MCP Integration Services
An honest overview of MCP integration: what the protocol is, which vendor servers exist and their status, and how we design governed connections.
The Model Context Protocol (MCP) is an open, JSON-RPC 2.0-based protocol that lets AI applications get context and actions from external programs in a standard way. Our MCP integration services help teams decide where MCP fits, evaluate the vendor servers that already exist, and design governed connections between AI clients and systems such as Salesforce, Marketing Cloud, Data 360, Braze, Tableau and MuleSoft. This page is the overview; each product has its own page below.
What MCP is, and what it is not
An MCP host is an AI application such as an IDE, a chat app or an agent platform. It creates one MCP client per MCP server, and each client keeps a dedicated connection to its server. A server runs locally (stdio) or remotely (Streamable HTTP) and exposes three primitives:
- Tools: functions the model can call, such as "find an account".
- Resources: data addressed by URIs that gives the model context.
- Prompts: reusable templates that the user chooses.
MCP is not a model and not an LLM API: it "focuses solely on the protocol for context exchange". The current revision is 2026-07-28 (stateless); 2025-11-25 and earlier use an initialize handshake, which the official TypeScript SDK client and the MCP Inspector still use by default. Since December 2025 MCP sits in the Agentic AI Foundation under the Linux Foundation. For a primer, read what MCP means for Salesforce teams.
When MCP beats direct API integration, and when it does not
MCP helps when people work through an AI client and need the same governed tools across assistants, or when a vendor already runs a server you can switch on. A direct API integration is usually better for system-to-system flows such as scheduled syncs or transactional sends, where a model choosing tools adds unwanted variability. See MCP vs direct API integration.
MCP or a direct API?
| Situation | Better fit | Why |
|---|---|---|
| A seller or service agent asks questions of CRM data in an AI client | MCP | The vendor server applies the user's own permissions |
| Nightly sync between Salesforce and a warehouse | Direct API or middleware | Deterministic, scheduled, high volume |
| A developer retrieves metadata and runs tests from an IDE | MCP (local server) | Tools act on an org the developer already authorised |
| An app triggers a transactional message | Direct API | No model should sit in that path |
| An agent combines CRM context with engagement metrics | MCP, possibly through a gateway | Several servers, one allowlist, one audit view |
Our reusable reference architecture
Every engagement starts from the same pattern, explained in MCP host, client and server architecture and MCP security and authorisation. This is a reference design; we validate the APIs, edition and permissions for each implementation.
Governed MCP connection: reference architecture
Reference architecture: a reusable pattern, not a live client integration
Select a component to see what it is responsible for and how data moves to and from it.
Components and data flows (text version)
| Component | Type | Responsibility |
|---|---|---|
| Business user or developerworks in an AI client | People | Asks questions in an AI client and confirms any write action. Their own vendor permissions bound what every tool can do. |
| MCP hostIDE, chat app or agent platform | AI and agents | Creates one MCP client per server, shows tool calls to the user and enforces the confirmation step before write tools run. |
| Authorization servervendor OAuth, per user | Identity, policy and governance | Issues tokens bound to one MCP server as the audience. For Salesforce the client is registered as an External Client App; for Braze, users sign in with their dashboard login. |
| MCP gateway or registryallowlists, policies, logs | Identity, policy and governance | Optional central layer that lists approved servers and tools, applies policies such as call limits, and keeps one audit view across vendors. |
| Salesforce Hosted MCPvendor-run, GA 29 Apr 2026 | Salesforce product | Salesforce-run servers. Standard servers are off until an admin enables them; custom servers expose chosen Flows, Named Queries and Apex. |
| Braze MCP servervendor-run, remote | Engagement platform | Braze-run remote server with read and write tools. Tools that expose user-level PII are not available. |
| Custom MCP adapterproposed, only for gaps | Integration layer | A GeekMidst-built server for gaps the vendor servers leave, such as one tool that combines systems. Proposed design only. |
| Salesforce orgCRUD, FLS and sharing enforced | Salesforce product | System of record for CRM data. CRUD, field-level security and sharing apply to every hosted MCP call. |
| Braze workspacenon-PII data via MCP | Engagement platform | Campaigns, Canvases, segments, catalogs and KPIs that the Braze server reads or changes under the user's dashboard permissions. |
| Other approved APIscalled by the adapter only | External or custom system | Any further system the adapter calls with narrow, server-side credentials. |
Data flows
- Business user or developer → MCP host: prompts and approvals. The user asks; for any write the host shows the exact change and waits for confirmation. No confirmation means no call.
- MCP host → Authorization server: OAuth with PKCE. The client gets a token for one specific server, sending the resource parameter. Tokens travel in the Authorization header, never in the query string.
- MCP host → MCP gateway or registry: MCP requests. JSON-RPC over Streamable HTTP. Without a gateway the client connects to each server directly with the same rules.
- MCP gateway or registry → Salesforce Hosted MCP: allowlisted tool calls. Only tools on the allowlist pass. A blocked call returns an error to the host rather than being retried elsewhere.
- MCP gateway or registry → Braze MCP server: allowlisted tool calls. Read tools first; write tools only after a confirmed approval.
- MCP gateway or registry → Custom MCP adapter: allowlisted tool calls. Used only where the design includes a custom adapter.
- Salesforce Hosted MCP → Salesforce org: runs as the user. Each call runs as the authenticated user; there are no anonymous service accounts and the audit trail names the user.
- Braze MCP server → Braze workspace: dashboard permissions. Calls are limited by the user's Braze permissions; campaign edits are attributed to the signed-in user.
- Custom MCP adapter → Other approved APIs: scoped API calls. Least-privilege credentials held server-side. Failures return a tool error with isError true, not partial data.
Vendor servers first
Vendor MCP servers belong to their vendors. Where an official vendor server exists, we evaluate it first: its status, tools, authentication, licensing and limits. We only propose a custom GeekMidst server or adapter for real gaps, such as a tighter tool allowlist than the vendor offers, an approval step before writes, or one tool that combines several systems. Those GeekMidst adapters are proposed designs, not existing products.
Product pages and vendor status
Statuses are copied from the vendors' sources as checked on 22 October 2026. Where no official source confirmed a status, we write "status not confirmed".
Vendor MCP servers and our pages
| Product | Vendor server and stated status | Our page |
|---|---|---|
| Salesforce CRM and Platform | Salesforce Hosted MCP Servers: GA 29 Apr 2026, Enterprise Edition and above | Salesforce MCP integration |
| Marketing Cloud Engagement | Marketing Cloud Engagement MCP Server: GA 2 Jun 2026 | Marketing Cloud MCP |
| Data 360 | Data 360 MCP Server: Developer Preview 6 May 2026; "generally available now" per Salesforce, 19 Aug 2026 | Data 360 MCP |
| Braze | Braze MCP server (remote): generally available per Braze, 23 Jul 2026 | Braze MCP integration |
| Agentforce as an MCP client | Beta from 15 Jan 2026; GA status not confirmed | Agentforce and MCP |
| Tableau | Tableau MCP, open source and hosted; hosted GA likely but not confirmed | Tableau MCP |
| MuleSoft | MCP Connector; MCP Bridge GA from 12 Aug 2026 | MuleSoft and MCP |
| Salesforce DX | DX MCP Server: maturity tracked per tool; whole-server GA not confirmed | Salesforce DevOps MCP |
| GM1X AMPscript Studio | No MCP connectivity today | AMPscript Studio proposal |
How status labels work on this site
- Vendor release stage: GA, beta, pilot or developer preview, exactly as the vendor states it. "Status not confirmed" means no official source confirmed it.
- GeekMidst catalogue status: Planned, In development, Implemented, Tested, Available or Deprecated. Vendor entries are listed separately, marked as not affiliated with GeekMidst; a listing is not an endorsement.
- Diagram badges: Reference architecture is a reusable pattern, Proposed design is not yet built, and Implemented is used only for our own website MCP server.
The live catalogue below is the data our MCP server returns from list_integrations.
MCP catalogue
Status shows what GeekMidst has verified, not what a vendor announces. Planned means designed but not built. Tested and Available require recorded test evidence. Updated from our records each time this page loads.
GeekMidst servers and adapters
Tested
GeekMidst website MCP server
- Product
- GeekMidst website (published guides and calculators)
- Transport
- Streamable HTTP
- Authentication
- None: public, read-only published content only
- Access
- Read-only
- Tested clients
- TypeScript SDK @modelcontextprotocol/sdk 1.32.1 (initialize handshake, 2025-11-25), TypeScript SDK @modelcontextprotocol/client 2.3.1 (legacy, auto and pinned 2026-07-28), Python SDK mcp 2.3.0 (auto), MCP Inspector CLI 2.12.0 (legacy, modern and auto)
- Last verified
- 22 Oct 2026
- Limitations
- Read-only. No SSE stream (plain JSON responses). No authentication, so it never serves private data. Does not connect to Salesforce, Braze or any client system.
Planned
Salesforce CRM adapter (proposed)
- Product
- Sales Cloud, Service Cloud, Salesforce Platform
- Transport
- Streamable HTTP
- Authentication
- OAuth 2.1 per user (planned); secrets held server-side
- Access
- Read-only
- Limitations
- Not built. Each implementation is designed for the client's org, edition and permissions.
Planned
Marketing Cloud developer adapter (proposed)
- Product
- Marketing Cloud Engagement
- Transport
- Streamable HTTP
- Authentication
- OAuth 2.1 per user (planned); secrets held server-side
- Access
- Read-only
- Limitations
- Not built.
Planned
Braze and Salesforce orchestration adapter (proposed)
- Product
- Braze with Salesforce CRM
- Transport
- Streamable HTTP
- Authentication
- OAuth 2.1 per user (planned); secrets held server-side
- Access
- Read-only
- Limitations
- Not built.
Planned
AMPscript Studio MCP connector (proposed)
- Product
- GM1X AMPscript Studio
- Transport
- Streamable HTTP
- Authentication
- OAuth 2.1 per user (planned); secrets held server-side
- Access
- Read-only
- Limitations
- Not built. AMPscript Studio has no MCP connectivity today.
Vendor and open-source MCP servers we work with
These belong to their vendors. Listing one is not a claim of partnership or endorsement; "Planned" means GeekMidst has not yet tested it.
Planned Salesforce
Salesforce Hosted MCP Servers
- Product
- Salesforce Platform (SObject All, Reads, Mutations, Deletes; custom servers)
- Vendor status
- Generally available since 29 Apr 2026 (Enterprise Edition and above, Flex Credit
- Authentication
- OAuth 2.0 with PKCE per user through an External Client App (mcp_api scope)
- Access
- Read and write (with confirmation)
- Limitations
- Standard servers cannot be modified; usage may be billed. Each call runs as the signed-in user with their permissions.
Planned Salesforce
Marketing Cloud Engagement MCP Server
- Product
- Marketing Cloud Engagement
- Vendor status
- Generally available since 2 Jun 2026
- Authentication
- User OAuth through an Installed Package API Integration (Public App)
- Access
- Read and write (with confirmation)
- Limitations
- Effective rights are the package scopes intersected with the user's permissions. Destructive tools are annotated. No official server for Marketing Cloud Next was found.
Planned Salesforce
Data 360 MCP Server
- Product
- Data 360
- Vendor status
- Generally available (Salesforce news, 19 Aug 2026); open-source local edition la
- Authentication
- OAuth (hosted server)
- Access
- Read and write (with confirmation)
- Limitations
- The older hosted Data 360 SQL server is read-only. Check which edition of the server a use case needs.
Planned Braze
Braze MCP Server
- Product
- Braze
- Vendor status
- Generally available (Braze, 23 Jul 2026); some write tools in beta
- Transport
- Streamable HTTP
- Authentication
- OAuth with the user's Braze login; admin enables MCP access and the "Use MCP Server" permission
- Access
- Read and write (with confirmation)
- Limitations
- Tools exposing user-level PII are not available. Canvas tools are read-only. The older local server is deprecated.
Planned Salesforce (open source)
Salesforce DX MCP Server
- Product
- Salesforce developer tooling (orgs, metadata, data, tests, code analysis)
- Vendor status
- Open source (Apache-2.0); tools labelled GA or non-GA individually; whole-server
- Transport
- Local (stdio)
- Authentication
- Orgs already authorised locally with the Salesforce CLI
- Access
- Read and write (with confirmation)
- Limitations
- Runs on the developer's machine. Use sandboxes and scratch orgs; require review before any deployment.
Planned MuleSoft (Salesforce)
MuleSoft MCP Connector and MCP Bridge
- Product
- MuleSoft Anypoint Platform and Agent Fabric
- Vendor status
- MCP Bridge generally available (12 Aug 2026); MCP Connector 1.7.x current; Platf
- Transport
- Streamable HTTP
- Authentication
- Depends on the API and policies; remote servers can register with OAuth 2.1 and PKCE in Agent Fabric
- Access
- Read and write (with confirmation)
- Limitations
- Governance through Omni Gateway policies. Capabilities depend on the APIs exposed.
Planned Tableau (Salesforce, open source)
Tableau MCP
- Product
- Tableau Cloud and Tableau Server
- Vendor status
- Open source; hosted Tableau MCP described as generally available on the Tableau
- Transport
- Streamable HTTP
- Authentication
- Personal access token (self-hosted) or OAuth 2.1 per user (hosted, Tableau Cloud)
- Access
- Read and write (with confirmation)
- Limitations
- Admins can exclude tool groups but cannot switch the hosted service off.
Planned Slack (Salesforce)
Slack MCP server
- Product
- Slack
- Vendor status
- Generally available (17 Feb 2026)
- Transport
- Streamable HTTP
- Authentication
- Confidential OAuth with user tokens; each client is an approved Slack app
- Access
- Read and write (with confirmation)
- Limitations
- IP allowlists and audit logs apply.
The one GeekMidst MCP server that exists today
This website runs a public, read-only MCP server at the /mcp endpoint on this website: Streamable HTTP with plain JSON responses, protocol versions 2026-07-28, 2025-11-25, 2025-06-18 and 2025-03-26, and tools such as search_site, get_page and list_integrations, all annotated read-only. It needs no authentication because it only serves published website content, and it is rate limited per address. It does not connect to Salesforce, Braze or any client system, and cannot change anything. Details and test evidence are on the GeekMidst MCP server project page.
How we shape a proposed tool catalogue
Each product page lists a proposed catalogue in the same shape. Read-only tools come first; write tools need human confirmation.
How we classify proposed tools
| Tool class | Example | Read/write | Approval needed |
|---|---|---|---|
| Lookup | Find a record the user can already see | Read | No |
| Summarise | Summarise a case history or campaign results | Read | No |
| Draft | Prepare an update or content without saving it | Read (returns a draft) | No, but a person reviews the output |
| Change | Update a record, edit a template, publish a segment | Write | Yes, a named person confirms |
| Destructive | Delete, stop or archive | Write | Yes, and usually not exposed at all |
Security, privacy and operations
- Authentication: a protected MCP server is an OAuth 2.1 resource server that must check each token was issued for it and must not pass other tokens along. Secrets stay server-side; never paste passwords or tokens into an AI chat.
- Least privilege and privacy: per-user OAuth where offered, narrow scopes, only the tools a use case needs, and a decision on which fields may reach a model. Check with your legal adviser on the rules that apply to you.
- Limits and licensing: we quote only what vendors state; otherwise check the vendor's limits, editions and credits.
- Audit and errors: log who called which tool and the outcome; return tool failures with
isError: trueso the model can correct its input. - Environments: sandbox first, tested with the MCP Inspector CLI and official SDKs. Our checklist is in MCP security and governance.
Related
MCP server development
Servers built only for real gaps
→MCP integration consulting
Vendor servers, permissions and governance
→MCP architecture guide
Hosts, clients, servers and trust boundaries
→GeekMidst MCP server
Our public, read-only server
→Enterprise AI integration
Where MCP sits among AI patterns
→Questions we hear
Does GeekMidst have an MCP server for Salesforce?
Is MCP a replacement for APIs?
Can an AI change our data through MCP?
Can we try the GeekMidst MCP server?
Sources
Plan your MCP integration
Tell us which AI clients and systems you want to connect. We can review the vendor servers, permissions and approvals with you before anything is built.
