document to the public webthe product requires a one-time public profile that can only be created in the browser
- Delete its own accountthe identity check before deletion showed no form in our agent's browser
1 more
- Buy a paid plan on its ownonly a credit-card checkout page exists; no automated payment option
Can an AI agent sign up for Coda on its own?
Yes, in a browser, without a human. No sign-up API. Web form at coda.io/signup/password (email, first and last name, password); no CAPTCHA signals, went through in our agent's browser.
Does Coda (coda.io) have an MCP server, and can an agent connect to it?
Yes. Coda has an official MCP server. The server lists 37 tools and speaks the older 25 Nov 2025 MCP spec.
A new agent can get in on its own: in the drive of 6 Oct 2026, our agent signed up, verified and got its key without a person. Through the MCP server, 3 of our agent's 4 attempts worked.
What the drive found
APIOpenAPIMCP · officialCLISDK–llms.txt–Webhooks–SandboxHow does an AI agent get a Coda (coda.io) API key?
In the drive of 6 Oct 2026, our agent got its Coda API key in a browser, without a person. API token only from Account settings > API connections > Generate API token. MCP uses OAuth authorization_code + PKCE with a browser consent page; DCR works headless, no device flow, no CIMD.
Can an AI agent delete its Coda account?
Not on its own: blocked. Docs, folder and Pack deleted via API and MCP (read back 404). The account itself: no API; the web path (My Settings > account.grammarly.com > Delete Account) goes to a 'Verify that it's you' step on grammarly.com that rendered no form in our agent's browser, with an invisible reCAPTCHA Enterprise on the page. Account remains; API token revoked in the web UI.
Can an AI agent pay for Coda?
Card checkout.
- Card checkout
- Stripe card form card checkout
It has a free plan.
What would let agents pay on their own
- Accept x402 or MPP on your API. Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card.Step-by-step guide
- List your plans on Stripe Projects. Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev).Step-by-step guide
No 402, x402, MPP, UCP or billing API; x402./mpp./agents. subdomains do not resolve; no listing in x402 Bazaar or mpp.dev. Upgrade is a hosted checkout on superhuman.com (billing, seats, card details, Complete purchase), no trial. We stopped before payment details, so whether 3DS or another human step follows is unknown.
From the drive of 6 Oct 2026.
For the team behind Coda.
Where agents stop in Coda (coda.io) today, and the fixes that get them further, highest impact first.
Wall at delete
The fixes, highest impact first
- Let agents mint API tokens headlessStep-by-step guide
- Answer MCP server/discover on the 28 Jul 2026 spec
- Stop redirecting MCP calls with 307
3 more fixes
- Create maker profiles through the API
- Offer account deletion without a browser
- Publish llms.txt and markdown docs Step-by-step guide
- Claim it free and reply next to the result.
- A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
- Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Details
Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.
Already claimed it? Open it in your dashboard.
Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.
Embed the badge on your site
Behind the level.
The part scores and the measures behind them.
Part scores and the measures · paid plans
Part scores
Agent-ready setup
- llms.txt: not found
- OpenAPI: found
- MCP server: found
- CLI: found
Not measured in this drive: Holds up, Docs match (part of an Audit).
The measures
- Work done70
- Reliability100
- Crash test–
Needs a paid plan
Not counted in the level. Our drive used free plan.
| Capability | Plan |
|---|---|
| Customize a published doc's domain/branding | Pro |
| Configure SSO / enterprise security controls | Enterprise |
For agents and builders.
The drive as data, every checkpoint and all 49 attempts.
How an agent connects · 7 tips
/api/tools/coda.json/tools/coda.mdMCP get_tool {"slug":"coda"}
- Use the REST API at https://coda.io/apis/v1 for reads and row writes; the MCP server at https://coda.io/apis/mcp for structure (table_create, table_columns_manage, control_manage) the REST API lacks.
- Writes are async: expect 202 + requestId and allow 3-20 s before reading back; right after a create, GETs can return 409 'try again in a moment' or 404.
- MCP doc-scoped calls answer 307 to /apis/mcp/docs/{docId} with an empty body: re-POST (with a fresh initialize) to that URL.
- MCP wants canvas URIs (coda://docs/{doc}/canvases/canvas-...) for table_create, not the REST page id under pages/; column number type is 'num'.
- MCP OAuth access tokens expire after 300 s: refresh with the 60-day refresh token.
- Upserts are idempotent with keyColumns on POST .../rows.
- Page export downloads are gzip-compressed and the link expires in 300 s.
Every checkpoint, in detail · 9 checkpoints
- DocsHeadlessOpenAPI 3.0.0 (API 1.6.0, 91 paths) at coda.io/apis/v1/openapi.json and docs.superhuman.com; API reference pages are HTML. The help center (help.superhuman.com, where the MCP setup article lives) answered our signed agent with a Cloudflare challenge (403 cf-mitigated: challenge). No llms.txt, no markdown pages.
- Sign upIn a browserNo sign-up API. Web form at coda.io/signup/password (email, first and last name, password); no CAPTCHA signals, went through in our agent's browser.
- VerifyIn a browserVerification mail arrived within about a minute; its link (a plain GET) opened in the browser and led to onboarding.
- KeyIn a browserAPI token only from Account settings > API connections > Generate API token. MCP uses OAuth authorization_code + PKCE with a browser consent page; DCR works headless, no device flow, no CIMD.
- First callHeadlessGET /apis/v1/whoami with the token returned our user and workspace.
- First actionHeadlessPOST /docs created a doc (201), read back with GET /docs/{id}.
- PayIn a browserNo 402, x402, MPP, UCP or billing API; x402./mpp./agents. subdomains do not resolve; no listing in x402 Bazaar or mpp.dev. Upgrade is a hosted checkout on superhuman.com (billing, seats, card details, Complete purchase), no trial. We stopped before payment details, so whether 3DS or another human step follows is unknown.
- CancelNot neededNothing to cancel: our agent used the free plan.
- DeleteBlockedDocs, folder and Pack deleted via API and MCP (read back 404). The account itself: no API; the web path (My Settings > account.grammarly.com > Delete Account) goes to a 'Verify that it's you' step on grammarly.com that rendered no form in our agent's browser, with an invisible reCAPTCHA Enterprise on the page. Account remains; API token revoked in the web UI.
The attempt log · 49 attempts
| Capability | Route | Result | Evidence |
|---|---|---|---|
| robots/aipref: Read robots.txt and Content-Usage | api | done ✓ | coda.io/robots.txt 200: User-agent: * Disallow: /apis/ /embed/ /docs /d/; no Content-Usage or Content-signal lines; no Content-Usage header on coda.io/. docs.superhuman.com/robots.txt: User-agent: * Disallow: / |
| OpenAPI: Fetch OpenAPI | api | done ✓ | GET https://coda.io/apis/v1/openapi.json 200 application/json, openapi 3.0.0, info.version 1.6.0, title Superhuman Docs API, servers https://docs.superhuman.com/apis/v1, 91 paths / 125 operations; also openapi.yaml |
| llms.txt / markdown: Look for llms.txt and markdown docs | api | failed ✓ | coda.io/llms.txt 307 -> 404; docs.superhuman.com/llms.txt 404; docs page with Accept: text/markdown returns text/html, no Vary: Accept; /developers/apis/v1.md 307 not markdown |
| well-known cards: ai-catalog, agent-card, server-card, ucp, auth.md, SKILL.md | api | failed ✓ | /.well-known/ai-catalog.json, agent-card.json, agent.json, mcp/server-card.json, ucp: 404 HTML on coda.io and docs.superhuman.com; auth.md, SKILL.md: 307 to 404; <mcp>/server-card: 401 |
| MCP server/discover: POST server/discover on official MCP endpoints | mcp | partial ✓ | POST https://coda.io/apis/mcp and https://docs.superhuman.com/apis/mcp -> 401 application/json {statusCode:401,...}, WWW-Authenticate: Bearer realm="mcp", resource_metadata=".../.well-known/oauth-protected-resource/apis/mcp", scope="mcp:all" |
| MCP auth metadata: Read PRM and AS metadata | api | done ✓ | PRM coda.io: resource https://coda.io/apis/mcp, authorization_servers [https://coda.io]; PRM docs.superhuman.com: AS https://id.superhuman.com. AS metadata (coda.io and id.superhuman.com): authorization_code only, S256, registration_endpoint (DCR), no client_id_metadata_document_supported, no device_authorization_endpoint, no agent_auth |
| Sign up: Create account with email+password | browser | done ✓ | No sign-up API in OpenAPI (91 paths, none for accounts). Web form coda.io/signup/password (email, first, last name, password) -> "Verify your email" page; no CAPTCHA signals |
| Verify email: Open verification link | browser | done ✓ | Mail "Welcome! Please verify your email" from noreply@docs.superhuman.com arrived within ~1 min; link coda.io/signup/verify?token=... -> /firstsignin -> docs.superhuman.com/onboarding "Welcome, AgentDrives Test." |
| Get API token: Generate API token | browser | done ✓ | Account settings > API connections > Generate API token (name dialog, optional restriction) shows a UUID token; no API/CLI route to mint a token. MCP OAuth: authorization_code only (needs browser consent), DCR registration_endpoint, no device flow |
| First API call: GET /whoami | api | done ✓ | GET https://coda.io/apis/v1/whoami 200 {name: AgentDrives Test, tokenName: agentdrives-drive, workspace ws-9SQudjGrx9}; same on docs.superhuman.com/apis/v1 |
| Generate API keys/tokens for programmatic access: Mint a token and confirm it with /whoami | browser | done ✓ | token generated in account settings; GET /whoami returns tokenName agentdrives-drive |
| Create a doc: POST /docs titled AgentDrives Test Doc | api | done ✓ | POST /docs 201 id L6j-i5mUW-; GET /docs/L6j-i5mUW- returns name AgentDrives Test Doc |
| Build structured pages inside a doc: POST page with markdown canvas content (heading, list, bold) | api | done ✓ | POST /docs/L6j-i5mUW-/pages 202 id canvas-UQFZlN5RA9; /mutationStatus completed true; GET /pages lists Project plan; markdown export returns the same heading/list/bold |
| Check status of long-running API mutations: Poll mutationStatus for the page create | api | done ✓ | GET /mutationStatus/mutate:b6aef674-... {completed:false} then {completed:true} |
| Export a page content: Export page as markdown | api | done ✓ | POST .../pages/canvas-UQFZlN5RA9/export {outputFormat:markdown} 202 inProgress; GET .../export/{id} complete with S3 downloadLink (expires 300 s); download is gzip, decompressed markdown matches what we wrote |
| MCP version: server/discover with OAuth token, then initialize fallback | mcp | done ✓ | server/discover with MCP-Protocol-Version 2026-07-28 -> HTTP 400 JSON-RPC -32000 "Unsupported protocol version: 2026-07-28 (supported versions: 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05, 2024-10-07)"; initialize offering 2026-07-28 -> protocolVersion 2025-11-25, serverInfo coda-agent-mcp-server 16.0.3, SSE reply, Mcp-Session-Id; tools/list 37 tools |
| Create and manage tables/databases of rows: Create a Tasks table with 3 typed columns and 2 rows, read it back | mcp | done ✓ | MCP table_create (official Coda MCP, 2025-11-25) -> tableUri grid-ssK-URSluD, rowCount 2; REST GET /docs/L6j-i5mUW-/tables lists Tasks; GET .../columns shows Task text, Status text, Points number |
| Insert, update, and delete rows in a table: Insert a row, update a cell, delete a row, upsert by key column | api | done ✓ | POST .../rows 202 then GET rows shows Publish result/Open/5; PUT .../rows/i-0Mnr1nW1sO Status Done -> read back Done; DELETE .../rows/i--BybqttjmE -> row gone after ~10 s; POST same Task with keyColumns [Task] and Points 8 -> row updated to 8, no duplicate |
| Read rows and filter/sort a table data: List rows with column names, filter by query Task:"Review" | api | done ✓ | GET .../rows?useColumnNames=true&sortBy=natural&valueFormat=simple returns 2 rows; ?query=Task:"Review" returns only i--BybqttjmE; GET unknown row -> 404 "Could not find a row with the specified ID or name." |
| Inspect column schema/types for a table: List columns of Tasks | api | done ✓ | GET /docs/L6j-i5mUW-/tables/grid-ssK-URSluD/columns -> c-Yjcn0TYKZy Task text, c-HmowX2tSKR Status text, c-Was_NAQI_M Points number |
| Build formulas and buttons that act on data: Add a formula column and a button column (MCP), push the button (REST), add a named canvas formula and read it via REST | api | done ✓ | MCP table_columns_manage added Double points (Points * 2) and Mark done button (ModifyRows thisRow Status Done); REST rows show Double points 16; POST .../rows/i-eMOhY5bxZa/buttons/c-nywOcglosL 202 -> Status read back Done, mutationStatus completed true; MCP control_manage created formula TotalPoints; REST GET /formulas/f-9rBqptCY6k value 11; MCP formula_execute Tasks.Points.Sum = 11 |
| Inspect and use interactive controls in a doc: Create a button control on the canvas (MCP) and read it via REST /controls | api | done ✓ | MCP control_manage type button -> ctrl-ylLHWmaqRQ; REST GET /docs/L6j-i5mUW-/controls listed it after ~20 s (first read empty, GET by id 404 "Could not find a control"); GET /controls/ctrl-ylLHWmaqRQ controlType button |
| Organize docs into folders/workspaces: Create a folder and put a doc in it | api | done ✓ | GET /folders lists My docs; POST /folders 201 fl-dRx89XM32t; POST /docs with folderId -> GET /docs?folderId=fl-dRx89XM32t lists AgentDrives Copy |
| Copy an existing doc as a starting point: Copy the test doc with sourceDoc | api | done ✓ | POST /docs {sourceDoc:L6j-i5mUW-, folderId} 201 MM6E3gVlmR with sourceDoc set; GET /docs/MM6E3gVlmR/tables lists Tasks |
| Share a doc and manage collaborator permissions: Grant anyone-with-link read access, read it back, revoke it | api | done ✓ | POST /docs/L6j-i5mUW-/acl/permissions {access readonly, principal anyone, suppressEmail} 200 {}; GET /acl/permissions shows id 6643d18f... readonly anyone; DELETE /acl/permissions/6643d18f... 200; GET shows items [] |
| Search for people/groups to share a doc with: Search principals for "drive" | api | done ✓ | GET /docs/L6j-i5mUW-/acl/principals/search?query=drive -> users [AgentDrives Test the agent's inbox], groups [] |
| Configure a doc access-control (ACL) defaults: Turn off allowCopying and back on | api | done ✓ | PATCH /docs/L6j-i5mUW-/acl/settings {allowCopying:false} 200; GET /acl/settings shows allowCopying false; PATCH back to true |
| Publish a doc to a public, shareable website: PUT /docs/{id}/publish with a slug | api | failed ✓ | PUT /docs/L6j-i5mUW-/publish {slugName, discoverable false, mode view} -> 400 {"statusCode":400,"statusMessage":"Bad Request","message":"Please create a maker profile before publishing a doc."} |
| Publish a doc to a public, shareable website: Find how to create the maker profile the API asks for | browser | blocked ✓ | No API route for a maker profile in the OpenAPI; doc Share > globe opens "Share to web" with "Create profile" (public profile docs.superhuman.com/@agentdrives-test) |
| Get discovered via search engines and the public Gallery: List gallery categories | api | partial ✓ | GET /categories 200 lists Coda AI, Personal, Project management, ... |
| View stats (views, copies, likes) for a published doc: Read doc analytics | api | partial ✓ | GET /analytics/docs 200 {items:[]}; GET /analytics/docs/summary 200 {totalSessions:0} |
| Resolve a Coda browser link to a resource: Resolve the table browser link | api | done ✓ | GET /resolveBrowserLink?url=https://docs.superhuman.com/d/_dL6j-i5mUW-#_tugrid-ssK-URSluD -> resource type table id grid-ssK-URSluD name Tasks |
| Generate content/tables with AI assistant: Have an agent build a structured table and page from a description over the Coda MCP | mcp | done ✓ | MCP table_create / table_columns_manage / control_manage built the Tasks table with typed, formula and button columns and a TotalPoints formula on the Project plan page; read back via REST tables/columns/formulas |
| Build custom Packs/integrations in Pack Studio: Create a Pack and upload a version with a Greet formula | cli | done ✓ | POST /packs {name} 200 {packId:70269}; official @codahq/packs-sdk CLI `coda upload pack.ts` (API token in .coda.json) -> Done; GET /packs/70269/versions lists packVersion 1, buildNotes AgentDrives test |
| Connect third-party tools via Packs: Install a Pack into a doc headless | none | skipped | OpenAPI has pack listing/admin routes (/packs, /packs/listings) but no route to install a Pack into a doc; MCP tools/list (37 tools) has none either |
| Chat with Coda AI inside a doc: Ask Docs AI the total points in the Tasks table | browser | done ✓ | Docs AI (Beta) side panel: prompt "How many points are in the Tasks table in total?" -> "Reading table - Done", answer 11 (3 + 8 = 11), matches REST formula TotalPoints value 11 |
| Automate recurring/triggered actions in a doc: Create or trigger an automation headless | none | skipped | OpenAPI has POST /docs/{docId}/hooks/automation/{ruleId} to trigger a webhook-triggered rule, but no route to create a rule; MCP tools/list has no automation tool |
| Buy a plan the agent way: Probe 402 rails, discovery and the checkout without paying | browser | partial ✓ | No 402 anywhere: unauthenticated GET /apis/v1/docs -> 401 JSON; x402./mpp./agents. on coda.io and superhuman.com do not resolve; /.well-known/ucp 404; no x-payment-info in OpenAPI; x402 Bazaar and mpp.dev list no coda/superhuman service; no billing routes in OpenAPI or MCP tools. Pricing coda.io/pricing -> superhuman.com/plans/docs: Free EUR 0, Pro EUR 12/15, Business EUR 33/40, Enterprise contact sales. Get Superhuman Pro -> superhuman.com/upgrade/docs/pro: choose billing, seats, "Enter your payment details / Credit or debit card" (Gr4vy secure fields, Stripe/Google Pay frames), Complete purchase; no trial offered |
| Delete created data: Delete the docs, folder and Pack we made | api | done ✓ | DELETE /docs/MM6E3gVlmR 202; MCP document_delete coda://docs/L6j-i5mUW- ok; DELETE /packs/70269 200; DELETE /folders/fl-dRx89XM32t 200; GET /docs/{both} 404 "Doc has been deleted.", GET /packs/70269 404, GET /folders/fl-dRx89XM32t 403, GET /docs items [] |
| Delete the account: Delete the Superhuman account | browser | blocked ✓ | No account-delete route in the OpenAPI or MCP tools. Docs account settings has no delete; profile menu My Settings -> account.grammarly.com/profile "Delete Account" -> www.grammarly.com/signin?popup=deleteAccount&secureLogin=true shows "Verify that it is you" with a reCAPTCHA Enterprise anchor frame and no input or button, unchanged after ~30 s |
| Customize a published doc domain/branding: Check plan for custom domains | none | plan_gated | superhuman.com/plans/docs: Pro (EUR 12/month annual) lists "Custom icons, branding, domains"; Free does not |
| View analytics on an installed Pack usage/formulas: Read Pack analytics | api | partial ✓ | GET /analytics/packs?limit=3 200 {items:[]} on the Free plan |
| Configure SSO / enterprise security controls: Check plan | none | plan_gated | superhuman.com/plans/docs: SAML SSO and SCIM listed under Enterprise (Contact sales) |
| Upgrade/change subscription plan and billing: Find how to upgrade without paying | browser | partial ✓ | superhuman.com/upgrade/docs/pro: billing choice, seats, card fields, Complete purchase; no billing API or MCP tool |
| Run AI at scale over rows via an AI column: Add an AI column | none | skipped | no API or MCP route for AI columns (MCP table_columns_manage format types: none, num, button, canvas, ... no AI type) |
| Use templates to start a doc/team hub: Start from a template | none | skipped | no template route in the OpenAPI; POST /docs sourceDoc copies a doc we can read |
| Manage workspace members, roles, and domains (admin): n/a | none | skipped | no admin routes used; would invite real people |
| Cancel the plan: Find how a plan is cancelled | none | skipped | no plan started (Free). Checkout text: "You can cancel anytime on your Subscription page"; account.grammarly.com has a Subscription tab; no billing API or MCP tool |
| Revoke the API token: Revoke our API token | browser | done ✓ | Account settings > API connections > token menu > Revoke; GET /whoami with the token -> 401 Unauthorized |
Also in Docs and workspace.
CraftL3Gets in on its ownCoda vs Craft
NotionL1Can't sign up on its ownCoda vs Notion