How is this different from connecting Customer.io MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Customer.io MCP API changes?

We track the Customer.io MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Customer.io tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Customer.io?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Customer.io MCP server myself?

No. TrustGate connects to the Customer.io MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Customer.io directly.

Connect Customer.io MCP to your AI agents, securely.

Q: Is Customer.io MCP secure?

The server itself exposes 8 tools, and some of them can write to your Customer.io account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Customer.io.

One secured endpoint for every Customer.io call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Customer.io MCP now

What your agents can ask once Customer.io MCP is connected.

Select the tools your AI agents can call

8 tools from the Customer.io MCP schema.

Showing 8 tools

cio_primereadLoads the AI-ready reference for the Customer.io API. The agent is expected to call this at the start of a task.
cio_schemareadDiscovers API endpoints: lists resources, finds endpoints and inspects parameters before any call is made.
cio_read_apireadMakes authenticated GET requests for listing, reading and inspecting resources, with filtering, pagination and dry-run previews.
cio_write_apihigh riskMakes authenticated POST, PUT and PATCH requests to create and edit resources, with dry-run previews. With the write:live scope this reaches message sending, subscriptions and suppressions.
cio_delete_apihigh riskMakes authenticated DELETE requests to remove resources, with dry-run previews. Deleting people requires the live-data setting to be turned on by an account admin.
cio_skills_listreadLists the available agent skills: task-specific instructions for multi-step operations such as creating automations.
cio_skills_readreadReads the full content of a specific skill so the agent can follow its step-by-step workflow.
cio_auth_statusreadShows the current authentication state, including which workspaces the token can access.

What Customer.io MCP exposes

Customer.io MCP groups its 8 tools into 3 categories, each with a suggested starting policy.

All 8 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
API Gateway	Loading the AI-ready API reference, discovering endpoints and inspecting their parameters, and then issuing authenticated GET, POST, PUT, PATCH and DELETE requests across the full Journeys UI API and CDP Data Pipelines API, each with dry-run previews	Read / Write	The three request tools exist so reads, writes and deletes can be approved separately. Allow cio_read_api freely and gate the other two; requests with unknown body fields return 422 rather than dropping them silently
Skills	Listing the Customer.io-maintained library of task-specific instructions for multi-step operations, and reading the full content of one so the agent can follow a step-by-step workflow	Read	Read-only and vendor-maintained. The agent fetches the right skill on its own, so what it reads here shapes how it uses the write tools afterwards
Session	The current authentication state, including which workspaces the token can reach	Read	Call it before any write to confirm the workspace, since Customer.io expects the workspace to be named explicitly and a token may reach several

Connect Customer.io MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Customer.io
Find Customer.io in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Customer.io MCP or block it. You allow the exact tools each agent can call, one by one.

Customer.io MCP	8 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 8 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Customer.io MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Customer.io MCP8 documented tools covering the full Journeys UI API and CDP Data Pipelines API, at mcp.customer.io/mcp (US) or mcp-eu.customer.io/mcp (EU). Five OAuth scopes: read, read:sensitive, write, write:live and configure. An account admin must enable MCP, and live-data editing and sensitive-data access are separate switches that are off by default.
Coding assistants	Connection & credentialsper user	API Gateway5 tools
Internal copilots	Tool access policiesdeny by default	Skills2 tools
Workflow automations	Request & response inspectioninline	Session1 tool
Compatible MCP clients	Activity monitoringalerts and logs