Microsoft made its Dynamics 365 Sales MCP server generally available on Oct. 29. HubSpot already runs a public MCP server for its CRM, and Salesforce has a Data 360 MCP server in developer preview. Three major sales platforms now publish a front door for AI agents they did not build, and the three doors are built differently.
MCP, the Model Context Protocol, is the connection standard that lets an AI client call tools on another system. For a sales organization the practical meaning is simple. A rep or an analyst working in Claude, ChatGPT, Copilot or an internal agent can read and change CRM records without opening the CRM. This feature compares what each vendor has published, what each page leaves unsaid, and what a revenue leader should settle before turning any of it on.
Microsoft: 59 tools behind one endpoint
Taruna Manchanda, Principal Product Manager for Dynamics 365 Sales at Microsoft, and co-author Ritesh Darbarwar published the announcement on the Dynamics 365 blog. They wrote that the Dynamics 365 CX MCP Server for Sales “is generally available today.” The post describes the server as a step toward headless CRM, meaning the data, business logic and actions stay in the CRM while the screens that people use become optional.
Advertisement
At general availability the server exposes 59 tools across six domains: opportunity management, accounts and contacts, lead management, activities and email, product and pricing, and quote and order management. Each environment gets a single Microsoft-hosted, HTTP-based MCP endpoint. The post separates tools from skills. A tool is a building block, and Manchanda and Darbarwar wrote that “each tool performs a single governed action.” A skill combines several tools with instructions to finish a seller task.
The clients Microsoft names include Microsoft Cowork and Sales Agent, Copilot Studio agents, GitHub Copilot CLI and Visual Studio Code, along with other MCP-compatible clients. That list matters because it shows the server is meant for tools outside Microsoft’s own seller experience.
Authentication runs through Microsoft Entra ID, using an OAuth 2.0 on-behalf-of exchange to Dataverse. The Agent 365 Tooling Gateway brokers connections and authentication to the Dataverse environment, and administrators manage connections through it. On permissions, the post says that “access continues to follow existing Dataverse roles and permissions.” A seller’s agent can therefore reach what the seller could already reach.
The post does not mention pricing or credits. A reader should ask whether calls through this server consume anything.
HubSpot: a public endpoint any compatible client can use
HubSpot’s developer documentation describes its remote MCP server as “a publicly hosted endpoint for connecting external AI tools and applications” to its CRM. The page says the server is “designed for agents to take actions within a user’s HubSpot account on their behalf,” in contrast to HubSpot’s separate Developer MCP server, which helps people build on the platform.
The documentation lists contacts, companies, deals and tickets, and “more,” without a full object list. Agents can read, write and update records “as a user would.” Setup has three steps: add an MCP server in the AI tool’s settings, enter https://mcp.hubspot.com, and sign in to HubSpot to authorize. Authentication is OAuth, handled by the AI tool, so an administrator does not manage tokens or configure scopes by hand. The page gives example uses: pulling contact lists by criteria, summarizing pipeline status, turning meeting notes into record updates and analyzing closed-lost deals.
HubSpot’s AI tools page adds the commercial packaging. It says its connectors bring HubSpot customer context into ChatGPT, Claude, Gemini and Microsoft Copilot, and that “permissions are inherited from HubSpot automatically.” The same page says every write is attributed to the Audit Log, which gives an administrator a record of what an agent changed. It also invites readers to connect the HubSpot MCP server to any compatible AI client.
Neither page says which HubSpot plans include the connectors or the server, and the documentation page does not cover the audit log, usage limits or the specific permissions granted. Those answers are on the vendor’s side, and a buyer has to ask for them.
Salesforce: data first, in preview
Salesforce’s entry is the Data 360 MCP server, introduced in a May 26 post by James Nakashima. It is a developer preview. The preview is self-hosted and single-client and requires an upfront installation, and Salesforce says general availability is planned for 2026, when it becomes a Salesforce Hosted MCP Server.
It targets a different layer than the other two. The server exposes Data 360 capabilities through one interface for agents: data setup, identity resolution, segmentation, calculated insights and semantic models, plus a planned skills library with scenario-based instructions. Nakashima wrote that it “lets any MCP client, including AI tools, like Cursor and Claude Code, talk directly with the data you have in Data 360.” The post states the case for it in one sentence: “Agents are only as good as the context they have access to.”
The post does not describe security controls, and it notes that Zero Copy integrations keep data in Snowflake, Databricks, Google BigQuery or AWS rather than moving it. The post describes Data 360 capabilities and does not list CRM objects such as opportunities or accounts, so it is not a like-for-like match for the Microsoft and HubSpot servers. This comparison therefore treats Salesforce as the vendor furthest from general availability on this specific server.
Where the permissions live
The three vendors make the same promise in different words. Microsoft says access follows existing Dataverse roles. HubSpot says permissions are inherited. Both are claims that an agent acts as the user. In our reading, that is the right default and also the source of the main exposure: an agent that acts as a user inherits the user’s whole reach, including records the user would never think to touch on a given task. A rep with access to every account in a region has an agent with access to every account in the region.
The governance work for a sales organization starts there. Our earlier opinion that a sales assistant connector is a data boundary RevOps must own argued that someone has to be named for the connection, and the vendor pages bear that out. Microsoft puts connection management with administrators through the Agent 365 Tooling Gateway. HubSpot gives the administrator an audit log of writes. Neither page says who inside a sales organization decides which agent gets a connection.
The write path deserves the most attention. HubSpot’s documentation says agents can read, write and update, and Microsoft’s six domains include quote and order management. A read that goes wrong produces a bad summary. A write that goes wrong changes a forecast category, a contact owner or a quote. Microsoft describes each tool as a single governed action, which makes the unit of review small, and HubSpot’s audit attribution makes each change traceable afterward. Salesforce’s preview, being self-hosted and single-client, keeps the exposure small for now.
The bill is the unanswered question
None of the three pages states what a call through the server costs. That gap sits next to a pricing change that HubSpot published two weeks ago. The company’s flexible pricing page, updated Oct. 15, says spend controls are on by default, with an account-level credit limit set up to 50% above a customer’s monthly credits that customers can adjust. Customers can also move budget from seats to credits, or to another seat type, without waiting for renewal, and can set credit limits by feature and action.
Jon Dick, Chief Customer Officer at HubSpot, said, “Nobody should have to miss out on getting the most out of AI because they don’t know what the bill will be.” The sentence describes the exposure that outside agents create. Once any compatible client can call the CRM, usage no longer comes only from seats a company bought and counted.
Our coverage of Salesforce and HubSpot letting buyers cap what AI agents can spend and the analysis of AI spend risk moving from the contract to the control panel set out the mechanics. This week’s launches add a new source of metered activity to the same control panel, one that finance will not see until the invoice arrives. Microsoft’s post is silent on whether the MCP server draws on credits, and the answer changes the budget conversation.
What it means for the sales leader
A CRO or head of RevOps who hears that the CRM is now reachable from any AI client should settle five things before approving a connection, and none of them requires a vendor roadmap.
- Name an owner for every connection. The person who approves an agent’s access to deals and quotes should be a person, with a name on a list.
- Start with read access. Summaries of pipeline status and closed-lost analysis, two of the uses HubSpot’s documentation lists, carry little risk. Turn on writes for one object at a time.
- Review the roles behind the agent. Both vendors tie access to existing roles, so a broad role becomes a broad agent. Trim roles before connecting anything.
- Ask each vendor in writing whether calls through the server consume credits or metered usage, and set a cap before the first one.
- Check the audit trail on day one. HubSpot says every write is attributed to the Audit Log. Confirm that a test write appears there, and ask Microsoft where the equivalent record lives.
The sellers will notice the change first. A rep who asks an assistant to log a meeting and update the deal has no reason to open the CRM, so login counts stop being a clean measure of adoption.
What to watch next
Three dates and details will tell the story. Salesforce’s Data 360 server is due for general availability in 2026 and will arrive as a Hosted MCP Server, so its permission model will become comparable to the other two at that point. Microsoft’s general availability means its customers can start using the 59 tools today, which makes the first public accounts of what goes wrong the next useful data. HubSpot’s server is already live, and plan requirements and usage limits are the details its pages leave open.
The common thread is that the CRM has become a service other software calls. Vendors compete on how many tools they expose and on how convincingly they say an agent stays inside a user’s permissions. Buyers will compete on something less visible: who can say, at any hour, which agents are connected to the pipeline, what they may change and what each change cost.
