Salesforce Marketing Cloud

Live

OAUTH 2.0

MARKETING AUTOMATION

Marketing

Journeys, data extensions, and every email, SMS, and push send live in Marketing Cloud. Salesforce Marketing Cloud gives your agent authenticated access scoped to the user who authorized it.

  • Acts as the user: access and write actions stay tied to the Salesforce Marketing Cloud account that authorized the agent.
  • Credentials stay vaulted: AES-256, resolved at request time, never in LLM context.
  • Scoped before every call: permissions enforced. 90-day audit trail.
Salesforce Marketing Cloud
agent · Acme Q3
Run
How did the winback journey perform last week?
S
sfmc_journey_get
164ms
Salesforce Marketing Cloud agent
Winback reached 12,480 contacts, 31% opened, 4.2% clicked. 220 exited early on the purchase goal.
Sources: 1 journey, 3 sends, 12,480 contacts
salesforcemarketingcloud
4 calls
18:29
Message Claude...

Tools your marketing agent reaches for on Salesforce Marketing Cloud, scoped per user.

CALL ANY TOOL
Marketing automation across Marketing Cloud: manage contacts and data extensions, trigger journeys, and run email, SMS, and push sends.
salesforcemarketingcloud_address_email_validate
Validate address email
Validate an email address's syntax and deliverability using Marketing Cloud's Address Verification API. Choose one or more validators: SyntaxValidator checks for basic structural validity (e.g. presence of '@' and a domain with a '.'), MXValidator checks the domain has a valid DNS MX record, and ListDetectiveValidator checks the address's username or domain against a known bad-address filtering list. This is a read-only check -- it does not modify any Marketing Cloud data. Returns a validation result indicating whether the address passed each requested validator. Example: email 'help@example.com' with all three validators.
Parameters
Name
Type
Required
Description
email
string
Required
The email address to validate, e.g. 'help@example.com'.
validators
array
Optional
Which validators to run against the email address. SyntaxValidator checks basic format, MXValidator checks the domain's DNS MX record, and ListDetectiveValidator checks against a known bad-address list. Defaults to running all three.
salesforcemarketingcloud_approval_item_create
Create approval item
salesforcemarketingcloud_approval_item_get
Get approval item
salesforcemarketingcloud_approval_item_roles_list
List approval item roles
salesforcemarketingcloud_asset_category_delete
Delete asset category
salesforcemarketingcloud_asset_category_update
Update asset category
salesforcemarketingcloud_asset_query
Query asset
salesforcemarketingcloud_automation_start
Start automation
salesforcemarketingcloud_campaign_asset_add
Add campaign asset
salesforcemarketingcloud_campaign_assets_list
List campaign assets
salesforcemarketingcloud_contact_attribute_set_data_search
Search contact attribute set data
salesforcemarketingcloud_contact_preferences_get_by_key
Contact preferences get by key
salesforcemarketingcloud_data_extension_create
Create data extension
salesforcemarketingcloud_data_extension_delete
Delete data extension
salesforcemarketingcloud_data_extension_list
List data extension
salesforcemarketingcloud_data_extension_row_async_upsert
Upsert data extension row async
salesforcemarketingcloud_data_extension_row_insert
Data extension row insert
salesforcemarketingcloud_email_definition_send
Send email definition
salesforcemarketingcloud_event_notification_subscription_delete
Delete event notification subscription
salesforcemarketingcloud_file_transfer_location_update
Update file transfer location
salesforcemarketingcloud_file_transfer_location_validate
Validate file transfer location
salesforcemarketingcloud_journey_contacts_by_status_get
Get journey contacts by status
salesforcemarketingcloud_journey_publish
Publish journey
salesforcemarketingcloud_journey_stop
Stop journey
salesforcemarketingcloud_journey_validate
Validate journey
salesforcemarketingcloud_platform_endpoints_list
List platform endpoints
salesforcemarketingcloud_seed_list_update
Update seed list
salesforcemarketingcloud_sms_contact_subscription_status_get
Get sms contact subscription status
salesforcemarketingcloud_sms_import_send_delivery_report_create
Create sms import send delivery report
salesforcemarketingcloud_sms_keyword_delete_by_shortcode
Sms keyword delete by shortcode

For more tools, view docs.

Build your Agent
Drop the toolkit in, point it at the user, and your marketing agent can use Salesforce Marketing Cloud from the first run.
Python · LlamaIndex
import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Salesforce Marketing Cloud tools, scoped to the signed-in user
const { tools } = await sk.tools.listScopedTools("user_123", {
filter: { connectionNames: ["salesforcemarketingcloud"], toolNames: [
"salesforcemarketingcloud_address_email_validate",
"salesforcemarketingcloud_approval_item_create",
"salesforcemarketingcloud_approval_item_get"
] },
pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "How did the winback journey perform last week?" }] });
import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Salesforce Marketing Cloud tools, scoped to the signed-in user
const { tools } = await sk.tools.listScopedTools("user_123", {
filter: { connectionNames: ["salesforcemarketingcloud"], toolNames: [
"salesforcemarketingcloud_address_email_validate",
"salesforcemarketingcloud_approval_item_create",
"salesforcemarketingcloud_approval_item_get"
] },
pageSize: 100,
});

const openai = new OpenAI();
const res = await openai.responses.create({
model: "gpt-5",
tools: tools.map((t) => t.openai),
input: "How did the winback journey perform last week?",
});
import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Salesforce Marketing Cloud tools, scoped to the signed-in user
const { tools } = await sk.tools.listScopedTools("user_123", {
filter: { connectionNames: ["salesforcemarketingcloud"], toolNames: [
"salesforcemarketingcloud_address_email_validate",
"salesforcemarketingcloud_approval_item_create",
"salesforcemarketingcloud_approval_item_get"
] },
pageSize: 100,
});

const anthropic = new Anthropic();
const msg = await anthropic.messages.create({
model: "claude-opus-4-6",
max_tokens: 1024,
tools: tools.map((t) => t.anthropic),
messages: [{ role: "user", content: "How did the winback journey perform last week?" }],
});
import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Salesforce Marketing Cloud tools, scoped to the signed-in user
const { tools } = await sk.tools.listScopedTools("user_123", {
filter: { connectionNames: ["salesforcemarketingcloud"], toolNames: [
"salesforcemarketingcloud_address_email_validate",
"salesforcemarketingcloud_approval_item_create",
"salesforcemarketingcloud_approval_item_get"
] },
pageSize: 100,
});

const agent = new Agent({
name: "salesforcemarketingcloud_agent",
model: "gemini-2.5-pro",
instruction: "Act as the marketing agent for the signed-in user.",
tools,
});
await agent.run("How did the winback journey perform last week?");
Try these prompts
Paste any prompt into your agent to start using Salesforce Marketing Cloud.
Campaign reporting
Copy the prompt
Copied
How did the winback journey perform last week?
Copy the prompt
Copied
Which email send had the highest bounce rate this month?
Copy the prompt
Copied
Show contacts who entered the onboarding journey yesterday.
Data extensions
Copy the prompt
Copied
List rows added to the trial signups data extension today.
Copy the prompt
Copied
Add this contact to the enterprise nurture data extension.
Copy the prompt
Copied
Which data extensions feed the winback journey?
Sends
Copy the prompt
Copied
Trigger the renewal reminder journey for these account IDs.
Copy the prompt
Copied
Schedule the product launch email for Tuesday 10am.
Copy the prompt
Copied
Pause the winback journey until the pricing page ships.
SEE HOW AUTH WORKS
Users authorize Salesforce Marketing Cloud once. Their credentials stay vaulted, every call is checked, and every action is logged.
1
Authorize
Your user connects
Salesforce Marketing Cloud
once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access
Who:
user ‘A’
when:
Once per user
access:
Limited to user
2
Store
Their
Salesforce Marketing Cloud
token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection
vault:
encrypted
scope:
per-user
tokens:
auto-refreshed
3
Resolve
When your agent calls a
Salesforce Marketing Cloud
tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs
speed:
~40ms
check:
before every call
seen by:
nobody
4
Audit
Every
Salesforce Marketing Cloud
tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it
history:
90 days
export:
SIEM-ready
logged:
every call
Test other agents
Same per-user auth pattern across other agents and MCP connectors. Working code, live demos, fork what fits.
GTM and RevOps Teams
Revenue forecast commentary
Pulls open pipeline from Salesforce and HubSpot, calculates coverage against quota, flags at-risk stages, posts commentary to Slack, and logs every snapshot to Google Sheets.
GTM and RevOps Teams
Deal room sync
Pulls opportunity context from Salesforce, captures key decisions from Slack, and syncs a running summary to the deal room doc in Google Drive, but only when the deal actually changed.
GTM and RevOps Teams
Competitive intelligence briefing agent
Scans Gong calls for competitor mentions, matches each one to its Notion battlecard, and DMs every affected rep a single Slack digest per cycle. Every call runs as the PMM who owns the briefing, never a shared bot.
People Ops and HR teams
Offer letter routing agent
Drafts the offer in PandaDoc, blocks on the hiring manager's approval in Slack, then emails the candidate their e-signature link. Every call runs as the recruiter who triggered it, never a shared HR bot.
Test other agents
Same per-user auth pattern across other agents and MCP connectors. Working code, live demos, fork what fits.
GTM
Deal room sync agent
Pull opportunity context from Salesforce, capture decisions from Slack, and keep the Google Drive deal room doc current.
GTM
Revenue forecast agent
Score pipeline coverage against quota across Salesforce and HubSpot, post forecast commentary to Slack, log snapshots to Sheets.
GTM
Competitive intelligence briefing agent
Scan Gong calls for competitor mentions, match each one to its Notion battlecard, and DM every affected rep a single Slack digest.
PEOPLE OPS
Offer letter routing agent
Draft the offer in PandaDoc, gate it on hiring manager approval in Slack, then email the candidate their signature link.
Why Scalekit
Secure your agent's access. Connectors ship in minutes
01.
Shared tokens break per-user analytics
A shared token looks fine in a demo. In production every call looks like a service account. Scalekit resolves the real user credential so attribution, audit, and scope stay accurate.
// shared token
audit → bot_service_account
user_filter → broken

// scalekit
audit → user_abc
scope → enforced ✓
02.
Authentication is not authorization
03.
Multi-tenancy is architectural
04.
Salesforce Marketing Cloud today. Others tomorrow.
“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”
Venu Madhav Kattagoni
Head of Engineering / Von
FAQs
Frequently Asked Questions
Does the agent access Salesforce Marketing Cloud as the user or as a shared key?
As the user. Each member authorizes once and Scalekit resolves their credential at request time. Audit logs attribute every action to that user, not a shared service account.
Where is the Salesforce Marketing Cloud oauth 2.0 credential stored?
In Scalekit's managed AES-256 token vault, namespaced per tenant. Refresh is automatic. Revocation is a single dashboard action. Credentials never appear in prompts, logs, or LLM context.
Can I limit what the agent is allowed to do in Salesforce Marketing Cloud?
Yes. Pass a tool name filter to listScopedTools so the marketing agent only sees the subset you authorize. Pre-API-call scope checks block out-of-policy actions before the request reaches Salesforce Marketing Cloud.
What happens when a user revokes Salesforce Marketing Cloud access?
The connection is invalidated on the next tool call. Subsequent requests for that user fail closed with a clear error. Other users in the tenant remain unaffected. The event is logged for audit.
Marketing Cloud uses server-to-server OAuth. How does per-user attribution work?
Scalekit vaults the integration credential per tenant and records which user's agent call triggered each request, so the audit chain names a person even where Marketing Cloud sees one API user. Scope checks still run per user before the call.
Start in your coding agent
Up and running in one command
Install the Scalekit skill in your editor of choice. Connector, auth, tools, prompt, all wired up
Claude Code REPL
/plugin marketplace add scalekit-inc/claude-code-authstack
/plugin install agentkit@scalekit-auth-stack
Cursor Code REPL
# ~/.cursor/mcp.json
{
""mcpServers"": {
""salesforcemarketingcloud"": {
""url"": ""https://mcp.scalekit.com/salesforcemarketingcloud"",
""headers"": { ""Authorization"": ""Bearer $SCALEKIT_TOKEN"" }
}
}
}
Codex Code REPL
# ~/.codex/config.toml
[mcp_servers.salesforcemarketingcloud]
url = ""https://mcp.scalekit.com/salesforcemarketingcloud""
auth_env = ""SCALEKIT_TOKEN""
Copilot Code REPL
# .vscode/mcp.json
{
""servers"": {
""salesforcemarketingcloud"": {
""url"": ""https://mcp.scalekit.com/salesforcemarketingcloud"",
""type"": ""http""
}
}
}