Marketo Engage MCP Server

Model Context Protocol (MCP) is an open standard that connects AI tools to external services. The Marketo MCP server connects your AI assistant to Marketo. It supports operations across asset management, lead data, and campaign automation. See Supported MCP operations for exceptions and availability requirements.

When your AI tool calls the MCP server, the server uses the credentials in that request to execute the corresponding REST API call. You do not need to install, deploy, or run server-side software.

For more information on how data is handled with Marketo AI and the Marketo Engage MCP server, see the Data Information page.

IMPORTANT
The Model Context Protocol (MCP) is an emerging open-source standard and may present security or reliability risks. Adobe MCP server integrations and related documentation are provided “as is,” without warranties of any kind.
Connecting MCP clients or servers to Adobe products is a customer-elected configuration, and customers are responsible for evaluating the security and suitability of any MCP integration. Adobe is not responsible for issues arising from misconfiguration, misuse of the MCP, vulnerabilities in third-party implementations, or unintended actions performed through MCP-enabled workflows.
To reduce risk, Adobe encourages testing integrations in a sandbox environment prior to productive use and carefully reviewing and validating all MCP-initiated actions and responses before confirming or relying on them.

MCP basics

Think of MCP like a USB-C port for AI applications. USB-C provides a standardized way to connect your devices to various peripherals and accessories, and MCP provides a standardized way to connect AI models to data sources and tools. — Model Context Protocol

MCP allows an AI tool to connect to multiple external services simultaneously. For example, an AI assistant can:

  • Connect to a word processor for AI-assisted document generation
  • Connect to animation tools, such as Blender, for build visualizations
  • Connect to Adobe After Effects for video editing

Any application can implement MCP to expose data and actions to AI tools.

What Marketo Engage MCP does and does not do

Understanding the scope of MCP helps set expectations before you connect your AI tool.

MCP does:

  • Provide access to Marketo data and capabilities through standard REST APIs
  • Execute API calls on your behalf using credentials you supply with each request
  • Support multiple simultaneous users, each connected with their own credentials
  • Handle OAuth token refresh automatically. You do not need to manage token expiration
  • Operate within tenant-isolated environments so your data never intersects with another user’s session

MCP does not:

  • Use, host, or run any AI or machine learning models. All AI processing happens in your AI tool, not in the MCP
  • Train on or learn from any data, including your customer data
  • Generate predictions, recommendations, or decisions. Decision-making is the responsibility of the downstream AI tool or user
  • Store or retain credentials, request data, or session state between requests
  • Require you to install, deploy, or manage any server-side software

MCP may transmit data, including potentially sensitive fields, depending on API usage but B2B data involves customer business data and does not involve PII data.

Prerequisites

  • A Marketo instance with REST API access enabled
  • Admin access to create API credentials in Marketo LaunchPoint
  • Network access to the MCP server URL: https://marketo-mcp.adobe.io/mcp

Get Marketo credentials

You need the following values from your Marketo instance:

  • Client ID
  • Client Secret
  • Munchkin Account ID

If you already have them, skip to Configure your AI tool.

Client ID and Client Secret

  1. Go to Admin > LaunchPoint.
  2. Select your API service. If you do not have one, select New > New Service, choose Custom as the service type, and assign a dedicated API user.
  3. Select View Details and copy the Client ID and Client Secret values.

Munchkin Account ID

  1. Go to Admin > Munchkin.
  2. Copy the Munchkin Account ID. The format is XXX-XXX-XXX and matches the prefix of your instance URL.

Configure your AI tool

Configurations differ slightly depending on the tool. This section provides connection examples for common tools.

TIP
To connect to multiple Marketo instances, add separate entries in your MCP configuration with unique names: marketo-prod and marketo-staging, each with the corresponding credentials.
Claude Desktop

Claude Desktop claude-desktop

To connect to Claude Desktop, download marketo-mcp-bridge.zip and unpack it. Put marketo-mcp-bridge.mjs into a known location and use its absolute path in the configuration below.

You also need a supported LTS version of Node.js installed on your computer. The bridge does not require additional npm packages.

  1. Open Claude Desktop.
  2. Open claude_desktop_config.json. On macOS, the file is in ~/Library/Application Support/Claude/. On Windows, it is in %APPDATA%\Claude\. In versions with the developer settings menu, select Settings > Developer > Edit Config to open it.
  3. Add the following entry under mcpServers, preserving any existing settings. Replace the path and credential placeholders with your values:
code language-json
{
  "mcpServers": {
    "marketo-mcp": {
      "command": "node",
      "args": ["/path/to/marketo-bridge/marketo-mcp-bridge.mjs"],
      "env": {
        "MARKETO_MCP_PROD_CLIENT_ID": "<your-client-id>",
        "MARKETO_MCP_PROD_CLIENT_SECRET": "<your-client-secret>",
        "MARKETO_MCP_PROD_MUNCHKIN_ID": "<your-munchkin-id>"
      }
    }
  }
}
  1. Restart Claude Desktop.

If Claude Desktop cannot find Node.js, replace node in command with the absolute path to your Node.js executable. For more information, see Connect to local MCP servers.

Cursor

Cursor cursor

Add the marketo entry under mcpServers in ~/.cursor/mcp.json for your user account or .cursor/mcp.json in your project directory. Preserve any existing servers and replace the credential placeholders with your values:

code language-json
{
  "mcpServers": {
    "marketo": {
      "url": "https://marketo-mcp.adobe.io/mcp",
      "headers": {
        "X-Marketo-Client-Id": "YOUR-CLIENT-ID",
        "X-Marketo-Client-Secret": "YOUR-CLIENT-SECRET",
        "X-Marketo-Munchkin-Id": "YOUR-MUNCHKIN-ID"
      }
    }
  }
}

Open Customize in Cursor and confirm that the server is turned on. For more information, see Cursor MCP configuration.

Claude Code CLI

Claude Code (CLI) claude-code

Run the following command in your terminal, substituting your credentials:

code language-bash
claude mcp add --transport http marketo \
  https://marketo-mcp.adobe.io/mcp \
  --header "X-Marketo-Client-Id: YOUR-CLIENT-ID" \
  --header "X-Marketo-Client-Secret: YOUR-CLIENT-SECRET" \
  --header "X-Marketo-Munchkin-Id: YOUR-MUNCHKIN-ID"

The command adds the server for the current project and your user account. To make it available across projects, add --scope user. In Claude Code, run /mcp to check the connection. For more information, see Claude Code MCP configuration.

OpenAI Codex

OpenAI Codex codex

Add the following to ~/.codex/config.toml, preserving any existing configuration:

code language-toml
[mcp_servers.marketo]
url = "https://marketo-mcp.adobe.io/mcp"

[mcp_servers.marketo.env_http_headers]
X-Marketo-Client-Id = "MARKETO_CLIENT_ID"
X-Marketo-Client-Secret = "MARKETO_CLIENT_SECRET"
X-Marketo-Munchkin-Id = "MARKETO_MUNCHKIN_ID"

Set MARKETO_CLIENT_ID, MARKETO_CLIENT_SECRET, and MARKETO_MUNCHKIN_ID in the environment of the process that runs Codex. The values in env_http_headers are environment variable names, not credentials.

Start a new Codex session and run /mcp to check the connection. For more information, see Codex MCP configuration.

Gemini CLI

Gemini CLI

To add the Marketo Engage MCP server to Gemini CLI, add the following mcpServers entry to .gemini/settings.json in your project directory or ~/.gemini/settings.json for your user account. Preserve any existing settings and replace the credential placeholders with your values.

code language-json
{
  "mcpServers": {
    "marketo": {
      "httpUrl": "https://marketo-mcp.adobe.io/mcp",
      "headers": {
        "X-Marketo-Client-Id": "YOUR-CLIENT-ID",
        "X-Marketo-Client-Secret": "YOUR-CLIENT-SECRET",
        "X-Marketo-Munchkin-Id": "YOUR-MUNCHKIN-ID"
      }
    }
  }
}

Alternatively, set MARKETO_CLIENT_ID, MARKETO_CLIENT_SECRET, and MARKETO_MUNCHKIN_ID in your shell environment and run the following command. The shell expands the variables before the CLI stores the header values in your user configuration:

code language-bash
gemini mcp add --transport http -s user marketo https://marketo-mcp.adobe.io/mcp \
  -H "X-Marketo-Client-Id: $MARKETO_CLIENT_ID" \
  -H "X-Marketo-Client-Secret: $MARKETO_CLIENT_SECRET" \
  -H "X-Marketo-Munchkin-Id: $MARKETO_MUNCHKIN_ID"

Restart the session and run /mcp to check the connection. For more information, see Gemini CLI MCP configuration.

VS Code with GitHub Copilot

VS Code with GitHub Copilot vscode

Use the portable Copilot configuration for the latest versions of VS Code. Add the following entry under mcpServers in ~/.copilot/mcp-config.json, or $COPILOT_HOME/mcp-config.json if you set COPILOT_HOME. Preserve any existing servers:

code language-json
{
  "mcpServers": {
    "marketo": {
      "type": "http",
      "url": "https://marketo-mcp.adobe.io/mcp",
      "headers": {
        "X-Marketo-Client-Id": "${MARKETO_CLIENT_ID}",
        "X-Marketo-Client-Secret": "${MARKETO_CLIENT_SECRET}",
        "X-Marketo-Munchkin-Id": "${MARKETO_MUNCHKIN_ID}"
      }
    }
  }
}

Set the three environment variables in the environment that runs VS Code or the remote host that connects to the server. Start a new Copilot session and review any server trust prompts.

To use the guided setup instead, run MCP: Add Server, select HTTP (HTTP or Server-Sent Events), enter the server URL, and choose Global > Copilot Global. Then add the headers to the saved configuration.

Older versions also support MCP: Open User Configuration or .vscode/mcp.json. These files use servers instead of mcpServers and ${env:MARKETO_CLIENT_ID} syntax for environment variables. Do not mix the two formats. For more information, see VS Code MCP configuration.

Copilot Studio

Copilot Studio

Turn on generative orchestration for your agent before adding MCP tools. Use a custom connector to define all three required Marketo headers.

On your agent’s Tools page, select Add a tool > New tool > Custom connector. In Power Apps, create a custom connector and use the Swagger editor to enter the following definition:

code language-yaml
swagger: '2.0'
info:
  title: Marketo MCP Server
  description: Connect to the Marketo MCP server.
  version: 1.0.0
host: marketo-mcp.adobe.io
basePath: /
schemes:
  - https
paths:
  /mcp:
    post:
      summary: Marketo MCP Server
      description: Invoke the Marketo MCP server.
      operationId: InvokeServer
      x-ms-agentic-protocol: mcp-streamable-1.0
      parameters:
        - name: X-Marketo-Client-Id
          in: header
          description: Client ID.
          type: string
          required: true
        - name: X-Marketo-Client-Secret
          in: header
          description: Client secret.
          type: string
          required: true
        - name: X-Marketo-Munchkin-Id
          in: header
          description: Munchkin ID.
          type: string
          required: true
      responses:
        '200':
          description: Immediate Response
securityDefinitions: {}
security: []

Save or update the connector, return to Copilot Studio, and add it to your agent. Create a connection and supply the three header values when prompted. Keep credentials out of the OpenAPI definition and agent instructions. For more information, see Connect an agent to an existing MCP server.

Glean

Glean glean

To connect Glean to the Marketo Engage MCP server, follow Glean’s remote MCP setup instructions to add https://marketo-mcp.adobe.io/mcp. Check the Connectors catalog first. For a custom or unlisted server, use Admin console > Platform > Tools > Import tools from MCP server.

The Glean support team must configure the custom headers below. Include the server name, URL, and required header names in your support request, and coordinate secure handling of the credential values. A standard API key connection alone does not supply all three headers.

table 0-row-2 1-row-2 2-row-2 3-row-2
Header Value
X-Marketo-Client-Id Your Client ID
X-Marketo-Client-Secret Your Client Secret
X-Marketo-Munchkin-Id Your Munchkin Account ID

After Glean confirms that the headers are active, test the connection with a read-only request before making the tools available to other users.

Other tools

Other tools other-tools

Adobe hosts the Marketo MCP server and exposes it at a public URL. Any MCP client that supports remote servers over streamable HTTP transport may connect to it.
Clients that support direct remote HTTP connections do not need a bridge or locally installed server software. If your tool is not listed above, use the connection details below to configure it manually.

Connection details:

table 0-row-2 1-row-2 2-row-2
Setting Value
Transport HTTP (streamable HTTP)
Server URL https://marketo-mcp.adobe.io/mcp

Authentication headers:

Send all three headers with each request. Where you enter the server URL and headers depends on your tool, so consult its MCP documentation.

table 0-row-2 1-row-2 2-row-2 3-row-2
Header Value
X-Marketo-Client-Id Your Client ID
X-Marketo-Client-Secret Your Client Secret
X-Marketo-Munchkin-Id Your Munchkin Account ID

If your tool accepts a JSON configuration, start with the Cursor or VS Code examples, and adjust the keys and environment variable syntax to match your tool’s schema.

After connecting, ask your AI assistant to use the Marketo MCP server to list available channels without changing any data. Inspect the tool call and its response to confirm that the request uses the intended server and returns data without a connection or authentication error.

Available operations

Once connected, you can ask your AI assistant to perform operations across the following categories. For exceptions and availability requirements, see Supported MCP operations.

Forms

Browse, create, clone, and approve forms. Add or remove fields, configure field visibility rules, and identify where forms are embedded.

Example prompts:

  • “Show me all approved forms”
  • “Clone the Contact Us form into the Q2 Campaign folder”
  • “Add a Company field to the Demo Request form”

Smart campaigns

Create smart campaigns, configure smart list filters, add flow steps, and activate or deactivate campaigns.

Example prompts:

  • “What smart campaigns are active right now?”
  • “Create a new smart campaign called Lead Scoring Update in the Operations folder”
  • “Show me the flow steps in the Welcome Email campaign”

Leads and lists

Find leads by email address, create lead records, and manage static list membership.

Example prompts:

  • “Find the lead with email jane@example.com”
  • “Add lead ID 12345 to the Q2 MQL list”
  • “Create a new static list called Summer Event Attendees”

Programs

Create, clone, and tag programs. Browse programs by type, channel, or date range.

Example prompts:

  • “Clone the Q4 Webinar program into the 2026 Events folder”
  • “Create a new email program called Summer Sale in the Campaigns folder”
  • “Show me all programs tagged as Webinar”

Emails and snippets

Browse emails, create emails from templates, update content sections, and manage reusable snippets.

Example prompts:

  • “Show me all draft emails”
  • “Update the header section of the Welcome Email”
  • “What assets use the Holiday Promo snippet?”

Instance structure

To understand your Marketo configuration, browse folders, channels, tag types, and activity types.

Example prompts:

  • “List all folders in Marketo”
  • “Show me all available channels”
  • “What tag types are configured?”

Bulk operations

Export lead data in bulk and check import or export job status.

Example prompts:

  • “Create a bulk export of leads created in the last 30 days”
  • “Check the status of export job xx”

Troubleshooting

Error
Cause
Fix
“Marketo credentials not provided”
One or more of X-Marketo-Client-Id, X-Marketo-Client-Secret, or X-Marketo-Munchkin-Id is missing.
Verify all Marketo client credential headers are present in your configuration.
“401 Unauthorized”
Your credentials are missing, invalid, or expired. With Marketo client credentials, the Client ID or Client Secret is incorrect. With an IMS token, the token is invalid or expired.
Verify the credentials for your authentication method. For client credentials, re-check the Client ID and Client Secret in Admin > LaunchPoint. For an IMS token, generate a new token and update the Authorization header.
“403 Forbidden”
Your credentials are valid, but your Marketo instance is not enabled for MCP access.
Contact your Marketo MCP administrator to enable MCP access for your Munchkin Account ID.
“Too many requests” (rate limit)
You sent too many requests in a short period, or too many requests at the same time, and reached your Marketo instance’s API limits.
Reduce how frequently and how many requests you send at once, and wait a short time before retrying. Use a dedicated API user to track and manage your quota.
Connection timeout or refused
The MCP server is unreachable from your network.
Confirm you can reach the server URL from your environment. Check VPN requirements if applicable.
Tool calls return empty results
The API user lacks permissions for the requested asset type.
Ask your Marketo admin to review the API user role and permissions.

Security considerations

IMPORTANT
Use a dedicated API user in Marketo with only the permissions required for your work. Do not reuse admin credentials for API access.
  • Per-request credentials. Client ID, Client Secret, Munchkin ID, and the REST API endpoint are transmitted in HTTP headers with each request. The server does not store or cache them.
  • Multi-tenant isolation. Each request uses its own set of credentials. Your data does not intersect with any other user’s session.
  • Munchkin ID allowlist. The server only accepts requests for approved Marketo instances. Requests using an unauthorized Munchkin ID are rejected with a 403 error.
  • API rate limits. The MCP server inherits the API rate limits of your Marketo instance. Use a dedicated API user to track and manage quota consumption.
  • Keep credentials out of version control. Use environment variable interpolation (${MARKETO_CLIENT_SECRET}) if your AI tool supports it, so credentials are not stored in plain text in repository files.

Governance and data retention

Credential handling

  • Customer credentials are not persisted server-side and are supplied by the client per request, which helps limit credential exposure within the service.

API Interaction Model

  • Agent use: Agents may use the MCP Server to invoke supported Marketo APIs.
  • Authentication model alignment: The service uses the same external API authentication model documented for Marketo APIs.

Authentication and Authorization

  • Least privilege: Effective permissions are inherited from the Marketo API-only user assigned to the customer’s LaunchPoint service, enabling least-privilege administration within the customer’s Marketo configuration.
  • No server-side token persistence: The service continues to avoid server-side storage of customer credentials or tokens.

Logging and Monitoring

  • Security logging: Structured JSON logs are routed through Fluent Bit to Splunk, with sensitive-data masking and additional filtering to support compliance requirements.
  • Audit support: These controls support ongoing monitoring of service availability, security-relevant events, and operational quality.
  • No server-side secret storage: Customer credentials are not stored by the MCP deployment and must be provided by clients per request.
  • Token handling: Access tokens are short-lived, token responses are marked no-store, and tokens are accepted through standard authorization mechanisms rather than query-string transmission.
  • Role-based operational access: Administrative deployment access is governed through Adobe infrastructure roles and group-based controls, while data-plane permissions are inherited from the customer’s Marketo API user configuration.
  • Audit and observability: Security logging, masking, monitoring, and alerting are enabled to support investigation, service health tracking, and operational oversight.
recommendation-more-help
marketo-developer-help