Why the Model Context Protocol matters more than most people realize — and what Salesforce just made official
Two weeks ago at TrailblazerDX, Salesforce co-founder Parker Harris said the quiet part out loud: “Why should you ever log into Salesforce again? Maybe you never will.” Then Salesforce shipped Headless 360 — every capability the platform has, exposed as an API, MCP tool, or CLI command. The CRM most enterprises pay for is being deliberately rebuilt to be operated by agents instead of humans clicking through a UI.
That’s the headline. The deeper signal is that every major platform shipped an MCP server this year. Salesforce. DocuSign. Azure DevOps. GitHub. Notion. Slack. Whatever system you depend on, an AI agent can probably talk to it through the Model Context Protocol — and if it can’t yet, it will soon.
This isn’t a branding cycle. MCP is doing for AI agents what REST did for web services: standardizing the protocol layer that everything connects through. And like every protocol shift before it, the rush to adopt is going to outpace the discipline to govern.
What MCP actually is
The Model Context Protocol is an open standard, originally created by Anthropic, that defines how AI agents discover and use tools. Build an MCP server once, and every MCP-compatible agent can use it. If that sounds like what APIs did for system-to-system integration, you’re tracking the right analogy.
The mess this creates
Agents with tools are powerful, and powerful things break loudly when they’re not governed. A handful of failure modes already surfacing in production:
- Runaway token consumption. An agent that hits an MCP server, reasons over a verbose response, hits another tool, and chains again can burn six figures of inference cost in a weekend. There’s no rate limit on a bad agent loop by default.
- Blown API quotas. Most enterprise APIs were sized for a few thousand calls per day from known integrations. An untethered agent chews through a year’s quota in an afternoon.
- Destructive operations. This year’s headline incidents — agents deleting production databases, force-pushing branches, sending mass emails — were governance failures. The MCP server exposed the capability. The agent had the credentials. Nothing in between asked “should this happen?”
- Credential and data sprawl. Every MCP server is a new auth boundary. Without a registry, no one knows what’s connected to what, who owns it, or where the secrets live.
Wiring every agent directly to every system’s MCP server is the protocol-shift version of the point-to-point integration mess MuleSoft was built to solve a decade ago. Different protocol, same architectural smell — and at agent speed and volume, it’s worse.
The protocol is the easy part. The governance — what an agent is allowed to do, against which systems, with whose credentials, at what rate, with what audit trail — is where the next three years of enterprise pain (and services revenue) lives.
What MuleSoft Agent Fabric actually is
MuleSoft built a billion-dollar business on one insight: enterprises have too many systems, and connecting them with point-to-point custom code doesn’t scale. Agent Fabric — announced last September and expanded twice since — applies that same logic, one layer up. Five components anchor it:
- Agent Registry — the central catalog where every agent, MCP server, and A2A server gets registered and made discoverable. The “what’s connected to what” question gets an answer.
- Agent Broker — intelligent routing across agents and tools, organized into business-focused domains, with deterministic orchestration in beta. Cross-system, cross-vendor agent coordination without the spaghetti.
- Agent Governance (Flex Gateway for MCP and A2A) — the policy layer. Authentication, rate limiting, attribute-based access control, threat detection. Battle-tested API gateway patterns applied to agent traffic.
- Agent Visualizer — runtime map of the agent ecosystem with search, filter, and dependency tracing. Black-box AI made observable.
- Agent Scanners (added in January) — auto-discover agents already running in Agentforce, Amazon Bedrock, Google Vertex AI, and Microsoft Copilot Studio. The agents your teams have already shadow-deployed get pulled into governance instead of staying invisible.
Underneath this, the MCP building blocks — MCP Connector, MCP Bridge, Anypoint Code Builder MCP Server, plus the Salesforce-hosted MCP servers that shipped with Headless 360 — are all in place. The question is no longer “can my agent talk to my systems,” but “what fabric is governing and orchestrating in between?”
The practitioner perspective
We build MCP servers — not as a product, but as the operating infrastructure for our own AI Chief of Staff. Notion, Slack, Gmail, Calendar, DocuSign — they all run through MCP for us, with rate limits, scoped credentials, and audit logs, because we learned the hard way that the protocol layer is the easy part. An agent’s behavior is decided by the context it’s given and the boundaries it operates inside. MuleSoft’s bet — and ours — is that the boundaries are where the leverage lives.
What to do now
Headless 360 makes one thing crisp: the data, workflows, and trust layer your enterprise has spent years investing in are about to be reachable from any agent on any surface. That’s an enormous unlock and an enormous attack surface — and what’s sitting between the agents and the systems will determine how it goes.
If you’re a MuleSoft customer: every API you’ve already deployed is about to become dramatically more valuable — but only if someone connects it to the agent layer with governance intact. Ask your partner about their Agent Fabric strategy. If they don’t have one, that tells you something.
If you’re an integration partner: customers will vibe-code their way into the same governance nightmare they had with point-to-point integrations a decade ago. The partners running MCP and Agent Fabric in production today — with rate limits, audit trails, registries, and observability — will own the next wave.
The API economy created a $30B+ services market. The MCP economy will be larger. The question is who builds it with the discipline to keep it running.