Marketo Engage MCP Server
Model Context Protocol (MCP) is an open standard that connects AI tools to external services. The Marketo MCP server connects your AI assistant to Marketo. It supports operations across asset management, lead data, and campaign automation. See Supported MCP operations for exceptions and availability requirements.
When your AI tool calls the MCP server, the server uses the credentials in that request to execute the corresponding REST API call. You do not need to install, deploy, or run server-side software.
For more information on how data is handled with Marketo AI and the Marketo Engage MCP server, see the Data Information page.
Connecting MCP clients or servers to Adobe products is a customer-elected configuration, and customers are responsible for evaluating the security and suitability of any MCP integration. Adobe is not responsible for issues arising from misconfiguration, misuse of the MCP, vulnerabilities in third-party implementations, or unintended actions performed through MCP-enabled workflows.
To reduce risk, Adobe encourages testing integrations in a sandbox environment prior to productive use and carefully reviewing and validating all MCP-initiated actions and responses before confirming or relying on them.
MCP basics
Think of MCP like a USB-C port for AI applications. USB-C provides a standardized way to connect your devices to various peripherals and accessories, and MCP provides a standardized way to connect AI models to data sources and tools. — Model Context Protocol
MCP allows an AI tool to connect to multiple external services simultaneously. For example, an AI assistant can:
- Connect to a word processor for AI-assisted document generation
- Connect to animation tools, such as Blender, for build visualizations
- Connect to Adobe After Effects for video editing
Any application can implement MCP to expose data and actions to AI tools.
What Marketo Engage MCP does and does not do
Understanding the scope of MCP helps set expectations before you connect your AI tool.
MCP does:
- Provide access to Marketo data and capabilities through standard REST APIs
- Execute API calls on your behalf using credentials you supply with each request
- Support multiple simultaneous users, each connected with their own credentials
- Handle OAuth token refresh automatically. You do not need to manage token expiration
- Operate within tenant-isolated environments so your data never intersects with another user’s session
MCP does not:
- Use, host, or run any AI or machine learning models. All AI processing happens in your AI tool, not in the MCP
- Train on or learn from any data, including your customer data
- Generate predictions, recommendations, or decisions. Decision-making is the responsibility of the downstream AI tool or user
- Store or retain credentials, request data, or session state between requests
- Require you to install, deploy, or manage any server-side software
MCP may transmit data, including potentially sensitive fields, depending on API usage but B2B data involves customer business data and does not involve PII data.
Prerequisites
- A Marketo instance with REST API access enabled
- Admin access to create API credentials in Marketo LaunchPoint
- Network access to the MCP server URL:
https://marketo-mcp.adobe.io/mcp
Get Marketo credentials
You need the following values from your Marketo instance:
- Client ID
- Client Secret
- Munchkin Account ID
If you already have them, skip to Configure your AI tool.
Client ID and Client Secret
- Go to Admin > LaunchPoint.
- Select your API service. If you do not have one, select New > New Service, choose Custom as the service type, and assign a dedicated API user.
- Select View Details and copy the Client ID and Client Secret values.
Munchkin Account ID
- Go to Admin > Munchkin.
- Copy the Munchkin Account ID. The format is
XXX-XXX-XXXand matches the prefix of your instance URL.
Configure your AI tool
Configurations differ slightly depending on the tool. This section provides connection examples for common tools.
marketo-prod and marketo-staging, each with the corresponding credentials.Claude Desktop claude-desktop
To connect to Claude Desktop, download marketo-mcp-bridge.zip and unpack it. Put marketo-mcp-bridge.mjs into a known location and use its absolute path in the configuration below.
You also need a supported LTS version of Node.js installed on your computer. The bridge does not require additional npm packages.
- Open Claude Desktop.
- Open
claude_desktop_config.json. On macOS, the file is in~/Library/Application Support/Claude/. On Windows, it is in%APPDATA%\Claude\. In versions with the developer settings menu, select Settings > Developer > Edit Config to open it. - Add the following entry under
mcpServers, preserving any existing settings. Replace the path and credential placeholders with your values:
| code language-json |
|---|
|
- Restart Claude Desktop.
If Claude Desktop cannot find Node.js, replace node in command with the absolute path to your Node.js executable. For more information, see Connect to local MCP servers.
Cursor cursor
Add the marketo entry under mcpServers in ~/.cursor/mcp.json for your user account or .cursor/mcp.json in your project directory. Preserve any existing servers and replace the credential placeholders with your values:
| code language-json |
|---|
|
Open Customize in Cursor and confirm that the server is turned on. For more information, see Cursor MCP configuration.
Claude Code (CLI) claude-code
Run the following command in your terminal, substituting your credentials:
| code language-bash |
|---|
|
The command adds the server for the current project and your user account. To make it available across projects, add --scope user. In Claude Code, run /mcp to check the connection. For more information, see Claude Code MCP configuration.
OpenAI Codex codex
Add the following to ~/.codex/config.toml, preserving any existing configuration:
| code language-toml |
|---|
|
Set MARKETO_CLIENT_ID, MARKETO_CLIENT_SECRET, and MARKETO_MUNCHKIN_ID in the environment of the process that runs Codex. The values in env_http_headers are environment variable names, not credentials.
Start a new Codex session and run /mcp to check the connection. For more information, see Codex MCP configuration.
Gemini CLI
To add the Marketo Engage MCP server to Gemini CLI, add the following mcpServers entry to .gemini/settings.json in your project directory or ~/.gemini/settings.json for your user account. Preserve any existing settings and replace the credential placeholders with your values.
| code language-json |
|---|
|
Alternatively, set MARKETO_CLIENT_ID, MARKETO_CLIENT_SECRET, and MARKETO_MUNCHKIN_ID in your shell environment and run the following command. The shell expands the variables before the CLI stores the header values in your user configuration:
| code language-bash |
|---|
|
Restart the session and run /mcp to check the connection. For more information, see Gemini CLI MCP configuration.
VS Code with GitHub Copilot vscode
Use the portable Copilot configuration for the latest versions of VS Code. Add the following entry under mcpServers in ~/.copilot/mcp-config.json, or $COPILOT_HOME/mcp-config.json if you set COPILOT_HOME. Preserve any existing servers:
| code language-json |
|---|
|
Set the three environment variables in the environment that runs VS Code or the remote host that connects to the server. Start a new Copilot session and review any server trust prompts.
To use the guided setup instead, run MCP: Add Server, select HTTP (HTTP or Server-Sent Events), enter the server URL, and choose Global > Copilot Global. Then add the headers to the saved configuration.
Older versions also support MCP: Open User Configuration or .vscode/mcp.json. These files use servers instead of mcpServers and ${env:MARKETO_CLIENT_ID} syntax for environment variables. Do not mix the two formats. For more information, see VS Code MCP configuration.
Copilot Studio
Turn on generative orchestration for your agent before adding MCP tools. Use a custom connector to define all three required Marketo headers.
On your agent’s Tools page, select Add a tool > New tool > Custom connector. In Power Apps, create a custom connector and use the Swagger editor to enter the following definition:
| code language-yaml |
|---|
|
Save or update the connector, return to Copilot Studio, and add it to your agent. Create a connection and supply the three header values when prompted. Keep credentials out of the OpenAPI definition and agent instructions. For more information, see Connect an agent to an existing MCP server.
Glean glean
To connect Glean to the Marketo Engage MCP server, follow Glean’s remote MCP setup instructions to add https://marketo-mcp.adobe.io/mcp. Check the Connectors catalog first. For a custom or unlisted server, use Admin console > Platform > Tools > Import tools from MCP server.
The Glean support team must configure the custom headers below. Include the server name, URL, and required header names in your support request, and coordinate secure handling of the credential values. A standard API key connection alone does not supply all three headers.
| table 0-row-2 1-row-2 2-row-2 3-row-2 | |
|---|---|
| Header | Value |
X-Marketo-Client-Id |
Your Client ID |
X-Marketo-Client-Secret |
Your Client Secret |
X-Marketo-Munchkin-Id |
Your Munchkin Account ID |
After Glean confirms that the headers are active, test the connection with a read-only request before making the tools available to other users.
Other tools other-tools
Adobe hosts the Marketo MCP server and exposes it at a public URL. Any MCP client that supports remote servers over streamable HTTP transport may connect to it.
Clients that support direct remote HTTP connections do not need a bridge or locally installed server software. If your tool is not listed above, use the connection details below to configure it manually.
Connection details:
| table 0-row-2 1-row-2 2-row-2 | |
|---|---|
| Setting | Value |
| Transport | HTTP (streamable HTTP) |
| Server URL | https://marketo-mcp.adobe.io/mcp |
Authentication headers:
Send all three headers with each request. Where you enter the server URL and headers depends on your tool, so consult its MCP documentation.
| table 0-row-2 1-row-2 2-row-2 3-row-2 | |
|---|---|
| Header | Value |
X-Marketo-Client-Id |
Your Client ID |
X-Marketo-Client-Secret |
Your Client Secret |
X-Marketo-Munchkin-Id |
Your Munchkin Account ID |
If your tool accepts a JSON configuration, start with the Cursor or VS Code examples, and adjust the keys and environment variable syntax to match your tool’s schema.
After connecting, ask your AI assistant to use the Marketo MCP server to list available channels without changing any data. Inspect the tool call and its response to confirm that the request uses the intended server and returns data without a connection or authentication error.
Available operations
Once connected, you can ask your AI assistant to perform operations across the following categories. For exceptions and availability requirements, see Supported MCP operations.
Forms
Browse, create, clone, and approve forms. Add or remove fields, configure field visibility rules, and identify where forms are embedded.
Example prompts:
- “Show me all approved forms”
- “Clone the Contact Us form into the Q2 Campaign folder”
- “Add a Company field to the Demo Request form”
Smart campaigns
Create smart campaigns, configure smart list filters, add flow steps, and activate or deactivate campaigns.
Example prompts:
- “What smart campaigns are active right now?”
- “Create a new smart campaign called Lead Scoring Update in the Operations folder”
- “Show me the flow steps in the Welcome Email campaign”
Leads and lists
Find leads by email address, create lead records, and manage static list membership.
Example prompts:
- “Find the lead with email jane@example.com”
- “Add lead ID 12345 to the Q2 MQL list”
- “Create a new static list called Summer Event Attendees”
Programs
Create, clone, and tag programs. Browse programs by type, channel, or date range.
Example prompts:
- “Clone the Q4 Webinar program into the 2026 Events folder”
- “Create a new email program called Summer Sale in the Campaigns folder”
- “Show me all programs tagged as Webinar”
Emails and snippets
Browse emails, create emails from templates, update content sections, and manage reusable snippets.
Example prompts:
- “Show me all draft emails”
- “Update the header section of the Welcome Email”
- “What assets use the Holiday Promo snippet?”
Instance structure
To understand your Marketo configuration, browse folders, channels, tag types, and activity types.
Example prompts:
- “List all folders in Marketo”
- “Show me all available channels”
- “What tag types are configured?”
Bulk operations
Export lead data in bulk and check import or export job status.
Example prompts:
- “Create a bulk export of leads created in the last 30 days”
- “Check the status of export job xx”
Troubleshooting
X-Marketo-Client-Id, X-Marketo-Client-Secret, or X-Marketo-Munchkin-Id is missing.Authorization header.Security considerations
- Per-request credentials. Client ID, Client Secret, Munchkin ID, and the REST API endpoint are transmitted in HTTP headers with each request. The server does not store or cache them.
- Multi-tenant isolation. Each request uses its own set of credentials. Your data does not intersect with any other user’s session.
- Munchkin ID allowlist. The server only accepts requests for approved Marketo instances. Requests using an unauthorized Munchkin ID are rejected with a 403 error.
- API rate limits. The MCP server inherits the API rate limits of your Marketo instance. Use a dedicated API user to track and manage quota consumption.
- Keep credentials out of version control. Use environment variable interpolation (
${MARKETO_CLIENT_SECRET}) if your AI tool supports it, so credentials are not stored in plain text in repository files.
Governance and data retention
Credential handling
- Customer credentials are not persisted server-side and are supplied by the client per request, which helps limit credential exposure within the service.
API Interaction Model
- Agent use: Agents may use the MCP Server to invoke supported Marketo APIs.
- Authentication model alignment: The service uses the same external API authentication model documented for Marketo APIs.
Authentication and Authorization
- Least privilege: Effective permissions are inherited from the Marketo API-only user assigned to the customer’s LaunchPoint service, enabling least-privilege administration within the customer’s Marketo configuration.
- No server-side token persistence: The service continues to avoid server-side storage of customer credentials or tokens.
Logging and Monitoring
- Security logging: Structured JSON logs are routed through Fluent Bit to Splunk, with sensitive-data masking and additional filtering to support compliance requirements.
- Audit support: These controls support ongoing monitoring of service availability, security-relevant events, and operational quality.
- No server-side secret storage: Customer credentials are not stored by the MCP deployment and must be provided by clients per request.
- Token handling: Access tokens are short-lived, token responses are marked no-store, and tokens are accepted through standard authorization mechanisms rather than query-string transmission.
- Role-based operational access: Administrative deployment access is governed through Adobe infrastructure roles and group-based controls, while data-plane permissions are inherited from the customer’s Marketo API user configuration.
- Audit and observability: Security logging, masking, monitoring, and alerting are enabled to support investigation, service health tracking, and operational oversight.