{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "braze", "name": "Braze", "vendor": "Braze, Inc.", "vendorUrl": "https://www.braze.com", "kind": "http-api", "category": "lifecycle-marketing", "summary": "Braze is a hosted engagement platform that stores customer profiles and events, builds segments and sends campaigns and Canvas journeys by email, SMS, push and in-app message. Agents reach it through a REST API and an official remote MCP server.", "url": "https://www.anchorterminal.com/tools/braze", "markdownUrl": "https://www.anchorterminal.com/tools/braze.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/braze.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/braze.json", "license": "Proprietary service under Braze's Main Subscription Agreement. The deprecated local MCP server on PyPI is MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://mcp.braze.com/mcp", "packages": [], "auth": "mixed", "authNotes": "Access follows a Braze contract or trial, with no app review or partner approval. The REST API takes a workspace API key as a Bearer header at the instance's own host (15 instances, such as https://rest.iad-01.braze.com). A dashboard user creates the key with per-endpoint permissions such as `users.track` or `campaigns.list` and an optional IP allowlist, and neither can be edited afterwards. The remote MCP server takes only OAuth (authorisation code with PKCE S256, dynamic client registration, scopes `mcp:tools`, `mcp:resources` and `mcp:operator`). A company admin must turn on MCP OAuth access, each user needs the Use MCP Server permission per workspace, and calls run with that user's dashboard permissions. Companies that use IP allowlisting can't use the MCP server.", "pricing": "paid", "pricingNotes": "No public prices. Braze sells four editions (Go, Select, Pro, Enterprise) by contract, sized by monthly active users and Action Credits, and the pricing page says there is no free plan. A 14-day free trial is open at try.braze.com, and we couldn't read whether it asks for a card. There's no separate sandbox, and API and MCP calls aren't priced on their own (https://www.braze.com/pricing, checked 2026-10-08).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the MCP pages or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 71, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://www.braze.com/docs/api/home", "llmsTxt": "https://www.braze.com/llms.txt", "capabilities": [ "marketing.profiles", "marketing.events", "marketing.campaigns", "marketing.journeys", "marketing.segments" ], "tags": [ "official", "hosted", "mcp", "oauth", "api-key", "closed-source", "llms-txt", "sales-led", "enterprise", "eu-region", "status-page", "soc2" ], "lastRelease": "2026-09-17", "graded": true, "anchor": { "graded": true, "score": 61.2, "grade": "C", "agentReady": false, "rank": 330, "ranked": true, "rankOf": 629, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 69, "payments": 10, "reliability": 70, "schema": 68, "security": 77, "transparency": 83 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 70, "points": 14, "reason": "Read with the hosted lines and scored on the REST API first, with the remote MCP server beside it. status.braze.com on Statuspage has 132 components across 15 clusters, with a REST APIs component for each cluster (20). Between 10 July and 8 October 2026 it lists seven entries. One reached the API, a minor incident on 5 August with elevated error rates on US-01 and US-03 from 11:30 to 12:55 ET. The one critical entry, on 16 September, was the support portal during a Salesforce outage, and the rest were dashboard latency on US-07, Currents delay on EU-02 and Operator errors (18 of 30, minor incidents only, less 2 for 85 minutes of API errors on two clusters). REST limits are published per endpoint, 250,000 requests an hour by default and 250 a minute for broadcast sends. None were found for the MCP server (13 of 15). Every response carries `X-RateLimit-Limit`, `-Remaining` and `-Reset`, and the docs advise exponential backoff on 5XX. There's no Retry-After, no idempotency key for sends, and the errors page says Braze can't replay REST calls that fail during an incident (9 of 15). No published SLA. The terms promise commercially reasonable efforts and leave service levels to the contract (0). The REST API is generally available and the MCP server has been since 17 September 2026, with 21 of its 71 tools limited to beta programmes (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 68, "points": 11.05, "reason": "No OpenAPI document was found in the docs or the braze-inc GitHub organisation. A public Postman collection covers the REST endpoints, and the MCP tool schemas need a Braze sign-in that we don't have (12 of 25). www.braze.com/llms.txt exists for the marketing site, every docs page has a Markdown copy at /index.md and a Copy for LLM button, and the docs are on Context7 (10). Each endpoint page states its purpose, the key permission it needs and its rate limit. The MCP page lists 71 tools with a one-line description, the REST endpoint behind each and its access type, and says when to use the REST API instead of Operator Connect (15 of 20). Parameters come in tables with required flags and data types, without a schema to validate against (9 of 15). Curl and response examples on each endpoint page, and a table of fatal errors with causes (13 of 15). Release notes are dated and monthly. The REST API has no version scheme, so there is nothing for a client to pin (9 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 50, "points": 8.13, "reason": "71 MCP tools is over the 30 line, with no toolsets or dynamic loading documented. What a user sees follows dashboard permissions and three OAuth scopes. On REST, exports take `fields_to_export` (10 of 25). List endpoints page by `page` in groups of 100 with `sort_direction` and `last_edit.time[gt]`, custom attributes return in groups of 50, and segment exports go to a file with an optional callback (15 of 20). Errors are documented as HTTP status plus a message string and an `errors` array for non-fatal problems, without stable codes. A success response means queued, and `/users/identify` returns success when nothing matched (14 of 20). No idempotency keys. `/users/track/status` reports on asynchronous requests tagged with a `group_id`, and the docs suggest waiting up to five minutes between dependent calls. We couldn't read MCP annotations (5 of 20). Few required parameters on reads. The only REST client library is a Ruby one marked beta, last pushed in January 2022 (6 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 77, "points": 13.48, "reason": "The MCP server uses OAuth with PKCE S256, dynamic client registration, short-lived access tokens with refresh and the scopes `mcp:tools`, `mcp:resources` and `mcp:operator`, checked against an allowlist of redirect URIs. REST keys are limited to named endpoint permissions and optional IP allowlists and travel in a Bearer header. MCP tokens can be revoked only for the whole company at once (29 of 30). MCP access mirrors the user's dashboard permissions, needs a Use MCP Server permission that is off by default in each workspace, and has no tools that return user-level personal data. There is no confirmation step, Operator Connect acts without per-step approval, and Braze advises against a client's auto mode (15 of 20). Campaign content, catalogue items and attribute names can carry text written by others. The docs tell users to review proposed actions and give no prompt-injection guidance (5 of 15). The security event report records OAuth connections and REST key creation and removal, with export to S3, and an API usage dashboard shows traffic. Edits by individual MCP update tools don't appear in campaign edit history (9 of 15). security.txt valid to 1 January 2031 pointing to a HackerOne programme, ISO 27001, SOC 2 Type II and an annual third-party penetration test. We couldn't read whether the programme pays bounties (19 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 10, "points": 1.25, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page names four editions (Go, Select, Pro, Enterprise) priced by monthly active users and Action Credits, shows no figures and sends buyers to sales (0). It says there is no free plan. A 14-day trial is open at try.braze.com, and we couldn't read whether the form asks for a card, so half marks (10 of 20). A person signs up, creates a REST key in the dashboard or approves OAuth in a browser, and an admin must switch MCP access on first (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 69, "points": 6.04, "reason": "The newest release notes are dated 17 September 2026 and move the remote MCP server to general availability (30). Three dated releases since 10 July (23 July, 20 August and 17 September), which just meets the line (20). Closed service with public release notes, a support portal, a product feedback route for MCP clients and the Bonfire community. We didn't test support (10 of 15). The server isn't in the official MCP registry, where a search for braze returns only a third-party project. There is no current official REST SDK, and the mobile and web SDK repositories were pushed in October 2026 (4 of 15). The earlier local MCP server on PyPI, 1.2.0 of 14 May 2026, is deprecated with no further updates (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "note": "editorial 69, provenance 96", "reason": "Closed service under a Main Subscription Agreement last updated 13 October 2025, with SDK source public (15). The data retention page keeps profile data for the life of the account, up to 90 days in internal systems, two years before personal data is removed from the Data Lake and six months in backups. The DPA (revision 28 August 2025) commits to export, deletion and a certificate of deletion at termination, and the privacy policy is dated 23 June 2026. The retention page was last revised on 1 April 2024 (25 of 30). A deprecations log with dates exists and the local MCP server is marked deprecated, but no notice period for REST endpoints or MCP tools was found (9 of 20). The sub-processor list of 1 June 2026 gives each entity's service and location with 30 days' notice of additions, and the security datasheet names the AWS regions for US, EU, Australia, Indonesia, Japan and South Korea hosting (20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "71 MCP tools is over the 30 line, with no toolsets or dynamic loading documented. What a user sees follows dashboard permissions and three OAuth scopes. On REST, exports take `fields_to_export` (10 of 25). List endpoints page by `page` in groups of 100 with `sort_direction` and `last_edit.time[gt]`, custom attributes return in groups of 50, and segment exports go to a file with an optional callback (15 of 20). Errors are documented as HTTP status plus a message string and an `errors` array for non-fatal problems, without stable codes. A success response means queued, and `/users/identify` returns success when nothing matched (14 of 20). No idempotency keys. `/users/track/status` reports on asynchronous requests tagged with a `group_id`, and the docs suggest waiting up to five minutes between dependent calls. We couldn't read MCP annotations (5 of 20). Few required parameters on reads. The only REST client library is a Ruby one marked beta, last pushed in January 2022 (6 of 15).", "maintenance": "The newest release notes are dated 17 September 2026 and move the remote MCP server to general availability (30). Three dated releases since 10 July (23 July, 20 August and 17 September), which just meets the line (20). Closed service with public release notes, a support portal, a product feedback route for MCP clients and the Bonfire community. We didn't test support (10 of 15). The server isn't in the official MCP registry, where a search for braze returns only a third-party project. There is no current official REST SDK, and the mobile and web SDK repositories were pushed in October 2026 (4 of 15). The earlier local MCP server on PyPI, 1.2.0 of 14 May 2026, is deprecated with no further updates (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page names four editions (Go, Select, Pro, Enterprise) priced by monthly active users and Action Credits, shows no figures and sends buyers to sales (0). It says there is no free plan. A 14-day trial is open at try.braze.com, and we couldn't read whether the form asks for a card, so half marks (10 of 20). A person signs up, creates a REST key in the dashboard or approves OAuth in a browser, and an admin must switch MCP access on first (0).", "reliability": "Read with the hosted lines and scored on the REST API first, with the remote MCP server beside it. status.braze.com on Statuspage has 132 components across 15 clusters, with a REST APIs component for each cluster (20). Between 10 July and 8 October 2026 it lists seven entries. One reached the API, a minor incident on 5 August with elevated error rates on US-01 and US-03 from 11:30 to 12:55 ET. The one critical entry, on 16 September, was the support portal during a Salesforce outage, and the rest were dashboard latency on US-07, Currents delay on EU-02 and Operator errors (18 of 30, minor incidents only, less 2 for 85 minutes of API errors on two clusters). REST limits are published per endpoint, 250,000 requests an hour by default and 250 a minute for broadcast sends. None were found for the MCP server (13 of 15). Every response carries `X-RateLimit-Limit`, `-Remaining` and `-Reset`, and the docs advise exponential backoff on 5XX. There's no Retry-After, no idempotency key for sends, and the errors page says Braze can't replay REST calls that fail during an incident (9 of 15). No published SLA. The terms promise commercially reasonable efforts and leave service levels to the contract (0). The REST API is generally available and the MCP server has been since 17 September 2026, with 21 of its 71 tools limited to beta programmes (10).", "schema": "No OpenAPI document was found in the docs or the braze-inc GitHub organisation. A public Postman collection covers the REST endpoints, and the MCP tool schemas need a Braze sign-in that we don't have (12 of 25). www.braze.com/llms.txt exists for the marketing site, every docs page has a Markdown copy at /index.md and a Copy for LLM button, and the docs are on Context7 (10). Each endpoint page states its purpose, the key permission it needs and its rate limit. The MCP page lists 71 tools with a one-line description, the REST endpoint behind each and its access type, and says when to use the REST API instead of Operator Connect (15 of 20). Parameters come in tables with required flags and data types, without a schema to validate against (9 of 15). Curl and response examples on each endpoint page, and a table of fatal errors with causes (13 of 15). Release notes are dated and monthly. The REST API has no version scheme, so there is nothing for a client to pin (9 of 15).", "security": "The MCP server uses OAuth with PKCE S256, dynamic client registration, short-lived access tokens with refresh and the scopes `mcp:tools`, `mcp:resources` and `mcp:operator`, checked against an allowlist of redirect URIs. REST keys are limited to named endpoint permissions and optional IP allowlists and travel in a Bearer header. MCP tokens can be revoked only for the whole company at once (29 of 30). MCP access mirrors the user's dashboard permissions, needs a Use MCP Server permission that is off by default in each workspace, and has no tools that return user-level personal data. There is no confirmation step, Operator Connect acts without per-step approval, and Braze advises against a client's auto mode (15 of 20). Campaign content, catalogue items and attribute names can carry text written by others. The docs tell users to review proposed actions and give no prompt-injection guidance (5 of 15). The security event report records OAuth connections and REST key creation and removal, with export to S3, and an API usage dashboard shows traffic. Edits by individual MCP update tools don't appear in campaign edit history (9 of 15). security.txt valid to 1 January 2031 pointing to a HackerOne programme, ISO 27001, SOC 2 Type II and an annual third-party penetration test. We couldn't read whether the programme pays bounties (19 of 20).", "transparency": "Closed service under a Main Subscription Agreement last updated 13 October 2025, with SDK source public (15). The data retention page keeps profile data for the life of the account, up to 90 days in internal systems, two years before personal data is removed from the Data Lake and six months in backups. The DPA (revision 28 August 2025) commits to export, deletion and a certificate of deletion at termination, and the privacy policy is dated 23 June 2026. The retention page was last revised on 1 April 2024 (25 of 30). A deprecations log with dates exists and the local MCP server is marked deprecated, but no notice period for REST endpoints or MCP tools was found (9 of 20). The sub-processor list of 1 June 2026 gives each entity's service and location with 30 days' notice of additions, and the security datasheet names the AWS regions for US, EU, Australia, Indonesia, Japan and South Korea hosting (20)." }, "sources": [ { "what": "REST API overview, keys and permissions", "url": "https://www.braze.com/docs/api/basics", "seen": "2026-10-08" }, { "what": "API rate limits", "url": "https://www.braze.com/docs/api/api_limits", "seen": "2026-10-08" }, { "what": "API errors and responses", "url": "https://www.braze.com/docs/api/errors", "seen": "2026-10-08" }, { "what": "Braze MCP server", "url": "https://www.braze.com/docs/user_guide/brazeai/mcp_server", "seen": "2026-10-08" }, { "what": "MCP server functions", "url": "https://www.braze.com/docs/user_guide/brazeai/mcp_server/available_api_functions", "seen": "2026-10-08" }, { "what": "MCP server setup", "url": "https://www.braze.com/docs/user_guide/brazeai/mcp_server/setup", "seen": "2026-10-08" }, { "what": "Operator Connect", "url": "https://www.braze.com/docs/user_guide/brazeai/mcp_server/operator_connect", "seen": "2026-10-08" }, { "what": "OAuth admin settings", "url": "https://www.braze.com/docs/user_guide/administer/global/admin_settings/oauth_admin", "seen": "2026-10-08" }, { "what": "MCP protected resource metadata", "url": "https://mcp.braze.com/.well-known/oauth-protected-resource", "seen": "2026-10-08" }, { "what": "OAuth authorisation server metadata", "url": "https://dashboard.braze.com/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "security settings and event report", "url": "https://www.braze.com/docs/user_guide/administer/global/admin_settings/security_settings", "seen": "2026-10-08" }, { "what": "release notes", "url": "https://www.braze.com/docs/releases/home", "seen": "2026-10-08" }, { "what": "deprecations", "url": "https://www.braze.com/docs/releases/deprecations", "seen": "2026-10-08" }, { "what": "data retention", "url": "https://www.braze.com/docs/api/data_retention", "seen": "2026-10-08" }, { "what": "Postman collection", "url": "https://www.braze.com/docs/api/postman_collection", "seen": "2026-10-08" }, { "what": "building with an LLM", "url": "https://www.braze.com/docs/developer_guide/getting_started/build_with_llm", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://braze.statuspage.io/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://www.braze.com/pricing", "seen": "2026-10-08" }, { "what": "free trial terms", "url": "https://www.braze.com/company/legal/free-trial-terms", "seen": "2026-10-08" }, { "what": "Main Subscription Agreement", "url": "https://www.braze.com/company/legal/terms", "seen": "2026-10-08" }, { "what": "data processing addendum", "url": "https://www.braze.com/company/legal/dpa", "seen": "2026-10-08" }, { "what": "sub-processors", "url": "https://www.braze.com/company/legal/subprocessors", "seen": "2026-10-08" }, { "what": "security, privacy and architecture datasheet", "url": "https://www.braze.com/company/legal/security-schedule", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.braze.com/company/legal/privacy", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.braze.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=braze", "seen": "2026-10-08" }, { "what": "local MCP server on PyPI", "url": "https://pypi.org/project/braze-mcp-server/", "seen": "2026-10-08" }, { "what": "RDAP for braze.com", "url": "https://rdap.verisign.com/com/v1/domain/braze.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: whether the 14-day trial at try.braze.com asks for a card. The form is rendered by JavaScript and we couldn't read it", "unchecked: MCP tool input schemas, annotations and error shapes, which need a Braze sign-in", "unchecked: whether the HackerOne programme named in security.txt pays bounties. The page didn't render for our reader", "unchecked: weekly downloads of braze-mcp-server on PyPI. pypistats.org answered 429", "No OpenAPI document, published SLA, MCP rate limit or REST deprecation notice period was found in the reviewed documentation", "The trial page says 14 days and the free trial terms say 30 days unless otherwise specified. We recorded 14", "Scored on the REST API first because the MCP server has no profile, event or send tools. A reader who needs only analytics and content would weigh the MCP lines more" ] }, "negative": 0, "verdict": "The REST API covers profiles, events, sends and exports with keys limited to named endpoints, and the remote MCP server adds 71 tools under OAuth with PKCE that return no user-level personal data. No OpenAPI document, idempotency keys, published price or SLA were found, and MCP writes run without a confirmation step.", "bestFor": "A company already on Braze that wants an agent to read campaign and Canvas results, manage catalogues and templates through MCP, or write profiles and trigger sends through REST.", "strengths": [ "REST API keys carry per-endpoint permissions and optional IP allowlists, and a key's scope can't be edited after creation", "Remote MCP server with OAuth, PKCE S256, dynamic client registration and three scopes, generally available since 17 September 2026", "MCP tools return no user-level personal data, and the Use MCP Server permission is off by default for each workspace", "Rate limits published per endpoint, with `X-RateLimit-Limit`, `-Remaining` and `-Reset` headers on every response", "Sub-processor list of 1 June 2026 with locations, 30 days' notice of additions and hosting regions named for six countries or regions" ], "weaknesses": [ "No public prices. Editions, monthly active users and Action Credits are sold by contract, and the pricing page says there is no free plan", "No OpenAPI document found. The machine-readable contract is a public Postman collection", "No idempotency keys on sends or `/users/track`, and Braze says it can't replay REST calls that fail during an incident", "71 MCP tools with no documented toolsets, 21 of them limited to beta programmes", "Edits made through individual MCP update tools don't appear in campaign edit history, and Operator Connect acts without per-step approval" ], "agentNotes": [ "Use the REST host for the customer's instance, such as https://rest.iad-01.braze.com or https://rest.fra-01.braze.eu. A key sent to the wrong instance returns 401", "Create a REST key with only the permissions the task needs. Scope and IP allowlist can't be edited later, so a change means a new key", "Call `get_workspaces` first on MCP. Every other tool needs the returned workspace id as `app_group_id`, and the wrong workspace is a documented failure", "Use REST for profiles, events and sends. The MCP server has no user-level tools and can't trigger a message to a named user", "Treat `\"message\": \"success\"` as queued, not delivered. Add a `group_id` to `/users/track` and poll `/users/track/status`, and don't resend a trigger call blindly" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.2 } ], "editorialScores": { "ergonomics": 50, "maintenance": 69, "payments": 10, "reliability": 70, "schema": 68, "security": 77, "transparency": 69 }, "provenanceScore": 96 }, "connect": { "http": "curl --location -g --request GET 'https://rest.iad-01.braze.com/campaigns/list?page=0\u0026include_archived=false\u0026sort_direction=desc' \\\n--header 'Authorization: Bearer YOUR-REST-API-KEY'", "config": { "mcpServers": { "braze": { "url": "https://mcp.braze.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/marketing.profiles", "tool": "https://letme.dev/braze" }, "notable": [ "The remote MCP server answers at https://mcp.braze.com/mcp (US) and https://mcp.braze.eu/mcp (EU), became generally available on 17 September 2026 and replaces a local server from August 2025 that is now deprecated (https://www.braze.com/docs/user_guide/brazeai/mcp_server)", "The MCP function page lists 71 tools in 16 groups, 37 read and 34 write, and 21 of them (campaign authoring, segment creation, Operator Connect) are limited to beta programmes (https://www.braze.com/docs/user_guide/brazeai/mcp_server/available_api_functions)", "MCP tools return no user-level personal data, so profiles, events and sends to named users go through the REST API (https://www.braze.com/docs/user_guide/brazeai/mcp_server)", "Most REST endpoints share 250,000 requests an hour per workspace, reset on the clock hour. Broadcast sends are held to 250 a minute and 10 a minute per unique audience (https://www.braze.com/docs/api/api_limits)", "Each `/users/track` request holds up to 75 objects across attributes, events and purchases and is processed asynchronously (https://www.braze.com/docs/api/api_limits)", "Operator Connect, in beta, passes a prompt to BrazeAI Operator through `send_operator_prompt` and acts without per-step approval. It can't launch campaigns or Canvases (https://www.braze.com/docs/user_guide/brazeai/mcp_server/operator_connect)", "status.braze.com lists one minor REST API incident in the 90 days to 8 October 2026, on US-01 and US-03 on 5 August (https://braze.statuspage.io/api/v2/incidents.json)" ], "area": "communication", "details": [ { "label": "REST API", "value": "Twelve collections (catalogues, Cloud Data Ingestion, email lists, export, media library, messages, preference centre, SCIM, SMS, subscription groups, templates, user data), served from the instance's own host such as https://rest.iad-01.braze.com. No version scheme" }, { "label": "MCP server", "value": "Remote, https://mcp.braze.com/mcp (US) or https://mcp.braze.eu/mcp (EU), 71 tools in 16 groups. Generally available since 17 September 2026. No user-level personal data. Not available to companies that use IP allowlisting" }, { "label": "MCP tools", "value": "Workspaces 1, campaigns 19, Canvases 4, catalogues 13, custom attributes 1, custom events 3, Cloud Data Ingestion 3, KPIs 4, media library 1, purchases 3, segments 6, sends 1, sessions 1, email templates 4, Content Blocks 4, Operator 3. 21 are limited to beta programmes" }, { "label": "Credentials", "value": "REST API key per workspace with per-endpoint permissions and optional IP allowlist, fixed at creation. MCP by OAuth with PKCE S256, dynamic client registration and scopes mcp:tools, mcp:resources, mcp:operator" }, { "label": "Access", "value": "Contract or 14-day trial. A dashboard user creates REST keys. For MCP a company admin turns on MCP OAuth access and grants Use MCP Server per workspace" }, { "label": "Rate limits", "value": "250,000 requests an hour shared by most endpoints, reset on the clock hour. Broadcast sends 250 a minute and 10 a minute per unique audience. /users/track 3,000 requests per three seconds for customers priced on data points, otherwise by contract. /sends/id/create 100 a day. None found for MCP" }, { "label": "Batching", "value": "/users/track takes up to 75 objects a request, messaging endpoints up to 50 external ids, catalogue item calls up to 50 items. Most request bodies up to 4 MB" }, { "label": "Errors", "value": "HTTP status with a message string and an errors array. 429 with X-RateLimit-Limit, -Remaining and -Reset headers. Exponential backoff advised on 5XX. A success response means queued, not delivered" }, { "label": "Segments", "value": "REST lists segments, reads details and size series and exports members to a file. Creating and editing segments is an MCP beta tool" }, { "label": "Audit", "value": "Security event report (CSV, last 10,000 events, or export to S3) records OAuth connections and REST key creation and removal. Operator Connect edits appear in campaign edit history, individual MCP update tools don't" }, { "label": "Docs for agents", "value": "llms.txt on www.braze.com, a Markdown copy of each docs page at /index.md, a public Postman collection and the docs on Context7. No OpenAPI found" }, { "label": "SDKs", "value": "No current REST SDK. A Ruby client library marked beta, last pushed January 2022, covers the user endpoints. Mobile and web SDKs are public on GitHub" }, { "label": "Certifications", "value": "ISO 27001 and SOC 2 Type II per braze.com/product/trust, HIPAA-compliant per the security datasheet of 14 April 2026, annual third-party penetration test, HackerOne programme" }, { "label": "Data retention", "value": "Profile data for the life of the account. Up to 90 days in internal systems, personal data removed from the Data Lake after two years, backups kept six months (page revised 1 April 2024)" }, { "label": "Hosting", "value": "AWS in the US, Frankfurt, Sydney, Jakarta, Tokyo and Seoul, with 15 instances (nine US, two EU, and one each in Australia, Indonesia, Japan and South Korea)" } ], "provenance": { "legalEntity": "Braze, Inc.", "domain": "braze.com", "domainRegistered": "2000-01-19", "endpointOnVendorDomain": true, "terms": "https://www.braze.com/company/legal/terms", "privacy": "https://www.braze.com/company/legal/privacy", "statusPage": "https://status.braze.com", "changelog": "https://www.braze.com/docs/releases/home", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Main Subscription Agreement (last updated 13 October 2025) names Braze, Inc., and the privacy policy (last updated 23 June 2026) says it is a U.S. company headquartered in New York.", "REST hosts are on braze.com for the US, Australia, Indonesia, Japan and South Korea and on braze.eu for the EU. The MCP server is at mcp.braze.com and mcp.braze.eu.", "www.braze.com/.well-known/security.txt expires 2031-01-01, gives security@braze.com and points its policy to hackerone.com/braze_inc.", "status.braze.com redirects to braze.statuspage.io.", "RDAP for braze.com gives a registration date of 2000-01-19.", "The DPA (revision 28 August 2025), the sub-processor list (1 June 2026) and the security datasheet (14 April 2026) are PDFs linked from braze.com/company/legal." ], "score": 96, "checks": [ { "check": "Legal entity named", "value": "Braze, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "braze.com, registered 2000-01-19 (26 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.braze.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.braze.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.braze.com/company/legal/terms", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-10-13", "words": 5694, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: 13 October 2025", "says": "Last updated 2025-10-13" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement shall be governed exclusively by the internal laws of the State of New York, without regard to its conflicts of laws rules.", "says": "The law of the State of New York" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…RESPECT OF THE TWELVE-MONTH TERM IN WHICH THE INCIDENT GIVING RISE TO LIABILITY OCCURRED, PROVIDED THAT IN NO EVENT SHALL EITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER HEREUNDER.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "In the event that Customer is in breach of Customer’s obligations under Section 2, Braze may suspend Customer or Dashboard User access to the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "…written notice, Braze may terminate this Agreement and any or all outstanding Order Forms and Customer shall not be entitled to a refund of any prepaid fees, but shall remain obligated to pay unpaid fees owed, even if not yet invoiced, including any overages to entitlements, all as set forth on Customer's Order Forms." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "(f) access or provide access to a Dashboard User to the Services or the SDK for competitive purposes;", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "Subscriptions renew automatically for a period equal to the expiring term, with 60 days' notice and a price increase of up to 7 per cent.", "quote": "Braze will provide sixty (60) days’ advance notice of automatic renewal, including any price increase not to exceed 7%." }, { "date": "2026-10-08", "text": "Braze may use the customer's name and logo to identify it as a customer.", "quote": "Braze may use Customer’s name verbally and Customer’s name and logo in writing to identify Customer as a customer of Braze." }, { "date": "2026-10-08", "text": "Braze accepts no liability for output or for actions the customer takes based on output.", "quote": "BRAZE SHALL HAVE NO LIABILITY FOR OUTPUT AND/OR ACTIONS TAKEN BY CUSTOMER BASED ON THE OUTPUT." } ] }, { "kind": "privacy", "url": "https://www.braze.com/company/legal/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-06-23", "words": 5267, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: 23 June 2026", "says": "Last updated 2026-06-23" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Privacy Policy provides you with a description of how we collect and use data relating to or identifying individuals (“Personal Data”)." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We determine the appropriate retention period for Personal Data on the basis of the purpose for which we process the Personal Data, the amount, nature and sensitivity of your Personal Data processed, the potential risk of harm from unauthorized use or disclosure of your Personal Data and whether we can achieve the pur…" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Device Data: information may include IP address (or proxy server), device and application identification numbers, location, browser type, Internet service provider and/or mobile carrier, and operating system and system configuration information;" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "To opt out of all selling and sharing, you may click on the \"Do Not Sell or Share my Personal Information\" link in the footer of our Websites and follow the instructions therein.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "If you have a question about your privacy rights, please email us at [email protected]." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have a question about your privacy rights, please email us at [email protected].", "says": "Gives an email address, hidden from our reader by the page" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Data Privacy Framework, the UK Extension to the EU-U.S.", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may also disclose your Personal Data to technology and solutions partners in connection with customer or technical support, marketing, business development and account management, and to our partners for marketing and personalized advertising purposes." } ], "notes": [ { "date": "2026-10-08", "text": "Third-party session replay records the interactions and personal data of dashboard users of the service, as well as website visitors.", "quote": "We use session replay technology provided by third-party vendors to record the interactions and Personal Data of Dashboard Users and visitors to certain Websites, such as our learning management system and www.braze.com." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/braze.json", "live": { "slug": "braze", "probe": { "target": "https://mcp.braze.com/mcp", "method": "get", "lastAt": "2026-10-08T17:36:32.017450571Z", "lastOk": true, "lastStatus": 401, "lastMs": 270, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 271, "p95ms24h": 319, "samples24h": 25, "samples30d": 25, "days": [ { "date": "2026-10-08", "probes": 25, "ok": 25 } ] }, "vendorStatus": { "page": "https://status.braze.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T17:38:05.408926683Z" }, "securityTxt": { "url": "https://braze.com/.well-known/security.txt", "state": "valid", "expires": "2031-01-01T04:59:00.000Z", "checkedAt": "2026-10-08T15:39:06.359227057Z" }, "updatedAt": "2026-10-08T17:38:05.408926683Z" } } }