Official MCP Servers for Marketing Teams, Fact-Checked

A marketing team that wants an AI assistant to read its analytics, pull an ad report, update a CRM record or export a design now has a real set of servers to connect, published by the platform vendors themselves. The Model Context Protocol, or MCP, is the open standard those servers speak; a client such as Claude, ChatGPT or a coding agent connects to the server and gains a fixed set of tools. This post lists only the servers the vendors maintain, and only what their documentation says.

Two things make this list different from most. First, every entry is a vendor's own server. Community servers, including many listed in directories for Google Search Console, are listed in their own section and labelled as such. Second, nothing was installed or tested. The columns below are read from documentation on November 5, 2026, with the date each vendor stated where it stated one. Where a vendor's GitHub README disagrees with its developer guide, both are reported and the source of each is named.

The practical reason for the exercise is that "official" is doing a lot of work in vendor marketing right now, and it does not mean what buyers assume. Of the thirteen servers below, three are labelled generally available by their vendor. One is in open beta. Several carry no status label at all. Two are strictly read-only by design. Three bill your existing API quota. Those are the differences that decide what you connect first.

An official server, for this list, is one hosted or published by the vendor whose data it exposes, under that vendor's own GitHub organisation or domain. That rules out the many capable servers written by agencies, tool companies and individual developers. It is not a judgement on their quality; it is a statement about who answers when something breaks and whose terms of service govern the data.

The distinction matters for a marketing team more than for an engineering one, because the data involved is customer data. A community server that proxies your CRM through a third party's hosted endpoint has created a new data processor whether anyone noticed or not. Our MCP security audit checklist covers that assessment in detail; the short version is that a vendor-hosted server inherits the vendor's existing contract, and a community one does not.

Official also does not mean complete, stable or free. The example that makes the point is Shopify, whose documentation now states that the catalog and cart tools on its earlier Storefront server have been removed and replaced by a different protocol endpoint. A team that built on the original would have found their agent's tools gone. The failure case to avoid is treating a vendor logo as a stability guarantee; the status column below is the better guide.

The status column reports the vendor's own label or, where there is none, says so. A date appears only where the vendor's page or changelog stated it. Google Search Console is absent because no Google-published server was found; the only results were community projects.

Transport decides where the server runs. A remote server is hosted by the vendor and reached over HTTP; a local server runs on the user's machine and talks to the client over standard input and output. Remote is simpler to roll out across a team and easier for an administrator to approve or revoke. Local keeps credentials on the laptop and tends to appear first in a vendor's lifecycle.

Google publishes a server for Google Analytics and another for Google Ads, each as an open-source repository under an Apache-2.0 licence with a developer guide alongside. Neither guide labels its server beta, experimental or generally available. The Analytics repository was created on July 16, 2025 and the Ads repository on October 3, 2025; both showed recent commits when we read them on November 5, 2026.

The Google Analytics MCP guide lists nine read-only tools covering account summaries, property details, Google Ads links, annotations, custom dimensions and metrics, and four report types: standard, realtime, funnel and conversions. It states that the server is available for read requests only. The GitHub README for the same project, however, lists three write tools for creating annotations, custom dimensions and key events, which are off unless the server is started with an --allow-write flag and granted the broader edit scope. We report both because a team reading only the README would expect write access, and a team reading only the guide would not.

The Google Ads MCP guide is more direct: the implementation is strictly read-only and cannot change bids, pause campaigns or create assets. Its three tools list accessible customers, run a Google Ads Query Language search and return resource metadata. Here too the repository README lists tools the guide does not, including asset creation and label management. The guide also notes that developer tokens were sunset on September 9, 2026, with access levels now tied to the Google Cloud project, and that a hosted endpoint exists only as a pilot limited to allowlisted participants. Our Google Ads MCP setup guide walks through the local configuration.

The failure case Google itself warns about is worth repeating. If you self-host the Ads server and omit the OAuth variables while allowing unauthenticated access, the guide says you expose the container's service account credentials. A read-only server with an exposed service account is not read-only in any sense that matters.

Meta announced its ads AI connectors on April 29, 2026 and documents a remote MCP server for Facebook and Instagram advertising. The server overview lists seven tool categories: reporting; ad creation and management; catalog creation and management; signals and datasets; help and troubleshooting; A/B tests and conversion lift studies; and activity logs. Unlike Google's servers, this one is built to act, not only to read.

Two updates on July 16, 2026 matter for governance. Teams can now connect any AI application through their own developer app rather than only through Meta's named connectors, and portfolio administrators with full control can set server rules that limit what an agent may do, with budget changes and catalog updates given as examples. That is the most granular agent-action policy in this list (Stripe adds human confirmation and account-specific approval rules, and Slack requires administrator approval of clients), and it is the feature a finance team will ask about first.

The authentication detail is thinner than Google's. The connector path is described as requiring no developer credentials, API setup or coding, and the companion command-line tool uses a system user access token. We did not find an individual tool count on Meta's pages; a third-party figure of twenty-nine tools circulates and is unverified. Our ads-platform MCP playbook covers how the Meta and Google servers differ in a day-to-day reporting workflow.

The only servers in this list that their vendors label generally available sit in this group. HubSpot's changelog describes its remote CRM server as having graduated from beta to general availability for all accounts, with OAuth 2.1 and PKCE required on every connection and every action subject to the connecting user's existing permissions. It reads contacts, companies, deals, tickets, commerce objects, marketing campaigns, landing pages, blog posts and activities, and can create or update the core CRM objects. One restriction is easy to miss: if the account has sensitive data enabled, activity objects are blocked. HubSpot's separate developer server, generally available since February 19, 2026, is for building apps and CMS assets and does not touch CRM data. HubSpot's remote-server documentation also notes that its own AI connectors for Claude, Microsoft Copilot, Gemini and ChatGPT are powered by the remote server.

Salesforce's hosted servers reached general availability on April 29, 2026 after a pilot and a beta, for Enterprise Edition organisations and above. Each transaction runs as the authenticated user under per-user OAuth with PKCE, so existing create, read, update and delete rights, field-level security and sharing rules all apply. Capabilities extend beyond records to custom tools built from Apex actions, Flows and named queries, plus Data 360 queries, Tableau and prompt templates. The caveat is commercial: the documentation says the servers are intended for customers with Flex Credits and that server usage may be billed.

Shopify and Stripe sit here as commerce and payments infrastructure rather than marketing tools, but marketing teams touch both. Shopify's developer server runs locally without authentication and answers questions about Shopify's own documentation, not store data. Its storefront tooling has been reorganised: the catalog and cart tools have been removed from the older Storefront server in favour of a new commerce protocol endpoint that requires an agent profile on every request. Stripe's remote server offers search, read and write tools across the API, an analytics tool marked Preview, and human confirmation for some actions such as refunds, with approvals expiring after 24 hours. Its dated instruction is the one hard deadline in this post: migrate to agent API keys by November 30, 2026, because from December the server stops accepting full-access secret keys and restricted keys without the Agent tag.

The two SEO servers are the clearest case of an official server that costs money per call. Semrush's server is reachable only over Streamable HTTP at its hosted endpoint, authenticates by OAuth or an API key header, and consumes API units on every request; qualifying plans include 50,000 units, and the Projects API is read-only through it. Ahrefs' hosted server is available on paid plans from Lite upward, issues an MCP-tagged API key through OAuth consent, and applies a default limit of 200,000 API units per key per month, consumed the same way as direct API use. Neither page lists individual tool names.

The example that catches teams: an agent asked to "check rankings for all our pages" will issue one call per page, and units are charged per request by report type and data volume, so a large site can consume a meaningful share of a plan's units in one session. Set a per-session budget in the client and give the agent a sampling instruction before you connect either server. This is a place where the agentic workflow and the commercial plan have to be designed together, which is the work our agentic SEO practice does with clients.

Canva documents a remote server covering design generation and editing, design discovery, asset and brand management, export to PDF, PNG, JPG, PPTX and MP4, and commenting; its page states no plan requirements, dates or authentication detail, and a separate local developer server exists for people building Canva apps. Notion's server is documented as official under Notion's GitHub organisation, last pushed on October 29, 2026, with tool categories for search, collaboration, page and database management, files and calendars; the pages we read did not state transport or authentication, so those cells are blank rather than guessed. Slack's server speaks JSON-RPC over Streamable HTTP, explicitly does not support server-sent events or dynamic client registration, and is restricted to Marketplace-published and internal apps, with administrator approval and audit logging. Its tools cover search, sending and scheduling messages, reading channels and threads, canvases, files and lists.

The failure case across this group is the blank cell. Where we could not find transport or authentication on the vendor's page, we left it empty. A list that fills those cells from memory or from a third-party directory is the kind of list that gets a marketing team's agent connected to the wrong endpoint.

Several servers that appear in "best MCP servers for marketing" lists are not vendor-maintained. For Meta ads, they include community projects from Pipeboard and the brijr repository, among others. For Google Search Console, every server we found is a community project; we found no Google-published server as of November 5, 2026. Directory sites list many more for each platform.

None of this makes a community server unsafe to use. It changes three things: who maintains it when the underlying API changes, which organisation's terms govern the data it handles, and whether a hosted version introduces a processor your privacy notice does not mention. Our audit of what MCP servers inject into context found that the tool descriptions themselves vary widely in what they disclose, and that is the second thing to read after the licence.

This pass did not research servers for Mailchimp, LinkedIn, X, TikTok, Klaviyo or Zoho, so their absence from the tables says nothing about whether official servers exist for them.

The right order depends less on which tool a team uses most than on which server can do the least damage while the team learns how its agents behave. Four routes cover most marketing teams.