What Is MCP? A Guide for Salesforce Teams

If your Salesforce release notes, vendor emails and AI tools all mention "MCP" lately, you are not imagining it. MCP, the Model Context Protocol, is an open standard for connecting AI assistants to business systems, and Salesforce and Braze now publish their own MCP servers. This post explains what it is in plain English, what Salesforce and Braze offer today, where the risks are, and how to start.

What MCP is, and what it is not

MCP is an open protocol, built on JSON-RPC 2.0, that lets AI applications get context and take actions from external programs in a standard way. Think of it as an agreed plug shape: an assistant that speaks MCP can connect to a server that speaks MCP, subject to that server's sign-in and client rules.

MCP is not a model and not an LLM API. In the protocol's own words, it "focuses solely on the protocol for context exchange — it does not dictate how AI applications use LLMs or manage the provided context." Your choice of AI model and your choice of MCP servers are separate decisions.

Hosts, clients and servers

• Host: the AI application a person uses, such as a chat app, an IDE or an agent platform like Agentforce.
• Client: a connector the host creates, one per server.
• Server: the program that offers data and actions. It can run locally on a laptop (stdio) or remotely over the web (Streamable HTTP).

Tools, resources and prompts

A server offers three kinds of thing:

• Tools are actions the model can call, such as "find open cases for this account" or "create a draft journey". Each has a defined input format.
• Resources are pieces of data with an address, such as a document or a record summary, that the assistant can read for context.
• Prompts are reusable templates the user picks, such as "review this campaign".

Who runs MCP?

Anthropic donated MCP to the Agentic AI Foundation (AAIF), announced on 9 December 2025, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. Technical decisions still go through the project's maintainers and its enhancement proposal (SEP) process. The current revision of the spec is dated 2026-07-28.

What Salesforce offers today

Statuses below are as the vendor states them; check the linked documentation before planning.

• Salesforce Hosted MCP Servers: GA since 29 April 2026 for Enterprise Edition and above, documented as intended for customers with Flex Credits. Standard servers include SObject Reads (read and query only) and SObject All (full create, read, update, delete). They are disabled until an admin enables them, need an External Client App with the mcp_api scope, and run every call as the signed-in user with CRUD, field-level security and sharing enforced. You can also build custom servers from Apex, Flows and Prompt Builder templates.
• Headless 360 MCP Server: Beta, announced 14 July 2026.
• Salesforce DX MCP Server: open source and run locally with the Salesforce CLI. Maturity is tracked per tool; GA for the whole server is not confirmed.
• Marketing Cloud Engagement MCP Server: GA since 2 June 2026, with read and write tools for data extensions, journeys (created in Draft), automations and transactional sends.
• Data 360 MCP Server: Developer Preview from 6 May 2026, and described as generally available in a Salesforce news story of 19 August 2026. Hosted Data 360 calls count toward Connect API limits and Flex Credits.
• Agentforce as an MCP client: in beta since 15 January 2026, so agents can use external servers that admins register and allowlist. GA status is not confirmed.

What Braze offers today

Braze runs a remote MCP server (US and EU endpoints), described as generally available in a Braze article dated 23 July 2026. You sign in with your Braze dashboard login, and an admin must enable MCP OAuth access and grant the "Use MCP Server" permission, which is off by default. It has read tools across campaigns, Canvases, segments and KPIs, and some write tools; others, such as launching campaigns, are in beta. Tools that expose user-level personal data are not available. The older local Braze server is deprecated.

Salesforce has announced a definitive agreement to acquire Braze, subject to shareholder and regulatory approval and expected to close in Salesforce's fiscal 2028. Until then they are separate companies with separate MCP servers. More in what the Braze deal means.

The risks to plan for

• Too much access. A read-and-write server switched on for everyone is a large change to your security model. Start read-only and per-user.
• Actions without a human. Write tools should need confirmation. Braze advises against client "auto-mode".
• Untrusted content. A record or email can contain text written to mislead the assistant. Treat tool output as data, not instructions.
• Shadow servers. Local servers on laptops can reach production orgs. Keep an inventory.
• Costs and limits. Vendor API limits and credits still apply to every call.

Our MCP security and governance resource goes deeper.

Sensible first steps

1. Pick one read-only question people ask often, such as "summarise this account's open cases".
2. Check whether a vendor server already covers it, and what licence it needs.
3. Try it in a sandbox with a test user whose permissions match a real role.
4. Write down who may connect which assistant to which server.
5. Only then consider write tools, with confirmation and audit.

If you want to see MCP working without connecting your own systems, try the public, read-only GeekMidst MCP server, which serves this website's guides. For designs across Salesforce products, see MCP integrations and Salesforce MCP integration; these are proposed designs that we validate per org.

Sources

• https://modelcontextprotocol.io/docs/learn/architecture
• https://blog.modelcontextprotocol.io/posts/2025-12-09-mcp-joins-agentic-ai-foundation/
• https://developer.salesforce.com/blogs/2026/04/salesforce-hosted-mcp-servers-are-now-generally-available
• https://developer.salesforce.com/blogs/2026/06/the-mcp-server-for-marketing-cloud-engagement-is-now-ga
• https://www.braze.com/resources/articles/braze-mcp-server
• https://braze.com/docs/developer_guide/mcp_server/