# Lifecycle servers: Braze, Klaviyo, Intercom and Customer.io Checked on 2026-11-01. These servers can send messages, change suppression and delete people, so the read-only layer matters more here than anywhere else in the stack. Write-tool lists are partial and dated; the live tool list wins. ## Braze Server and status - Remote `https://mcp.braze.com/mcp` (US) and `https://mcp.braze.eu/mcp` (EU). Either reaches any cluster; EU customers use the EU endpoint. - Not available on free trial accounts. Accounts that use IP allowlisting cannot use it at all (failure F13). - The local beta server is deprecated (scanner S02). Clients - Verified clients: Claude, ChatGPT, Cursor, OpenAI Codex, Claude Code and VS Code. No client ID, secret or API key is needed. Braze advises against auto modes. Auth and who can connect - An admin turns on MCP OAuth access at Settings > Admin Settings > External Connections and approves each client's redirect URI; registering a client does not approve it. - The Use MCP Server permission is off by default and granted per user. Access mirrors the user's dashboard permissions, which are set per workspace; team-scoped access can break some tools. Read-only layer - A dashboard user without edit rights plus Use MCP Server. Braze has no read-only toggle, so do not use auto-approve modes, and block the write tools below in the client. Tools (2026-11-01) - Read: `get_workspaces` (returns `app_group_id`), `get_campaign_list`, `get_campaign_details`, `get_campaign_dataseries`, the Canvas tools (read-only) and KPI data series. - Write, generally available: the template, content block, catalog and media library create, update and delete tools (`create_email_template`, `update_email_template`, `create_content_block`, `update_content_block`, `create_catalog`, `create_catalog_fields`, `create_catalog_items`, `edit_catalog_items`, `replace_catalog_items`, the catalog deletes, `create_media_library_asset`), `duplicate_campaign` and `trigger_integration_sync`, which starts a data sync. - Write, behind beta gates: campaign create, edit, launch, stop, archive and message tools; `create_segment` and `edit_segment`; the Operator tools (`send_operator_prompt`, `cancel_operator_job`). - Tools return no user-profile data. T1 and T3 - T1: `get_workspaces`; the workspace ID matches. Name the workspace in every prompt. - T3: one campaign's sends for a closed period through `get_campaign_dataseries`. Revocation - Remove Use MCP Server from the user. A company admin can revoke every MCP OAuth token at once or turn MCP OAuth access off. Successful OAuth connections appear in the security event report. ## Klaviyo Server and status - Remote `https://mcp.klaviyo.com/mcp`, with no trailing slash. Owner, Admin or Manager roles only. - Local: `uvx klaviyo-mcp-server@latest` in vendor docs; pin a version for teams (scanner S05). Env: `PRIVATE_API_KEY`, `READ_ONLY`, `ALLOW_USER_GENERATED_CONTENT`. URL parameters (custom connections only) - `read-only` (default false) removes write tools. - `disable-tools-with-user-generated-content` removes tools that read customer-written content. - `toolsets` limits tools by resource:access scopes; `core-tools-only` keeps about 30 core tools. - `beta` (keep false) and `include-output-schemas` (false by default for ChatGPT). - `paginate-lists` (default false) pages the MCP list methods, `tools/list` included, with MCP cursors; `list-page-size` (default 20) sets that page and is ignored unless `paginate-lists` is true. A client that sets `paginate-lists=true` must follow `nextCursor`, or it sees only the first page of tools. - The listed Claude connector and the listed ChatGPT app cannot take parameters (failure F03). Use a custom connector, or a custom MCP server from the ChatGPT Plugins page. Read-only layer - Remote: a custom connection with `read-only=true&disable-tools-with-user-generated-content=true`. - Local: a read-scoped private key, `READ_ONLY=true` and `ALLOW_USER_GENERATED_CONTENT=false`. This is the strongest layer because the key itself cannot write. Tools (2026-11-01) - Read: `get_account_details`, `get_campaign_report`, `get_flow_report`. - Hard-to-reverse writes: `send_campaign`, `create_template_preview_send_job`, `bulk_suppress_profiles`, `request_profile_deletion`, `merge_profiles`, `create_webhook` and dozens of delete tools. - User-generated content: `get_events`, `get_event`, `get_profiles`, `get_profile`, `get_reviews`, `get_review` (read); `update_profile`, `create_or_update_profile`, `update_review` (write). T1 and T3 - T1: `get_account_details`; account name and ID match. - T3: `get_flow_report` or `get_campaign_report` for a closed period with the store's conversion metric. Pass on delivered counts, not attributed revenue. - T5: compare a list count (flows, segments) with the Klaviyo UI and confirm the answer states its coverage. Traps - Multiple accounts: one custom connector per account with a parameter that tells them apart, named for the store, and the account confirmed with `get_account_details` every time. - A shared project entry without `read-only=true`, shadowed for one person by their read-only personal entry (scanner S06, S10, S11): only that person was protected. - `paginate-lists=true` on a client that ignores MCP cursors shows only the first 20 tools, so T2 compares a partial list. Leave it off unless the client follows cursors. Client steps on the vendor page - Cursor: Settings > MCP > New MCP Server, then Needs login. VS Code: add the server to the user config, then MCP: List Servers > Start Server. Revocation - Remove the connector and the app authorisation; rotate any private key that sat in a config file. ## Intercom Server and status - Remote `https://mcp.intercom.com/mcp` (US) and `https://mcp.eu.intercom.com/mcp` (EU), Streamable HTTP. `/sse` endpoints are deprecated (scanner S02). AU workspaces are unsupported. - The Claude directory connector covers US workspaces; EU workspaces use a custom connector. Auth and who can connect - OAuth recommended. Bearer tokens work but do not get the Fin Operator tools. - Requested scopes include Write conversations (needed for `add_internal_note`) and read and write articles. Read-only layer - No read-only mode: block `add_internal_note`, `create_article`, `update_article` and the Fin Operator tools in the client. Tools (2026-11-01) - Read: `search`, `fetch`, `search_conversations`, `get_conversation`, `search_contacts`, `get_contact`, `list_companies`, `get_company`, `list_articles`, `search_articles`, `get_article`. - Write: `add_internal_note`, `create_article`, `update_article`. - Fin Operator (OAuth, entitlement and the Use Fin Operator permission): `send_operator_message` (uses credits), `get_operator_response`, `get_proposal_details`, `apply_proposals` (changes live configuration), `reject_proposals`. - Conversations and contacts are text written by outsiders (U): run the untrusted content test. T1 and T3 - T1: no tool returns the workspace on its own. Use a call that returns no customer content where one exists (for example `list_articles` with `per_page` 1); otherwise `search` with limit 1, `fetch` that one ID and use only its app link. Compare the workspace with `stack.md` and the endpoint region with the workspace URL. Do not repeat the conversation's content. - T3: one known conversation's state and assignee. Traps - A 401 means reconnect, not grant more. - Standalone Fin Operator MCP connections stopped on 2026-10-26 (article research): migrate to the main server. Revocation - The user disconnects the connector in each client and clears the client's saved authentication for the server. An admin removes the app's access in Intercom; Intercom's MCP page gives no path, so verify it in the workspace settings at run time and record it in the inventory. ## Customer.io Server and status - `https://mcp.customer.io/mcp` routes to the account's region; use `https://mcp-eu.customer.io/mcp` if a client cannot connect. An admin enables Customer.io MCP in Settings > AI. Auth and scopes - Scopes: `read` (default, no sensitive data), `read:sensitive` (admin toggle plus role), `write` (drafts), `write:live` (sends, subscriptions, suppressions; admin toggle) and `configure` (integrations, webhooks, settings). They are independent: grant less than you hold. - Admin toggles "Allow MCP to edit live data" and "Allow MCP to access sensitive data" are off by default. Read-only layer - Approve only the default read scope at consent and keep both admin toggles off. Tools (2026-11-01) - `cio_prime`, `cio_schema`, `cio_read_api`, `cio_write_api`, `cio_delete_api`, `cio_skills_list`, `cio_skills_read`, `cio_auth_status`. Reads, writes and deletes are separate tools, so client permissions can allow reads only. T1 and T3 - T1: `cio_auth_status` shows accessible workspaces and granted scopes (read only). - T3: one known campaign or broadcast delivery count. Revocation - Each user revokes their own sessions at Settings > Personal Settings > View sessions (under Connected clients); revoking ends the session at once and forces re-authentication. - Account admins cannot view or revoke other users' MCP sessions. Offboarding therefore means deactivating the user, or turning MCP off in Settings > AI, which stops every MCP request at once (sessions resume if it is turned back on). Vendor tooling - Customer.io plugins for Claude, ChatGPT and Codex, and Cursor; the Customer.io CLI for terminal agents.