MCP for marketing means connecting an AI assistant such as Claude, ChatGPT, Gemini or Microsoft Copilot to your marketing systems, including your CMS, analytics, CRM and ad platforms, through the Model Context Protocol. The assistant can then read live data and, where you allow it, act inside those tools, instead of working only from what you paste into a chat.
Key Takeaways
- The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in November 2024 and donated in December 2025 to the Agentic AI Foundation under the Linux Foundation.
- Major marketing vendors already ship MCP servers. Some are read-only, such as Google's servers for Analytics and Ads, and some can write, such as HubSpot's CRM server.
- The best first uses are read-only: content audits, performance reporting and campaign QA. They save hours and carry little risk.
- The main risks are prompt injection, over-broad permissions and untrusted servers. Least-privilege scopes, human approval for every write and audit logs address most of them.
- Treat MCP access like a new team member: a named owner, a clear job, limited keys and regular reviews.
This guide is for marketing leaders and operators who want AI assistants to do real work inside their stack without creating a security incident. Apex®, the AI-native digital experience platform (DXP) we build at Cyberdunes, supports MCP, and we wrote our own MCP access guide for customers. What follows is the operating model we recommend, including the use cases we would not automate yet.
What Is the Model Context Protocol?
MCP is a shared standard that lets any compatible AI assistant connect to any compatible tool or data source. Instead of building a separate integration for every assistant and every system, a vendor builds one MCP server and every MCP-ready assistant can use it.
Anthropic introduced MCP on November 25, 2024, describing it as "an open standard that enables developers to build secure, two-way connections between their data sources" and AI-powered tools, and noting that "every new data source requires its own custom implementation" without it (Anthropic, November 2024). Adoption spread fast. When Anthropic donated MCP to the new Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, on December 9, 2025, it reported more than 10,000 active public MCP servers and adoption by ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code (Anthropic, December 2025).
The protocol keeps maturing. The July 28, 2026 specification moved MCP to a stateless core and tightened authorization, so servers scale more easily behind ordinary load balancers (Model Context Protocol blog, July 2026). Four terms are enough for a marketing leader:
- Host: the AI app your team uses, such as Claude or ChatGPT.
- Client: the part of the host that connects to servers and asks you before sensitive actions.
- Server: a connector a vendor or your team runs for one system, such as GA4 or your CMS.
- Tools and resources: the actions a server offers (run a report, create a draft) and the data it exposes.
Why Does MCP Matter to Marketing Teams?
MCP matters because most marketing questions cross systems. "Which pages lost traffic, what changed on them and which deals did they influence?" touches analytics, the CMS and the CRM. Today someone exports three spreadsheets. With MCP, an assistant can query all three in one conversation.
The servers marketers need already exist, with very different permissions:
- CRM: HubSpot's remote MCP server became generally available to all HubSpot accounts on April 13, 2026, with read and write access. It can create or update contacts, companies, deals, tickets and activities, and "all actions respect your existing HubSpot user permissions" (HubSpot, April 2026).
- Analytics: Google's Google Analytics MCP server is labeled experimental, and its credentials must include the Analytics read-only scope (Google Analytics on GitHub).
- Advertising: Google's Google Ads API MCP server is "strictly read-only" and "cannot modify bids, pause campaigns, or create new assets" (Google Ads API documentation).
- Content: some CMS and DXP platforms, including Apex®, let assistants work with site content through MCP, which is what makes content audits and refreshes possible.
That spread is useful. You can start where the vendor has already limited the blast radius, and add write access only where you have controls. MCP also changes architecture decisions: a platform with one clean content model is far easier for an assistant to use than five services that disagree, a point we cover in our guide to composable versus all-in-one DXPs.
What Can Marketers Do With MCP? Use Cases by Risk
The best use cases combine data from two or more systems and end in a human decision. The table rates each by the access it needs and the damage a mistake could do.
| Use case | Systems | Scopes needed | Risk | Human check |
|---|---|---|---|---|
| Content audit: find thin, outdated or orphaned pages | CMS, analytics | Read | Low | Review the list |
| Weekly performance summary for leadership | Analytics, ads, CRM | Read | Low | Check numbers against the source report |
| AI referral traffic analysis | Analytics | Read | Low | Validate channel definitions |
| Campaign QA: broken links, missing UTM tags, wrong landing pages | CMS, ads, analytics | Read | Low | Fix issues by hand |
| Refresh drafts for declining pages | CMS, analytics | Read, create draft | Medium | Editor approves before publishing |
| Meta descriptions and schema suggestions at scale | CMS | Read, create draft | Medium | Spot-check a sample |
| CRM hygiene: log notes, update lifecycle fields | CRM | Read, write | High | Confirm each write |
| Publish an approved page or send an email | CMS, email | Write, publish, send | High | Named approver, every time |
| Change bids or budgets | Ad platform | Write | Very high | Keep manual for now |
For the analytics rows, set up AI referral channels first: our guide to tracking AI traffic in GA4 shows how. For content work, pair MCP with a checklist such as our 12-point GEO checklist so the assistant audits against a standard, not its own taste.
What Are the Security Risks of MCP?
The risks come from giving a model that reads untrusted text the ability to take actions. Four matter most for marketing teams.
Prompt Injection
OWASP ranks prompt injection first in its 2025 risks for large language model applications, and defines indirect prompt injection as what happens when a model "accepts input from external sources, such as websites or files" (Owasp, 2025). Marketing assistants read exactly that kind of input: form entries, reviews, competitor pages and inbound emails.
Over-Broad Permissions
The MCP security guidance warns that broad scopes granted up front expand the "blast radius" if a token is stolen, and recommends a "minimal initial scope set", with more scopes requested only when a privileged action is first attempted (MCP specification, November 2025). In plain terms: a reporting assistant should never hold a key that can delete contacts.
Untrusted Servers
Anyone can publish an MCP server. The specification says clients "MUST consider tool annotations to be untrusted unless they come from trusted servers" (MCP specification, November 2025), and its security guidance warns that a malicious local server can run commands with the same privileges as the assistant app (MCP specification, November 2025). Prefer servers published by the vendor of the system they connect to.
Confident Mistakes
Even without an attacker, a model can misread a request and update the wrong records. This is why our guide to AI evals recommends testing an assistant on known tasks before it touches production data.
The MCP Governance Checklist
Good MCP governance is mostly ordinary access management applied to a new kind of user. The MCP specification says there "SHOULD always be a human in the loop with the ability to deny tool invocations", and that clients should show tool inputs before calling a server and log tool usage for audit purposes (MCP specification, November 2025). Use this checklist before you connect anything.
| Control | Owner | Effort |
|---|---|---|
| Keep a register of every MCP server connected, who approved it and why | Marketing ops | 1 hour, then ongoing |
| Use only vendor-published or internally reviewed servers | IT or security | Per server review |
| Start every connection read-only; grant write scopes per use case | System owner | Per connection |
| Separate service accounts for assistants, never a person's admin login | IT | Half a day |
| Require approval for every write, publish and send action | Team lead | Built into the client |
| Keep assistants away from personal data they do not need for the task | Data protection lead | Per use case |
| Turn on and retain logs of tool calls, inputs and results | IT | Half a day |
| Test new use cases on a staging site or sandbox CRM first | Marketing ops | Per use case |
| Review access monthly and revoke unused connections | Named access owner | 30 minutes a month |
| Write down what the assistant may never do, such as change budgets | CMO | 1 hour |
If your website security basics are not in place yet, start with our website security checklist, because MCP access is only as safe as the accounts behind it.
How Much Should You Let an Assistant Do?
Let the assistant earn autonomy one level at a time. Each rung adds risk, so move up only when the rung below has run cleanly for several weeks.
In our experience the first two rungs cover most of the time savings: research, reporting and first drafts. The higher rungs save minutes per task but carry most of the risk. For the people and process side, see our operating model for AI agents in marketing.
How to Start With MCP in 30 Days
Start with one read-only use case that wastes hours every week, prove it, then expand. This plan fits a team with one marketing operations owner and some IT support.
- Week 1, pick the job: choose one recurring task, such as the Monday performance summary, and time how long it takes today.
- Week 1, name the owner: assign one person to own MCP access, approvals and the server register.
- Week 2, connect read-only: add your analytics and CMS servers with read scopes only, using a dedicated service account.
- Week 2, write the prompt: save a standard prompt that names the metrics, date ranges and output format you want.
- Week 3, run in parallel: produce the report both ways and compare every number with the source system.
- Week 4, decide: if the numbers match and time drops, keep it and pick the next use case. If not, fix the prompt or the data first.
- After day 30: add a draft-only content use case, such as refreshing declining pages, with an editor approving every change.
Does It Matter Which AI Assistant You Use?
Less than it used to. Because MCP is a shared standard, the same server works with any assistant that supports it, so you can choose the assistant for its writing, reasoning or price and keep your connections. Claude has supported MCP since launch: Anthropic said at the time that "all Claude.ai plans support connecting MCP servers to the Claude Desktop app" (Anthropic, November 2024). ChatGPT, Gemini and Microsoft Copilot followed, as listed above.
What still differs is the client: how clearly it shows which tools are connected, whether it asks before write actions, which plans allow custom servers and what your administrators can control. Check those settings in your assistant's documentation before you roll it out to a team, and standardize on one assistant per team so approvals and logs live in one place.
Which MCP Servers Are Best for Marketing?
The best MCP server for marketing is the one published by the vendor of the system you already use, with the narrowest scopes that do the job. Popularity in a directory tells you little about safety.
Judge any server on five questions:
- Who maintains it? Prefer the system's own vendor, as with HubSpot, Google Analytics and Google Ads.
- Can it run read-only? A read-only mode or scope is the safest place to start.
- How does it authenticate? Look for OAuth with per-user permissions. HubSpot, for example, requires OAuth 2.1 with PKCE.
- Does it respect existing roles? An assistant should never see more than the person using it.
- Can you see what it did? You need logs of every tool call for audits and incident reviews.
Your website is part of this picture too. Agents increasingly read and act on public sites, which is the subject of our guide to designing sites AI agents can use.
How Apex® Supports MCP
Apex® supports MCP, so AI assistants and agents can work with your Apex® content and data through a standard, secure interface instead of a custom integration. Access is enabled per account: you decide which content and data an assistant should reach, name the person responsible for that access, ask our support team to turn it on, then add the connection in your assistant and test it with a simple request.
That fits the governance model above: one owner, limited reach and regular reviews to remove what is no longer needed. Inside Apex®, Context Intelligence adds site audits, topic research, an answer-first AI writer and AI visibility tracking across ChatGPT, Gemini, Claude, Perplexity and Google AI Overviews, so assistants and your team work from the same content.
Sources
- Introducing the Model Context Protocol, Anthropic, November 2024
- Donating the Model Context Protocol and establishing the Agentic AI Foundation, Anthropic, December 2025
- The 2026-07-28 Specification, Model Context Protocol blog, July 2026
- Specification: Tools, Model Context Protocol, November 2025
- Specification: Security Best Practices, Model Context Protocol, November 2025
- LLM01:2025 Prompt Injection, OWASP Gen AI Security Project, 2025
- Remote HubSpot MCP server is now generally available, HubSpot, April 2026
- Google Analytics MCP Server (Experimental), Google Analytics on GitHub, accessed October 2026
- Google Ads API MCP server, Google for Developers, accessed October 2026
