Solutions / Use case

Your CRM. Your agents. Under control.

Connecting AI agents directly to Salesforce or HubSpot is fast to prototype and dangerous in production. Agent Gateway for MCP gives agents governed CRM access — every call traceable, every permission enforced, zero raw system access.

Book a demo See customer results

exploit success rate on unmanaged MCP servers: 92%
lower token costs with composite MCP tools vs. raw server access: 10×
Tray connectors available as governed MCP tools: 700+
execution uptime across all Tray workflows: 99.99%+

Direct CRM access for agents is fast to ship. Dangerous to run.

Salesforce and HubSpot hold the most sensitive commercial data in most companies — pipeline, contacts, revenue history. Connecting an AI agent directly to either via an API key is a prototype move: no audit trail, no per-agent controls, over-provisioned credentials, and token costs that escalate as agents pull full records.

Agent Gateway for MCP puts a governed layer in between. Agents call managed MCP tools. Tray enforces who can call what, logs every invocation, and handles the multi-step orchestration so the agent doesn’t need raw CRM access to get the answer.

The token problem nobody talks about until the bill arrives.

Unmanaged MCP consumes ~75,000 tokens across 10 typical servers. A raw Salesforce MCP server exposes hundreds of API endpoints — most irrelevant to what the agent is trying to do. The agent burns tokens exploring the surface. Composite MCP tools fix this: one tool call, one result, one fraction of the context window.

What teams build

Governed CRM tools for AI agents

Publish Salesforce and HubSpot as managed MCP tools — lookup, create, update — with RBAC enforced at the tool level. Agents can't do what you haven't explicitly allowed.

Composite workflows, not raw API calls

Package multi-step CRM sequences (enrich → score → update → notify) as a single governed MCP tool. Agents call one tool; Tray handles the orchestration. 10× fewer tokens, predictable behaviour.

Audit trail for every agent action

Every Salesforce and HubSpot write traceable to the agent and user that triggered it. Satisfies SOC 2, HIPAA, GDPR audit requirements without custom logging.

Cross-system orchestration out of the box

CRM is rarely the only system. 700+ Tray connectors — Slack, Snowflake, Zendesk, NetSuite — are available as governed MCP tools in the same deployment. One platform, one contract.

Zero raw CRM access remaining post-rollout

“As we roll MCP out, I don't want end users thinking about which system they're authenticating to or what tools they have access to. Tray's Dynamic Authentication lets us scale agents across the enterprise without compromising on user-level permissions.”

Mark Gill

Head of Infrastructure, Zuora

Teams already doing this on Tray.ai

IT / Business Tech

Zuora runs 200+ SaaS applications across the enterprise. As AI capabilities surfaced across those systems — each with its own interface, ass…

Read the story →

IT / Business Tech

MCP adoption spread rapidly across J.W. Pepper without centralized governance. Teams were building AI agents faster than IT could establish …

Read the story →

Frequently asked questions

Can't we just give the AI agent a Salesforce API key? +

You can. Most teams do in early prototypes. The problems show up in production — no audit trail, no per-agent permissioning, over-permissioned credentials, and token costs that balloon when the agent pulls full records to answer narrow questions. Agent Gateway for MCP adds a governed layer between the agent and your CRM without blocking what the agent can do.

Does this work with both Salesforce and HubSpot? +

Yes. Tray has native connectors for both. Each can be published as a governed MCP tool independently, or combined into a composite workflow (e.g. sync contact state across both CRMs as a single MCP tool call).

How does RBAC work across CRM tools? +

Permissions are set at the MCP tool level — not at the Salesforce/HubSpot credential level. You define what each agent or user role can call. The underlying CRM credentials are shared and centrally managed; the access policy lives in Tray.

What does "composite MCP tool" mean in practice? +

Instead of exposing raw Salesforce endpoints as 50+ individual tools (common in open-source MCP setups), you package a workflow — lookup account → check enrichment → update stage → post Slack summary — as one governed tool. The agent calls one tool, gets one result, burns a fraction of the tokens. J.W. Pepper collapsed 500+ MCP tools into ~20 workflows using this pattern.

See MCP for Salesforce and HubSpot in action.

Walk through the scenario with a Tray.ai expert.

Book a demo Compare alternatives