[object Object]

The Overlap

Both MCP servers and IntegrationHub Spokes expose external capabilities to Agentforce agents. A Spoke is Salesforce-native, packaged, governed through Setup, and runs through the existing External Services and Named Credential infrastructure. An MCP server is vendor-neutral, callable from multiple agent platforms (Agentforce, Claude Desktop, OpenAI Assistants, Cursor), and uses the Anthropic-originated open protocol that became an industry standard in 2025.

Surface differences:
                       Spoke                        MCP Server
Standard               Salesforce External Service  Open MCP protocol
Discovery              Setup, Connect REST API      AgentExchange, MCP registry
Auth                   Named Credential             OAuth or API key
Trust Layer            Native, automatic            Via Salesforce-managed proxy
Audit                  Event Monitoring             OpenTelemetry traces
Distribution           AppExchange managed pkg      AgentExchange listing or self-host
Cross-platform         No (Salesforce-only)         Yes

When Spokes Win

Deep Salesforce integration — Trust Layer coverage by default, native logging through Event Monitoring, packaged distribution via AppExchange with the existing security review process, and Permission-Set-based access control on every Action. Best for actions that need platform-level guarantees: signed payloads, idempotency tokens that survive retries, and audit trails the security team already knows how to query. Stick with Spokes if you’ve already built them; the migration cost rarely beats keeping a working integration.

When MCP Wins

Multi-platform agent strategy. You want the same backend tool callable from Agentforce in production and from Claude Desktop on a developer’s laptop without writing two integrations. New integrations where the MCP server is a thin wrapper over existing REST or GraphQL APIs and the lift is hours, not weeks. Anything where the integration logic is owned by a non-Salesforce team and shouldn’t live in your Salesforce metadata. Vendor-published MCP servers (Stripe, GitHub, Slack) are usually higher quality than equivalent community Spokes.

Decision quick-takes:
  Salesforce-only agent + existing Spoke         Stay with Spoke
  Cross-vendor agents need same tool             MCP
  Need Trust Layer coverage out of the box       Spoke (or MCP via Salesforce proxy)
  Vendor publishes an MCP server                 Use it; skip the Spoke
  Tool will be open-sourced                      MCP
  Heavy Salesforce-event-driven workflow         Spoke

The Hybrid Reality

Mature orgs run both. Spokes for Salesforce-exclusive agents and event-driven workflows. MCP for cross-platform tooling, vendor-published integrations, and developer ergonomics. Don’t force one pattern on everything — the cost is integration sprawl in the wrong direction.

Migration Path: Spoke to MCP

Three steps when you do migrate: (1) wrap the existing Spoke’s HTTP callout in an MCP server (Node.js or Python reference servers are 50–150 lines for most cases), (2) register it in your private MCP registry or list on AgentExchange, (3) flip the Action’s binding from External Service to MCP and run the eval set to confirm parity. Total migration: 1–3 days per integration of moderate complexity.

Common Failure Modes

  • Building MCP servers as raw HTTP wrappers with no schema validation. The agent then receives malformed payloads and hallucinates.
  • Skipping the Trust Layer proxy on PII-handling MCP servers. PII goes to the model unredacted.
  • Running self-hosted MCP servers without uptime monitoring. Agents fail silently when the server goes down because the LLM tries to “help” instead of erroring.

What to Do This Week

List your top 5 agent-callable integrations and tag each as Spoke-keep, MCP-migrate, or new-MCP-build. Don’t migrate working Spokes without a cross-platform reason.

[object Object]
Share