{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/customer-io.json", "name": "Customer.io", "score": 74.5, "shared": [ "marketing.profiles", "marketing.events", "marketing.segments", "marketing.campaigns", "marketing.journeys" ], "slug": "customer-io" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/klaviyo.json", "name": "Klaviyo API + MCP", "score": 71.7, "shared": [ "marketing.profiles", "marketing.events", "marketing.segments", "marketing.campaigns", "marketing.journeys" ], "slug": "klaviyo" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/iterable.json", "name": "Iterable", "score": 55.2, "shared": [ "marketing.profiles", "marketing.events", "marketing.segments", "marketing.campaigns", "marketing.journeys" ], "slug": "iterable" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/activecampaign.json", "name": "ActiveCampaign", "score": 50.5, "shared": [ "marketing.profiles", "marketing.events", "marketing.segments", "marketing.campaigns", "marketing.journeys" ], "slug": "activecampaign" } ], "tool": { "slug": "braze", "name": "Braze", "vendor": "Braze, Inc.", "vendorUrl": "https://www.braze.com", "kind": "http-api", "category": "lifecycle-marketing", "summary": "Braze is a hosted engagement platform that stores customer profiles and events, builds segments and sends campaigns and Canvas journeys by email, SMS, push and in-app message. Agents reach it through a REST API and an official remote MCP server.", "url": "https://www.anchorterminal.com/tools/braze", "markdownUrl": "https://www.anchorterminal.com/tools/braze.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/braze.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/braze.json", "license": "Proprietary service under Braze's Main Subscription Agreement. The deprecated local MCP server on PyPI is MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://mcp.braze.com/mcp", "packages": [], "auth": "mixed", "authNotes": "Access follows a Braze contract or trial, with no app review or partner approval. The REST API takes a workspace API key as a Bearer header at the instance's own host (15 instances, such as https://rest.iad-01.braze.com). A dashboard user creates the key with per-endpoint permissions such as `users.track` or `campaigns.list` and an optional IP allowlist, and neither can be edited afterwards. The remote MCP server takes only OAuth (authorisation code with PKCE S256, dynamic client registration, scopes `mcp:tools`, `mcp:resources` and `mcp:operator`). A company admin must turn on MCP OAuth access, each user needs the Use MCP Server permission per workspace, and calls run with that user's dashboard permissions. Companies that use IP allowlisting can't use the MCP server.", "pricing": "paid", "pricingNotes": "No public prices. Braze sells four editions (Go, Select, Pro, Enterprise) by contract, sized by monthly active users and Action Credits, and the pricing page says there is no free plan. A 14-day free trial is open at try.braze.com, and we couldn't read whether it asks for a card. There's no separate sandbox, and API and MCP calls aren't priced on their own (https://www.braze.com/pricing, checked 2026-10-08).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the MCP pages or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 71, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://www.braze.com/docs/api/home", "llmsTxt": "https://www.braze.com/llms.txt", "capabilities": [ "marketing.profiles", "marketing.events", "marketing.campaigns", "marketing.journeys", "marketing.segments" ], "tags": [ "official", "hosted", "mcp", "oauth", "api-key", "closed-source", "llms-txt", "sales-led", "enterprise", "eu-region", "status-page", "soc2" ], "lastRelease": "2026-09-17", "graded": true, "anchor": { "graded": true, "score": 61.2, "grade": "C", "agentReady": false, "rank": 371, "ranked": true, "rankOf": 722, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 69, "payments": 10, "reliability": 70, "schema": 68, "security": 77, "transparency": 83 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 70, "points": 14, "reason": "Read with the hosted lines and scored on the REST API first, with the remote MCP server beside it. status.braze.com on Statuspage has 132 components across 15 clusters, with a REST APIs component for each cluster (20). Between 10 July and 8 October 2026 it lists seven entries. One reached the API, a minor incident on 5 August with elevated error rates on US-01 and US-03 from 11:30 to 12:55 ET. The one critical entry, on 16 September, was the support portal during a Salesforce outage, and the rest were dashboard latency on US-07, Currents delay on EU-02 and Operator errors (18 of 30, minor incidents only, less 2 for 85 minutes of API errors on two clusters). REST limits are published per endpoint, 250,000 requests an hour by default and 250 a minute for broadcast sends. None were found for the MCP server (13 of 15). Every response carries `X-RateLimit-Limit`, `-Remaining` and `-Reset`, and the docs advise exponential backoff on 5XX. There's no Retry-After, no idempotency key for sends, and the errors page says Braze can't replay REST calls that fail during an incident (9 of 15). No published SLA. The terms promise commercially reasonable efforts and leave service levels to the contract (0). The REST API is generally available and the MCP server has been since 17 September 2026, with 21 of its 71 tools limited to beta programmes (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 68, "points": 11.05, "reason": "No OpenAPI document was found in the docs or the braze-inc GitHub organisation. A public Postman collection covers the REST endpoints, and the MCP tool schemas need a Braze sign-in that we don't have (12 of 25). www.braze.com/llms.txt exists for the marketing site, every docs page has a Markdown copy at /index.md and a Copy for LLM button, and the docs are on Context7 (10). Each endpoint page states its purpose, the key permission it needs and its rate limit. The MCP page lists 71 tools with a one-line description, the REST endpoint behind each and its access type, and says when to use the REST API instead of Operator Connect (15 of 20). Parameters come in tables with required flags and data types, without a schema to validate against (9 of 15). Curl and response examples on each endpoint page, and a table of fatal errors with causes (13 of 15). Release notes are dated and monthly. The REST API has no version scheme, so there is nothing for a client to pin (9 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 50, "points": 8.13, "reason": "71 MCP tools is over the 30 line, with no toolsets or dynamic loading documented. What a user sees follows dashboard permissions and three OAuth scopes. On REST, exports take `fields_to_export` (10 of 25). List endpoints page by `page` in groups of 100 with `sort_direction` and `last_edit.time[gt]`, custom attributes return in groups of 50, and segment exports go to a file with an optional callback (15 of 20). Errors are documented as HTTP status plus a message string and an `errors` array for non-fatal problems, without stable codes. A success response means queued, and `/users/identify` returns success when nothing matched (14 of 20). No idempotency keys. `/users/track/status` reports on asynchronous requests tagged with a `group_id`, and the docs suggest waiting up to five minutes between dependent calls. We couldn't read MCP annotations (5 of 20). Few required parameters on reads. The only REST client library is a Ruby one marked beta, last pushed in January 2022 (6 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 77, "points": 13.48, "reason": "The MCP server uses OAuth with PKCE S256, dynamic client registration, short-lived access tokens with refresh and the scopes `mcp:tools`, `mcp:resources` and `mcp:operator`, checked against an allowlist of redirect URIs. REST keys are limited to named endpoint permissions and optional IP allowlists and travel in a Bearer header. MCP tokens can be revoked only for the whole company at once (29 of 30). MCP access mirrors the user's dashboard permissions, needs a Use MCP Server permission that is off by default in each workspace, and has no tools that return user-level personal data. There is no confirmation step, Operator Connect acts without per-step approval, and Braze advises against a client's auto mode (15 of 20). Campaign content, catalogue items and attribute names can carry text written by others. The docs tell users to review proposed actions and give no prompt-injection guidance (5 of 15). The security event report records OAuth connections and REST key creation and removal, with export to S3, and an API usage dashboard shows traffic. Edits by individual MCP update tools don't appear in campaign edit history (9 of 15). security.txt valid to 1 January 2031 pointing to a HackerOne programme, ISO 27001, SOC 2 Type II and an annual third-party penetration test. We couldn't read whether the programme pays bounties (19 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 10, "points": 1.25, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page names four editions (Go, Select, Pro, Enterprise) priced by monthly active users and Action Credits, shows no figures and sends buyers to sales (0). It says there is no free plan. A 14-day trial is open at try.braze.com, and we couldn't read whether the form asks for a card, so half marks (10 of 20). A person signs up, creates a REST key in the dashboard or approves OAuth in a browser, and an admin must switch MCP access on first (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 69, "points": 6.04, "reason": "The newest release notes are dated 17 September 2026 and move the remote MCP server to general availability (30). Three dated releases since 10 July (23 July, 20 August and 17 September), which just meets the line (20). Closed service with public release notes, a support portal, a product feedback route for MCP clients and the Bonfire community. We didn't test support (10 of 15). The server isn't in the official MCP registry, where a search for braze returns only a third-party project. There is no current official REST SDK, and the mobile and web SDK repositories were pushed in October 2026 (4 of 15). The earlier local MCP server on PyPI, 1.2.0 of 14 May 2026, is deprecated with no further updates (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "note": "editorial 69, provenance 96", "reason": "Closed service under a Main Subscription Agreement last updated 13 October 2025, with SDK source public (15). The data retention page keeps profile data for the life of the account, up to 90 days in internal systems, two years before personal data is removed from the Data Lake and six months in backups. The DPA (revision 28 August 2025) commits to export, deletion and a certificate of deletion at termination, and the privacy policy is dated 23 June 2026. The retention page was last revised on 1 April 2024 (25 of 30). A deprecations log with dates exists and the local MCP server is marked deprecated, but no notice period for REST endpoints or MCP tools was found (9 of 20). The sub-processor list of 1 June 2026 gives each entity's service and location with 30 days' notice of additions, and the security datasheet names the AWS regions for US, EU, Australia, Indonesia, Japan and South Korea hosting (20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "71 MCP tools is over the 30 line, with no toolsets or dynamic loading documented. What a user sees follows dashboard permissions and three OAuth scopes. On REST, exports take `fields_to_export` (10 of 25). List endpoints page by `page` in groups of 100 with `sort_direction` and `last_edit.time[gt]`, custom attributes return in groups of 50, and segment exports go to a file with an optional callback (15 of 20). Errors are documented as HTTP status plus a message string and an `errors` array for non-fatal problems, without stable codes. A success response means queued, and `/users/identify` returns success when nothing matched (14 of 20). No idempotency keys. `/users/track/status` reports on asynchronous requests tagged with a `group_id`, and the docs suggest waiting up to five minutes between dependent calls. We couldn't read MCP annotations (5 of 20). Few required parameters on reads. The only REST client library is a Ruby one marked beta, last pushed in January 2022 (6 of 15).", "maintenance": "The newest release notes are dated 17 September 2026 and move the remote MCP server to general availability (30). Three dated releases since 10 July (23 July, 20 August and 17 September), which just meets the line (20). Closed service with public release notes, a support portal, a product feedback route for MCP clients and the Bonfire community. We didn't test support (10 of 15). The server isn't in the official MCP registry, where a search for braze returns only a third-party project. There is no current official REST SDK, and the mobile and web SDK repositories were pushed in October 2026 (4 of 15). The earlier local MCP server on PyPI, 1.2.0 of 14 May 2026, is deprecated with no further updates (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page names four editions (Go, Select, Pro, Enterprise) priced by monthly active users and Action Credits, shows no figures and sends buyers to sales (0). It says there is no free plan. A 14-day trial is open at try.braze.com, and we couldn't read whether the form asks for a card, so half marks (10 of 20). A person signs up, creates a REST key in the dashboard or approves OAuth in a browser, and an admin must switch MCP access on first (0).", "reliability": "Read with the hosted lines and scored on the REST API first, with the remote MCP server beside it. status.braze.com on Statuspage has 132 components across 15 clusters, with a REST APIs component for each cluster (20). Between 10 July and 8 October 2026 it lists seven entries. One reached the API, a minor incident on 5 August with elevated error rates on US-01 and US-03 from 11:30 to 12:55 ET. The one critical entry, on 16 September, was the support portal during a Salesforce outage, and the rest were dashboard latency on US-07, Currents delay on EU-02 and Operator errors (18 of 30, minor incidents only, less 2 for 85 minutes of API errors on two clusters). REST limits are published per endpoint, 250,000 requests an hour by default and 250 a minute for broadcast sends. None were found for the MCP server (13 of 15). Every response carries `X-RateLimit-Limit`, `-Remaining` and `-Reset`, and the docs advise exponential backoff on 5XX. There's no Retry-After, no idempotency key for sends, and the errors page says Braze can't replay REST calls that fail during an incident (9 of 15). No published SLA. The terms promise commercially reasonable efforts and leave service levels to the contract (0). The REST API is generally available and the MCP server has been since 17 September 2026, with 21 of its 71 tools limited to beta programmes (10).", "schema": "No OpenAPI document was found in the docs or the braze-inc GitHub organisation. A public Postman collection covers the REST endpoints, and the MCP tool schemas need a Braze sign-in that we don't have (12 of 25). www.braze.com/llms.txt exists for the marketing site, every docs page has a Markdown copy at /index.md and a Copy for LLM button, and the docs are on Context7 (10). Each endpoint page states its purpose, the key permission it needs and its rate limit. The MCP page lists 71 tools with a one-line description, the REST endpoint behind each and its access type, and says when to use the REST API instead of Operator Connect (15 of 20). Parameters come in tables with required flags and data types, without a schema to validate against (9 of 15). Curl and response examples on each endpoint page, and a table of fatal errors with causes (13 of 15). Release notes are dated and monthly. The REST API has no version scheme, so there is nothing for a client to pin (9 of 15).", "security": "The MCP server uses OAuth with PKCE S256, dynamic client registration, short-lived access tokens with refresh and the scopes `mcp:tools`, `mcp:resources` and `mcp:operator`, checked against an allowlist of redirect URIs. REST keys are limited to named endpoint permissions and optional IP allowlists and travel in a Bearer header. MCP tokens can be revoked only for the whole company at once (29 of 30). MCP access mirrors the user's dashboard permissions, needs a Use MCP Server permission that is off by default in each workspace, and has no tools that return user-level personal data. There is no confirmation step, Operator Connect acts without per-step approval, and Braze advises against a client's auto mode (15 of 20). Campaign content, catalogue items and attribute names can carry text written by others. The docs tell users to review proposed actions and give no prompt-injection guidance (5 of 15). The security event report records OAuth connections and REST key creation and removal, with export to S3, and an API usage dashboard shows traffic. Edits by individual MCP update tools don't appear in campaign edit history (9 of 15). security.txt valid to 1 January 2031 pointing to a HackerOne programme, ISO 27001, SOC 2 Type II and an annual third-party penetration test. We couldn't read whether the programme pays bounties (19 of 20).", "transparency": "Closed service under a Main Subscription Agreement last updated 13 October 2025, with SDK source public (15). The data retention page keeps profile data for the life of the account, up to 90 days in internal systems, two years before personal data is removed from the Data Lake and six months in backups. The DPA (revision 28 August 2025) commits to export, deletion and a certificate of deletion at termination, and the privacy policy is dated 23 June 2026. The retention page was last revised on 1 April 2024 (25 of 30). A deprecations log with dates exists and the local MCP server is marked deprecated, but no notice period for REST endpoints or MCP tools was found (9 of 20). The sub-processor list of 1 June 2026 gives each entity's service and location with 30 days' notice of additions, and the security datasheet names the AWS regions for US, EU, Australia, Indonesia, Japan and South Korea hosting (20)." }, "sources": [ { "what": "REST API overview, keys and permissions", "url": "https://www.braze.com/docs/api/basics", "seen": "2026-10-08" }, { "what": "API rate limits", "url": "https://www.braze.com/docs/api/api_limits", "seen": "2026-10-08" }, { "what": "API errors and responses", "url": "https://www.braze.com/docs/api/errors", "seen": "2026-10-08" }, { "what": "Braze MCP server", "url": "https://www.braze.com/docs/user_guide/brazeai/mcp_server", "seen": "2026-10-08" }, { "what": "MCP server functions", "url": "https://www.braze.com/docs/user_guide/brazeai/mcp_server/available_api_functions", "seen": "2026-10-08" }, { "what": "MCP server setup", "url": "https://www.braze.com/docs/user_guide/brazeai/mcp_server/setup", "seen": "2026-10-08" }, { "what": "Operator Connect", "url": "https://www.braze.com/docs/user_guide/brazeai/mcp_server/operator_connect", "seen": "2026-10-08" }, { "what": "OAuth admin settings", "url": "https://www.braze.com/docs/user_guide/administer/global/admin_settings/oauth_admin", "seen": "2026-10-08" }, { "what": "MCP protected resource metadata", "url": "https://mcp.braze.com/.well-known/oauth-protected-resource", "seen": "2026-10-08" }, { "what": "OAuth authorisation server metadata", "url": "https://dashboard.braze.com/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "security settings and event report", "url": "https://www.braze.com/docs/user_guide/administer/global/admin_settings/security_settings", "seen": "2026-10-08" }, { "what": "release notes", "url": "https://www.braze.com/docs/releases/home", "seen": "2026-10-08" }, { "what": "deprecations", "url": "https://www.braze.com/docs/releases/deprecations", "seen": "2026-10-08" }, { "what": "data retention", "url": "https://www.braze.com/docs/api/data_retention", "seen": "2026-10-08" }, { "what": "Postman collection", "url": "https://www.braze.com/docs/api/postman_collection", "seen": "2026-10-08" }, { "what": "building with an LLM", "url": "https://www.braze.com/docs/developer_guide/getting_started/build_with_llm", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://braze.statuspage.io/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://www.braze.com/pricing", "seen": "2026-10-08" }, { "what": "free trial terms", "url": "https://www.braze.com/company/legal/free-trial-terms", "seen": "2026-10-08" }, { "what": "Main Subscription Agreement", "url": "https://www.braze.com/company/legal/terms", "seen": "2026-10-08" }, { "what": "data processing addendum", "url": "https://www.braze.com/company/legal/dpa", "seen": "2026-10-08" }, { "what": "sub-processors", "url": "https://www.braze.com/company/legal/subprocessors", "seen": "2026-10-08" }, { "what": "security, privacy and architecture datasheet", "url": "https://www.braze.com/company/legal/security-schedule", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.braze.com/company/legal/privacy", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.braze.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=braze", "seen": "2026-10-08" }, { "what": "local MCP server on PyPI", "url": "https://pypi.org/project/braze-mcp-server/", "seen": "2026-10-08" }, { "what": "RDAP for braze.com", "url": "https://rdap.verisign.com/com/v1/domain/braze.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: whether the 14-day trial at try.braze.com asks for a card. The form is rendered by JavaScript and we couldn't read it", "unchecked: MCP tool input schemas, annotations and error shapes, which need a Braze sign-in", "unchecked: whether the HackerOne programme named in security.txt pays bounties. The page didn't render for our reader", "unchecked: weekly downloads of braze-mcp-server on PyPI. pypistats.org answered 429", "No OpenAPI document, published SLA, MCP rate limit or REST deprecation notice period was found in the reviewed documentation", "The trial page says 14 days and the free trial terms say 30 days unless otherwise specified. We recorded 14", "Scored on the REST API first because the MCP server has no profile, event or send tools. A reader who needs only analytics and content would weigh the MCP lines more" ] }, "negative": 0, "verdict": "The REST API covers profiles, events, sends and exports with keys limited to named endpoints, and the remote MCP server adds 71 tools under OAuth with PKCE that return no user-level personal data. No OpenAPI document, idempotency keys, published price or SLA were found, and MCP writes run without a confirmation step.", "bestFor": "A company already on Braze that wants an agent to read campaign and Canvas results, manage catalogues and templates through MCP, or write profiles and trigger sends through REST.", "strengths": [ "REST API keys carry per-endpoint permissions and optional IP allowlists, and a key's scope can't be edited after creation", "Remote MCP server with OAuth, PKCE S256, dynamic client registration and three scopes, generally available since 17 September 2026", "MCP tools return no user-level personal data, and the Use MCP Server permission is off by default for each workspace", "Rate limits published per endpoint, with `X-RateLimit-Limit`, `-Remaining` and `-Reset` headers on every response", "Sub-processor list of 1 June 2026 with locations, 30 days' notice of additions and hosting regions named for six countries or regions" ], "weaknesses": [ "No public prices. Editions, monthly active users and Action Credits are sold by contract, and the pricing page says there is no free plan", "No OpenAPI document found. The machine-readable contract is a public Postman collection", "No idempotency keys on sends or `/users/track`, and Braze says it can't replay REST calls that fail during an incident", "71 MCP tools with no documented toolsets, 21 of them limited to beta programmes", "Edits made through individual MCP update tools don't appear in campaign edit history, and Operator Connect acts without per-step approval" ], "agentNotes": [ "Use the REST host for the customer's instance, such as https://rest.iad-01.braze.com or https://rest.fra-01.braze.eu. A key sent to the wrong instance returns 401", "Create a REST key with only the permissions the task needs. Scope and IP allowlist can't be edited later, so a change means a new key", "Call `get_workspaces` first on MCP. Every other tool needs the returned workspace id as `app_group_id`, and the wrong workspace is a documented failure", "Use REST for profiles, events and sends. The MCP server has no user-level tools and can't trigger a message to a named user", "Treat `\"message\": \"success\"` as queued, not delivered. Add a `group_id` to `/users/track` and poll `/users/track/status`, and don't resend a trigger call blindly" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.2 } ], "editorialScores": { "ergonomics": 50, "maintenance": 69, "payments": 10, "reliability": 70, "schema": 68, "security": 77, "transparency": 69 }, "provenanceScore": 96 }, "connect": { "http": "curl --location -g --request GET 'https://rest.iad-01.braze.com/campaigns/list?page=0\u0026include_archived=false\u0026sort_direction=desc' \\\n--header 'Authorization: Bearer YOUR-REST-API-KEY'", "config": { "mcpServers": { "braze": { "url": "https://mcp.braze.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/marketing.profiles", "tool": "https://letme.dev/braze" }, "notable": [ "The remote MCP server answers at https://mcp.braze.com/mcp (US) and https://mcp.braze.eu/mcp (EU), became generally available on 17 September 2026 and replaces a local server from August 2025 that is now deprecated (https://www.braze.com/docs/user_guide/brazeai/mcp_server)", "The MCP function page lists 71 tools in 16 groups, 37 read and 34 write, and 21 of them (campaign authoring, segment creation, Operator Connect) are limited to beta programmes (https://www.braze.com/docs/user_guide/brazeai/mcp_server/available_api_functions)", "MCP tools return no user-level personal data, so profiles, events and sends to named users go through the REST API (https://www.braze.com/docs/user_guide/brazeai/mcp_server)", "Most REST endpoints share 250,000 requests an hour per workspace, reset on the clock hour. Broadcast sends are held to 250 a minute and 10 a minute per unique audience (https://www.braze.com/docs/api/api_limits)", "Each `/users/track` request holds up to 75 objects across attributes, events and purchases and is processed asynchronously (https://www.braze.com/docs/api/api_limits)", "Operator Connect, in beta, passes a prompt to BrazeAI Operator through `send_operator_prompt` and acts without per-step approval. It can't launch campaigns or Canvases (https://www.braze.com/docs/user_guide/brazeai/mcp_server/operator_connect)", "status.braze.com lists one minor REST API incident in the 90 days to 8 October 2026, on US-01 and US-03 on 5 August (https://braze.statuspage.io/api/v2/incidents.json)" ], "area": "communication", "details": [ { "label": "REST API", "value": "Twelve collections (catalogues, Cloud Data Ingestion, email lists, export, media library, messages, preference centre, SCIM, SMS, subscription groups, templates, user data), served from the instance's own host such as https://rest.iad-01.braze.com. No version scheme" }, { "label": "MCP server", "value": "Remote, https://mcp.braze.com/mcp (US) or https://mcp.braze.eu/mcp (EU), 71 tools in 16 groups. Generally available since 17 September 2026. No user-level personal data. Not available to companies that use IP allowlisting" }, { "label": "MCP tools", "value": "Workspaces 1, campaigns 19, Canvases 4, catalogues 13, custom attributes 1, custom events 3, Cloud Data Ingestion 3, KPIs 4, media library 1, purchases 3, segments 6, sends 1, sessions 1, email templates 4, Content Blocks 4, Operator 3. 21 are limited to beta programmes" }, { "label": "Credentials", "value": "REST API key per workspace with per-endpoint permissions and optional IP allowlist, fixed at creation. MCP by OAuth with PKCE S256, dynamic client registration and scopes mcp:tools, mcp:resources, mcp:operator" }, { "label": "Access", "value": "Contract or 14-day trial. A dashboard user creates REST keys. For MCP a company admin turns on MCP OAuth access and grants Use MCP Server per workspace" }, { "label": "Rate limits", "value": "250,000 requests an hour shared by most endpoints, reset on the clock hour. Broadcast sends 250 a minute and 10 a minute per unique audience. /users/track 3,000 requests per three seconds for customers priced on data points, otherwise by contract. /sends/id/create 100 a day. None found for MCP" }, { "label": "Batching", "value": "/users/track takes up to 75 objects a request, messaging endpoints up to 50 external ids, catalogue item calls up to 50 items. Most request bodies up to 4 MB" }, { "label": "Errors", "value": "HTTP status with a message string and an errors array. 429 with X-RateLimit-Limit, -Remaining and -Reset headers. Exponential backoff advised on 5XX. A success response means queued, not delivered" }, { "label": "Segments", "value": "REST lists segments, reads details and size series and exports members to a file. Creating and editing segments is an MCP beta tool" }, { "label": "Audit", "value": "Security event report (CSV, last 10,000 events, or export to S3) records OAuth connections and REST key creation and removal. Operator Connect edits appear in campaign edit history, individual MCP update tools don't" }, { "label": "Docs for agents", "value": "llms.txt on www.braze.com, a Markdown copy of each docs page at /index.md, a public Postman collection and the docs on Context7. No OpenAPI found" }, { "label": "SDKs", "value": "No current REST SDK. A Ruby client library marked beta, last pushed January 2022, covers the user endpoints. Mobile and web SDKs are public on GitHub" }, { "label": "Certifications", "value": "ISO 27001 and SOC 2 Type II per braze.com/product/trust, HIPAA-compliant per the security datasheet of 14 April 2026, annual third-party penetration test, HackerOne programme" }, { "label": "Data retention", "value": "Profile data for the life of the account. Up to 90 days in internal systems, personal data removed from the Data Lake after two years, backups kept six months (page revised 1 April 2024)" }, { "label": "Hosting", "value": "AWS in the US, Frankfurt, Sydney, Jakarta, Tokyo and Seoul, with 15 instances (nine US, two EU, and one each in Australia, Indonesia, Japan and South Korea)" } ], "provenance": { "legalEntity": "Braze, Inc.", "domain": "braze.com", "domainRegistered": "2000-01-19", "endpointOnVendorDomain": true, "terms": "https://www.braze.com/company/legal/terms", "privacy": "https://www.braze.com/company/legal/privacy", "statusPage": "https://status.braze.com", "changelog": "https://www.braze.com/docs/releases/home", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Main Subscription Agreement (last updated 13 October 2025) names Braze, Inc., and the privacy policy (last updated 23 June 2026) says it is a U.S. company headquartered in New York.", "REST hosts are on braze.com for the US, Australia, Indonesia, Japan and South Korea and on braze.eu for the EU. The MCP server is at mcp.braze.com and mcp.braze.eu.", "www.braze.com/.well-known/security.txt expires 2031-01-01, gives security@braze.com and points its policy to hackerone.com/braze_inc.", "status.braze.com redirects to braze.statuspage.io.", "RDAP for braze.com gives a registration date of 2000-01-19.", "The DPA (revision 28 August 2025), the sub-processor list (1 June 2026) and the security datasheet (14 April 2026) are PDFs linked from braze.com/company/legal." ], "score": 96, "checks": [ { "check": "Legal entity named", "value": "Braze, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "braze.com, registered 2000-01-19 (26 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.braze.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.braze.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.braze.com/company/legal/terms", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-10-13", "words": 5694, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: 13 October 2025", "says": "Last updated 2025-10-13" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement shall be governed exclusively by the internal laws of the State of New York, without regard to its conflicts of laws rules.", "says": "The law of the State of New York" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…RESPECT OF THE TWELVE-MONTH TERM IN WHICH THE INCIDENT GIVING RISE TO LIABILITY OCCURRED, PROVIDED THAT IN NO EVENT SHALL EITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER HEREUNDER.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "In the event that Customer is in breach of Customer’s obligations under Section 2, Braze may suspend Customer or Dashboard User access to the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "…written notice, Braze may terminate this Agreement and any or all outstanding Order Forms and Customer shall not be entitled to a refund of any prepaid fees, but shall remain obligated to pay unpaid fees owed, even if not yet invoiced, including any overages to entitlements, all as set forth on Customer's Order Forms." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "(f) access or provide access to a Dashboard User to the Services or the SDK for competitive purposes;", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "Subscriptions renew automatically for a period equal to the expiring term, with 60 days' notice and a price increase of up to 7 per cent.", "quote": "Braze will provide sixty (60) days’ advance notice of automatic renewal, including any price increase not to exceed 7%." }, { "date": "2026-10-08", "text": "Braze may use the customer's name and logo to identify it as a customer.", "quote": "Braze may use Customer’s name verbally and Customer’s name and logo in writing to identify Customer as a customer of Braze." }, { "date": "2026-10-08", "text": "Braze accepts no liability for output or for actions the customer takes based on output.", "quote": "BRAZE SHALL HAVE NO LIABILITY FOR OUTPUT AND/OR ACTIONS TAKEN BY CUSTOMER BASED ON THE OUTPUT." } ] }, { "kind": "privacy", "url": "https://www.braze.com/company/legal/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-06-23", "words": 5267, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: 23 June 2026", "says": "Last updated 2026-06-23" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Privacy Policy provides you with a description of how we collect and use data relating to or identifying individuals (“Personal Data”)." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We determine the appropriate retention period for Personal Data on the basis of the purpose for which we process the Personal Data, the amount, nature and sensitivity of your Personal Data processed, the potential risk of harm from unauthorized use or disclosure of your Personal Data and whether we can achieve the pur…" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Device Data: information may include IP address (or proxy server), device and application identification numbers, location, browser type, Internet service provider and/or mobile carrier, and operating system and system configuration information;" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "To opt out of all selling and sharing, you may click on the \"Do Not Sell or Share my Personal Information\" link in the footer of our Websites and follow the instructions therein.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "If you have a question about your privacy rights, please email us at [email protected]." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have a question about your privacy rights, please email us at [email protected].", "says": "Gives an email address, hidden from our reader by the page" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Data Privacy Framework, the UK Extension to the EU-U.S.", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may also disclose your Personal Data to technology and solutions partners in connection with customer or technical support, marketing, business development and account management, and to our partners for marketing and personalized advertising purposes." } ], "notes": [ { "date": "2026-10-08", "text": "Third-party session replay records the interactions and personal data of dashboard users of the service, as well as website visitors.", "quote": "We use session replay technology provided by third-party vendors to record the interactions and Personal Data of Dashboard Users and visitors to certain Websites, such as our learning management system and www.braze.com." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/braze.json", "live": { "slug": "braze", "probe": { "target": "https://mcp.braze.com/mcp", "method": "get", "lastAt": "2026-10-08T19:52:46.731137367Z", "lastOk": true, "lastStatus": 401, "lastMs": 256, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 264, "p95ms24h": 319, "samples24h": 50, "samples30d": 50, "days": [ { "date": "2026-10-08", "probes": 50, "ok": 50 } ] }, "vendorStatus": { "page": "https://status.braze.com", "indicator": "maintenance", "summary": "Service Under Maintenance", "checkedAt": "2026-10-08T19:50:27.587336188Z" }, "securityTxt": { "url": "https://braze.com/.well-known/security.txt", "state": "valid", "expires": "2031-01-01T04:59:00.000Z", "checkedAt": "2026-10-08T15:39:06.359227057Z" }, "pages": [ { "url": "https://www.braze.com/docs/releases/home", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:26:48.434408153Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "c84a0deb311a" }, { "url": "https://www.braze.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:26:50.345609932Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "90f9bf6b6c9c" }, { "url": "https://www.braze.com/company/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:26:44.004338511Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2328a04f813f" }, { "url": "https://www.braze.com/company/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:26:46.13034848Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "066935a8590e" } ], "updatedAt": "2026-10-08T19:52:46.731137367Z" } }, "verify": { "accepts": "a page on braze.com or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/braze.svg", "body": { "slug": "braze", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/braze", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/braze\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/braze.svg\" alt=\"Braze on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Braze on Anchor Terminal](https://www.anchorterminal.com/badges/braze.svg)](https://www.anchorterminal.com/tools/braze)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/braze\"\u003eBraze on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/braze", "json": "https://www.anchorterminal.com/tools/braze.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/braze.md", "slim": "https://www.anchorterminal.com/tools/braze.min.md" }, "markdown": "## Overview\n\n**Grade C · 61.2/100 · rank #371 of 722 · #3 in Lifecycle marketing \u0026 customer engagement · not agent-ready · confidence medium**\n\n\n## Assessment\n\nThe REST API covers profiles, events, sends and exports with keys limited to named endpoints, and the remote MCP server adds 71 tools under OAuth with PKCE that return no user-level personal data. No OpenAPI document, idempotency keys, published price or SLA were found, and MCP writes run without a confirmation step.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Braze, Inc. (https://www.braze.com) |\n| Kind | HTTP API |\n| Category | Lifecycle marketing \u0026 customer engagement (https://www.anchorterminal.com/categories/lifecycle-marketing) |\n| Transport | HTTP, Streamable HTTP |\n| Endpoint | `https://mcp.braze.com/mcp` |\n| Auth | OAuth or key · Access follows a Braze contract or trial, with no app review or partner approval. The REST API takes a workspace API key as a Bearer header at the instance's own host (15 instances, such as https://rest.iad-01.braze.com). A dashboard user creates the key with per-endpoint permissions such as `users.track` or `campaigns.list` and an optional IP allowlist, and neither can be edited afterwards. The remote MCP server takes only OAuth (authorisation code with PKCE S256, dynamic client registration, scopes `mcp:tools`, `mcp:resources` and `mcp:operator`). A company admin must turn on MCP OAuth access, each user needs the Use MCP Server permission per workspace, and calls run with that user's dashboard permissions. Companies that use IP allowlisting can't use the MCP server. |\n| Pricing | Paid (Paid) · No public prices. Braze sells four editions (Go, Select, Pro, Enterprise) by contract, sized by monthly active users and Action Credits, and the pricing page says there is no free plan. A 14-day free trial is open at try.braze.com, and we couldn't read whether it asks for a card. There's no separate sandbox, and API and MCP calls aren't priced on their own (https://www.braze.com/pricing, checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the API docs, the MCP pages or the pricing page (checked 2026-10-08). |\n| Licence | Proprietary service under Braze's Main Subscription Agreement. The deprecated local MCP server on PyPI is MIT |\n| Tools exposed | 71 |\n| Docs | https://www.braze.com/docs/api/home |\n| llms.txt | https://www.braze.com/llms.txt |\n| Last release | 2026-09-17 |\n| REST API | Twelve collections (catalogues, Cloud Data Ingestion, email lists, export, media library, messages, preference centre, SCIM, SMS, subscription groups, templates, user data), served from the instance's own host such as https://rest.iad-01.braze.com. No version scheme |\n| MCP server | Remote, https://mcp.braze.com/mcp (US) or https://mcp.braze.eu/mcp (EU), 71 tools in 16 groups. Generally available since 17 September 2026. No user-level personal data. Not available to companies that use IP allowlisting |\n| MCP tools | Workspaces 1, campaigns 19, Canvases 4, catalogues 13, custom attributes 1, custom events 3, Cloud Data Ingestion 3, KPIs 4, media library 1, purchases 3, segments 6, sends 1, sessions 1, email templates 4, Content Blocks 4, Operator 3. 21 are limited to beta programmes |\n| Credentials | REST API key per workspace with per-endpoint permissions and optional IP allowlist, fixed at creation. MCP by OAuth with PKCE S256, dynamic client registration and scopes mcp:tools, mcp:resources, mcp:operator |\n| Access | Contract or 14-day trial. A dashboard user creates REST keys. For MCP a company admin turns on MCP OAuth access and grants Use MCP Server per workspace |\n| Rate limits | 250,000 requests an hour shared by most endpoints, reset on the clock hour. Broadcast sends 250 a minute and 10 a minute per unique audience. /users/track 3,000 requests per three seconds for customers priced on data points, otherwise by contract. /sends/id/create 100 a day. None found for MCP |\n| Batching | /users/track takes up to 75 objects a request, messaging endpoints up to 50 external ids, catalogue item calls up to 50 items. Most request bodies up to 4 MB |\n| Errors | HTTP status with a message string and an errors array. 429 with X-RateLimit-Limit, -Remaining and -Reset headers. Exponential backoff advised on 5XX. A success response means queued, not delivered |\n| Segments | REST lists segments, reads details and size series and exports members to a file. Creating and editing segments is an MCP beta tool |\n| Audit | Security event report (CSV, last 10,000 events, or export to S3) records OAuth connections and REST key creation and removal. Operator Connect edits appear in campaign edit history, individual MCP update tools don't |\n| Docs for agents | llms.txt on www.braze.com, a Markdown copy of each docs page at /index.md, a public Postman collection and the docs on Context7. No OpenAPI found |\n| SDKs | No current REST SDK. A Ruby client library marked beta, last pushed January 2022, covers the user endpoints. Mobile and web SDKs are public on GitHub |\n| Certifications | ISO 27001 and SOC 2 Type II per braze.com/product/trust, HIPAA-compliant per the security datasheet of 14 April 2026, annual third-party penetration test, HackerOne programme |\n| Data retention | Profile data for the life of the account. Up to 90 days in internal systems, personal data removed from the Data Lake after two years, backups kept six months (page revised 1 April 2024) |\n| Hosting | AWS in the US, Frankfurt, Sydney, Jakarta, Tokyo and Seoul, with 15 instances (nine US, two EU, and one each in Australia, Indonesia, Japan and South Korea) |\n| Capabilities | marketing.profiles, marketing.events, marketing.campaigns, marketing.journeys, marketing.segments |\n| Tags | official, hosted, mcp, oauth, api-key, closed-source, llms-txt, sales-led, enterprise, eu-region, status-page, soc2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/braze.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 70 | 14.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 68 | 11.1 |\n| Agent ergonomics | 13% | 16.2 | 50 | 8.1 |\n| Security \u0026 auth | 14% | 17.5 | 77 | 13.5 |\n| Payments \u0026 pricing | 10% | 12.5 | 10 | 1.2 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 69 | 6.0 |\n| Transparency \u0026 trust (editorial 69, provenance 96) | 7% | 8.8 | 83 | 7.3 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **61.2 → C** |\n\n### Why each score\n\n- Reliability 70: Read with the hosted lines and scored on the REST API first, with the remote MCP server beside it. status.braze.com on Statuspage has 132 components across 15 clusters, with a REST APIs component for each cluster (20). Between 10 July and 8 October 2026 it lists seven entries. One reached the API, a minor incident on 5 August with elevated error rates on US-01 and US-03 from 11:30 to 12:55 ET. The one critical entry, on 16 September, was the support portal during a Salesforce outage, and the rest were dashboard latency on US-07, Currents delay on EU-02 and Operator errors (18 of 30, minor incidents only, less 2 for 85 minutes of API errors on two clusters). REST limits are published per endpoint, 250,000 requests an hour by default and 250 a minute for broadcast sends. None were found for the MCP server (13 of 15). Every response carries `X-RateLimit-Limit`, `-Remaining` and `-Reset`, and the docs advise exponential backoff on 5XX. There's no Retry-After, no idempotency key for sends, and the errors page says Braze can't replay REST calls that fail during an incident (9 of 15). No published SLA. The terms promise commercially reasonable efforts and leave service levels to the contract (0). The REST API is generally available and the MCP server has been since 17 September 2026, with 21 of its 71 tools limited to beta programmes (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 68: No OpenAPI document was found in the docs or the braze-inc GitHub organisation. A public Postman collection covers the REST endpoints, and the MCP tool schemas need a Braze sign-in that we don't have (12 of 25). www.braze.com/llms.txt exists for the marketing site, every docs page has a Markdown copy at /index.md and a Copy for LLM button, and the docs are on Context7 (10). Each endpoint page states its purpose, the key permission it needs and its rate limit. The MCP page lists 71 tools with a one-line description, the REST endpoint behind each and its access type, and says when to use the REST API instead of Operator Connect (15 of 20). Parameters come in tables with required flags and data types, without a schema to validate against (9 of 15). Curl and response examples on each endpoint page, and a table of fatal errors with causes (13 of 15). Release notes are dated and monthly. The REST API has no version scheme, so there is nothing for a client to pin (9 of 15).\n- Agent ergonomics 50: 71 MCP tools is over the 30 line, with no toolsets or dynamic loading documented. What a user sees follows dashboard permissions and three OAuth scopes. On REST, exports take `fields_to_export` (10 of 25). List endpoints page by `page` in groups of 100 with `sort_direction` and `last_edit.time[gt]`, custom attributes return in groups of 50, and segment exports go to a file with an optional callback (15 of 20). Errors are documented as HTTP status plus a message string and an `errors` array for non-fatal problems, without stable codes. A success response means queued, and `/users/identify` returns success when nothing matched (14 of 20). No idempotency keys. `/users/track/status` reports on asynchronous requests tagged with a `group_id`, and the docs suggest waiting up to five minutes between dependent calls. We couldn't read MCP annotations (5 of 20). Few required parameters on reads. The only REST client library is a Ruby one marked beta, last pushed in January 2022 (6 of 15).\n- Security \u0026 auth 77: The MCP server uses OAuth with PKCE S256, dynamic client registration, short-lived access tokens with refresh and the scopes `mcp:tools`, `mcp:resources` and `mcp:operator`, checked against an allowlist of redirect URIs. REST keys are limited to named endpoint permissions and optional IP allowlists and travel in a Bearer header. MCP tokens can be revoked only for the whole company at once (29 of 30). MCP access mirrors the user's dashboard permissions, needs a Use MCP Server permission that is off by default in each workspace, and has no tools that return user-level personal data. There is no confirmation step, Operator Connect acts without per-step approval, and Braze advises against a client's auto mode (15 of 20). Campaign content, catalogue items and attribute names can carry text written by others. The docs tell users to review proposed actions and give no prompt-injection guidance (5 of 15). The security event report records OAuth connections and REST key creation and removal, with export to S3, and an API usage dashboard shows traffic. Edits by individual MCP update tools don't appear in campaign edit history (9 of 15). security.txt valid to 1 January 2031 pointing to a HackerOne programme, ISO 27001, SOC 2 Type II and an annual third-party penetration test. We couldn't read whether the programme pays bounties (19 of 20).\n- Payments \u0026 pricing 10: Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page names four editions (Go, Select, Pro, Enterprise) priced by monthly active users and Action Credits, shows no figures and sends buyers to sales (0). It says there is no free plan. A 14-day trial is open at try.braze.com, and we couldn't read whether the form asks for a card, so half marks (10 of 20). A person signs up, creates a REST key in the dashboard or approves OAuth in a browser, and an admin must switch MCP access on first (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 69: The newest release notes are dated 17 September 2026 and move the remote MCP server to general availability (30). Three dated releases since 10 July (23 July, 20 August and 17 September), which just meets the line (20). Closed service with public release notes, a support portal, a product feedback route for MCP clients and the Bonfire community. We didn't test support (10 of 15). The server isn't in the official MCP registry, where a search for braze returns only a third-party project. There is no current official REST SDK, and the mobile and web SDK repositories were pushed in October 2026 (4 of 15). The earlier local MCP server on PyPI, 1.2.0 of 14 May 2026, is deprecated with no further updates (5 of 10).\n- Transparency \u0026 trust 83: Closed service under a Main Subscription Agreement last updated 13 October 2025, with SDK source public (15). The data retention page keeps profile data for the life of the account, up to 90 days in internal systems, two years before personal data is removed from the Data Lake and six months in backups. The DPA (revision 28 August 2025) commits to export, deletion and a certificate of deletion at termination, and the privacy policy is dated 23 June 2026. The retention page was last revised on 1 April 2024 (25 of 30). A deprecations log with dates exists and the local MCP server is marked deprecated, but no notice period for REST endpoints or MCP tools was found (9 of 20). The sub-processor list of 1 June 2026 gives each entity's service and location with 30 days' notice of additions, and the security datasheet names the AWS regions for US, EU, Australia, Indonesia, Japan and South Korea hosting (20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (15 items): https://www.anchorterminal.com/fixes/braze.md (JSON https://www.anchorterminal.com/fixes/braze.json)\n\n### What we couldn't check\n\n- unchecked: whether the 14-day trial at try.braze.com asks for a card. The form is rendered by JavaScript and we couldn't read it\n- unchecked: MCP tool input schemas, annotations and error shapes, which need a Braze sign-in\n- unchecked: whether the HackerOne programme named in security.txt pays bounties. The page didn't render for our reader\n- unchecked: weekly downloads of braze-mcp-server on PyPI. pypistats.org answered 429\n- No OpenAPI document, published SLA, MCP rate limit or REST deprecation notice period was found in the reviewed documentation\n- The trial page says 14 days and the free trial terms say 30 days unless otherwise specified. We recorded 14\n- Scored on the REST API first because the MCP server has no profile, event or send tools. A reader who needs only analytics and content would weigh the MCP lines more\n\n### Sources\n\n- REST API overview, keys and permissions: \u003chttps://www.braze.com/docs/api/basics\u003e (seen 2026-10-08)\n- API rate limits: \u003chttps://www.braze.com/docs/api/api_limits\u003e (seen 2026-10-08)\n- API errors and responses: \u003chttps://www.braze.com/docs/api/errors\u003e (seen 2026-10-08)\n- Braze MCP server: \u003chttps://www.braze.com/docs/user_guide/brazeai/mcp_server\u003e (seen 2026-10-08)\n- MCP server functions: \u003chttps://www.braze.com/docs/user_guide/brazeai/mcp_server/available_api_functions\u003e (seen 2026-10-08)\n- MCP server setup: \u003chttps://www.braze.com/docs/user_guide/brazeai/mcp_server/setup\u003e (seen 2026-10-08)\n- Operator Connect: \u003chttps://www.braze.com/docs/user_guide/brazeai/mcp_server/operator_connect\u003e (seen 2026-10-08)\n- OAuth admin settings: \u003chttps://www.braze.com/docs/user_guide/administer/global/admin_settings/oauth_admin\u003e (seen 2026-10-08)\n- MCP protected resource metadata: \u003chttps://mcp.braze.com/.well-known/oauth-protected-resource\u003e (seen 2026-10-08)\n- OAuth authorisation server metadata: \u003chttps://dashboard.braze.com/.well-known/oauth-authorization-server\u003e (seen 2026-10-08)\n- security settings and event report: \u003chttps://www.braze.com/docs/user_guide/administer/global/admin_settings/security_settings\u003e (seen 2026-10-08)\n- release notes: \u003chttps://www.braze.com/docs/releases/home\u003e (seen 2026-10-08)\n- deprecations: \u003chttps://www.braze.com/docs/releases/deprecations\u003e (seen 2026-10-08)\n- data retention: \u003chttps://www.braze.com/docs/api/data_retention\u003e (seen 2026-10-08)\n- Postman collection: \u003chttps://www.braze.com/docs/api/postman_collection\u003e (seen 2026-10-08)\n- building with an LLM: \u003chttps://www.braze.com/docs/developer_guide/getting_started/build_with_llm\u003e (seen 2026-10-08)\n- status incidents: \u003chttps://braze.statuspage.io/api/v2/incidents.json\u003e (seen 2026-10-08)\n- pricing: \u003chttps://www.braze.com/pricing\u003e (seen 2026-10-08)\n- free trial terms: \u003chttps://www.braze.com/company/legal/free-trial-terms\u003e (seen 2026-10-08)\n- Main Subscription Agreement: \u003chttps://www.braze.com/company/legal/terms\u003e (seen 2026-10-08)\n- data processing addendum: \u003chttps://www.braze.com/company/legal/dpa\u003e (seen 2026-10-08)\n- sub-processors: \u003chttps://www.braze.com/company/legal/subprocessors\u003e (seen 2026-10-08)\n- security, privacy and architecture datasheet: \u003chttps://www.braze.com/company/legal/security-schedule\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://www.braze.com/company/legal/privacy\u003e (seen 2026-10-08)\n- security.txt: \u003chttps://www.braze.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=braze\u003e (seen 2026-10-08)\n- local MCP server on PyPI: \u003chttps://pypi.org/project/braze-mcp-server/\u003e (seen 2026-10-08)\n- RDAP for braze.com: \u003chttps://rdap.verisign.com/com/v1/domain/braze.com\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 96/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Braze, Inc. | 20/20 |\n| Domain age | braze.com, registered 2000-01-19 (26 years) | 15/15 |\n| Endpoint on the vendor's domain | mcp.braze.com | 15/15 |\n| Terms of service | read, states 5 of the 7 things a reader expects, and has 1 clause that costs points | 6.3/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.braze.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nThe Main Subscription Agreement (last updated 13 October 2025) names Braze, Inc., and the privacy policy (last updated 23 June 2026) says it is a U.S. company headquartered in New York.\n\nREST hosts are on braze.com for the US, Australia, Indonesia, Japan and South Korea and on braze.eu for the EU. The MCP server is at mcp.braze.com and mcp.braze.eu.\n\nwww.braze.com/.well-known/security.txt expires 2031-01-01, gives security@braze.com and points its policy to hackerone.com/braze_inc.\n\nstatus.braze.com redirects to braze.statuspage.io.\n\nRDAP for braze.com gives a registration date of 2000-01-19.\n\nThe DPA (revision 28 August 2025), the sub-processor list (1 June 2026) and the security datasheet (14 April 2026) are PDFs linked from braze.com/company/legal.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.braze.com/company/legal/terms), read 2026-10-08, dated 2025-10-13, states 5 of the 7 things a reader expects.\n\n- To know. Restricts benchmarking or competitive use (costs points). \"(f) access or provide access to a Dashboard User to the Services or the SDK for competitive purposes;\"\n- Gives the date it was last updated. Last updated 2025-10-13.\n- Names the governing law or courts. The law of the State of New York.\n- States a limit on its liability. Capped at the fees paid in the 12 months before the claim.\n- Not found in the text. Says how changes to the terms are announced.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). Subscriptions renew automatically for a period equal to the expiring term, with 60 days' notice and a price increase of up to 7 per cent. \"Braze will provide sixty (60) days’ advance notice of automatic renewal, including any price increase not to exceed 7%.\"\n- Also in the text (2026-10-08). Braze may use the customer's name and logo to identify it as a customer. \"Braze may use Customer’s name verbally and Customer’s name and logo in writing to identify Customer as a customer of Braze.\"\n- Also in the text (2026-10-08). Braze accepts no liability for output or for actions the customer takes based on output. \"BRAZE SHALL HAVE NO LIABILITY FOR OUTPUT AND/OR ACTIONS TAKEN BY CUSTOMER BASED ON THE OUTPUT.\"\n\n**Privacy policy** (https://www.braze.com/company/legal/privacy), read 2026-10-08, dated 2026-06-23, states 8 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"We may also disclose your Personal Data to technology and solutions partners in connection with customer or technical support, marketing, business development and account management, and to our partners for marketing and personalized advertising purposes.\"\n- Gives the date it was last updated. Last updated 2026-06-23.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. Gives an email address, hidden from our reader by the page.\n- Says where data is transferred or stored. Relies on the Data Privacy Framework.\n- Also in the text (2026-10-08). Third-party session replay records the interactions and personal data of dashboard users of the service, as well as website visitors. \"We use session replay technology provided by third-party vendors to record the interactions and Personal Data of Dashboard Users and visitors to certain Websites, such as our learning management system and www.braze.com.\"\n\n## Live (updated 2026-10-08 19:52 UTC)\n\n- Right now: up, HTTP 401, 256 ms, checked 2026-10-08 19:52 UTC (get on `https://mcp.braze.com/mcp`, asks for auth)\n- Uptime 24h 100.0% (50 probes) · 30 days 100.0% (50 probes) · p50 264 ms · p95 319 ms\n- Vendor status page: maintenance, Service Under Maintenance\n- security.txt: valid, expires 2031-01-01T04:59:00.000Z\n- Watching changelog \u003chttps://www.braze.com/docs/releases/home\u003e\n- Watching pricing \u003chttps://www.braze.com/pricing\u003e\n- Watching privacy \u003chttps://www.braze.com/company/legal/privacy\u003e\n- Watching terms \u003chttps://www.braze.com/company/legal/terms\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/braze.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- REST API keys carry per-endpoint permissions and optional IP allowlists, and a key's scope can't be edited after creation\n- Remote MCP server with OAuth, PKCE S256, dynamic client registration and three scopes, generally available since 17 September 2026\n- MCP tools return no user-level personal data, and the Use MCP Server permission is off by default for each workspace\n- Rate limits published per endpoint, with `X-RateLimit-Limit`, `-Remaining` and `-Reset` headers on every response\n- Sub-processor list of 1 June 2026 with locations, 30 days' notice of additions and hosting regions named for six countries or regions\n\n## Weaknesses\n\n- No public prices. Editions, monthly active users and Action Credits are sold by contract, and the pricing page says there is no free plan\n- No OpenAPI document found. The machine-readable contract is a public Postman collection\n- No idempotency keys on sends or `/users/track`, and Braze says it can't replay REST calls that fail during an incident\n- 71 MCP tools with no documented toolsets, 21 of them limited to beta programmes\n- Edits made through individual MCP update tools don't appear in campaign edit history, and Operator Connect acts without per-step approval\n\n## Before you call it (notes for agents)\n\n1. Use the REST host for the customer's instance, such as https://rest.iad-01.braze.com or https://rest.fra-01.braze.eu. A key sent to the wrong instance returns 401\n2. Create a REST key with only the permissions the task needs. Scope and IP allowlist can't be edited later, so a change means a new key\n3. Call `get_workspaces` first on MCP. Every other tool needs the returned workspace id as `app_group_id`, and the wrong workspace is a documented failure\n4. Use REST for profiles, events and sends. The MCP server has no user-level tools and can't trigger a message to a named user\n5. Treat `\"message\": \"success\"` as queued, not delivered. Add a `group_id` to `/users/track` and poll `/users/track/status`, and don't resend a trigger call blindly\n\n## Connect\n\nFirst request:\n\n```bash\ncurl --location -g --request GET 'https://rest.iad-01.braze.com/campaigns/list?page=0\u0026include_archived=false\u0026sort_direction=desc' \\\n--header 'Authorization: Bearer YOUR-REST-API-KEY'\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"braze\": {\n \"url\": \"https://mcp.braze.com/mcp\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/braze. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Customer.io | BB | 74.5 | 61 | marketing.profiles, marketing.events, marketing.segments, marketing.campaigns, marketing.journeys | no | https://www.anchorterminal.com/tools/customer-io.md |\n| Klaviyo API + MCP | BB | 71.7 | 103 | marketing.profiles, marketing.events, marketing.segments, marketing.campaigns, marketing.journeys | no | https://www.anchorterminal.com/tools/klaviyo.md |\n| Iterable | C | 55.2 | 515 | marketing.profiles, marketing.events, marketing.segments, marketing.campaigns, marketing.journeys | no | https://www.anchorterminal.com/tools/iterable.md |\n| ActiveCampaign | D | 50.5 | 590 | marketing.profiles, marketing.events, marketing.segments, marketing.campaigns, marketing.journeys | no | https://www.anchorterminal.com/tools/activecampaign.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The remote MCP server answers at https://mcp.braze.com/mcp (US) and https://mcp.braze.eu/mcp (EU), became generally available on 17 September 2026 and replaces a local server from August 2025 that is now deprecated (source: \u003chttps://www.braze.com/docs/user_guide/brazeai/mcp_server\u003e)\n- The MCP function page lists 71 tools in 16 groups, 37 read and 34 write, and 21 of them (campaign authoring, segment creation, Operator Connect) are limited to beta programmes (source: \u003chttps://www.braze.com/docs/user_guide/brazeai/mcp_server/available_api_functions\u003e)\n- MCP tools return no user-level personal data, so profiles, events and sends to named users go through the REST API (source: \u003chttps://www.braze.com/docs/user_guide/brazeai/mcp_server\u003e)\n- Most REST endpoints share 250,000 requests an hour per workspace, reset on the clock hour. Broadcast sends are held to 250 a minute and 10 a minute per unique audience (source: \u003chttps://www.braze.com/docs/api/api_limits\u003e)\n- Each `/users/track` request holds up to 75 objects across attributes, events and purchases and is processed asynchronously (source: \u003chttps://www.braze.com/docs/api/api_limits\u003e)\n- Operator Connect, in beta, passes a prompt to BrazeAI Operator through `send_operator_prompt` and acts without per-step approval. It can't launch campaigns or Canvases (source: \u003chttps://www.braze.com/docs/user_guide/brazeai/mcp_server/operator_connect\u003e)\n- status.braze.com lists one minor REST API incident in the 90 days to 8 October 2026, on US-01 and US-03 on 5 August (source: \u003chttps://braze.statuspage.io/api/v2/incidents.json\u003e)\n\n## Compare\n\n- [ActiveCampaign vs Braze](https://www.anchorterminal.com/compare/activecampaign-vs-braze.md): D 50.5 vs C 61.2\n- [Braze vs Customer.io](https://www.anchorterminal.com/compare/braze-vs-customer-io.md): C 61.2 vs BB 74.5\n- [Braze vs Iterable](https://www.anchorterminal.com/compare/braze-vs-iterable.md): C 61.2 vs C 55.2\n- [Braze vs Klaviyo API + MCP](https://www.anchorterminal.com/compare/braze-vs-klaviyo.md): C 61.2 vs BB 71.7\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on braze.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"braze\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/braze\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/braze.svg\" alt=\"Braze on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Braze on Anchor Terminal](https://www.anchorterminal.com/badges/braze.svg)](https://www.anchorterminal.com/tools/braze)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/braze\"\u003eBraze on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Braze is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/braze-dark.png\n- Light: https://www.anchorterminal.com/assets/share/braze-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Lifecycle marketing \u0026 customer engagement", "url": "https://www.anchorterminal.com/categories/lifecycle-marketing" }, { "name": "Braze", "url": "" } ], "description": "Braze is a hosted engagement platform that stores customer profiles and events, builds segments and sends campaigns and Canvas journeys by email, SMS, push and in-app message. Agents reach it through a REST API and an official remote MCP server.", "facts": [ "rank #371 of 722", "OAuth or key auth", "0 desk reviews" ], "h1": "Braze", "image": "https://www.anchorterminal.com/assets/og/tools-braze.png", "path": "/tools/braze", "published": "2026-10-01", "section": "tools", "title": "Braze review for AI agents, grade C (61.2/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/braze" }, "tokens": { "markdown": 7950, "slim": 2030 }, "version": 1 }