According to the U.S. Census, "Counties or equivalent entities form the geographic 'building blocks' for metropolitan and micropolitan statistical areas throughout the United States and Puerto Rico." Additionally, states are made up of counties; there are no multi-state counties. A step "under" counties, one finds "places"; places can straddle multiple counties, but not multiple states.
MSA to County Relationships are provided by the U.S. Census here, under the heading "Core based statistical areas (CBSAs), metropolitan divisions, and combined statistical areas (CSAs)".
County to Place Relationships are provided by the U.S. Census here. This includes ONLY census places, i.e. incorporated places and census-designated places (CDP). Many populated "places" are not included, which can lie outside of census places (e.g. a rural community) or inside (e.g. a neighbourhood of a city). I have not yet found a list of unincorporated/non-CDP places (and their counties and states).
Finally, to obtain MSA to place relationships, join the MSA to County Relationships file with the County to Place Relationships file on county, which can be done for example in Excel. Some places straddle multiple counties and some places can be homonyms across counties within states or across states. Counties can also be homonyms across states. Hence, an accurate representation of MSA to place relationships must also include relevant counties and states (all of which data is included in the above-mentioned files).