AgentExchange: Salesforce's marketplace now lists 13,600 items with MCP

AgentExchange, Salesforce's marketplace for apps, agents, actions and MCP servers, reaches late October with more than 13,600 listings and 186,000 reviews, according to the profile PPC Land published on 20 October. The figure is explained by April's merger, when the storefront built for Agentforce absorbed AppExchange and the Slack Marketplace and inherited, in one go, more than 10,000 apps from Salesforce and its partners and around 2,600 Slack apps.

For anyone building integrations with Claude and MCP, Luis Rijo's piece is useful for one specific reason: it describes how one of the giants of enterprise software has chosen to distribute MCP servers. Not as an open registry, but as a curated channel, with upfront review and its own billing.

From agent catalogue to single store

The timeline PPC Land lays out is short. AgentExchange was announced on 4 March 2025 with more than 200 partners, including Google Cloud, Docusign, Box and Workday. On 23 June 2025 Agentforce 3 added native MCP client support, and more than 30 partners were already offering their own servers. April 2026 brought the merger with AppExchange and Slack, together with a 50 million dollar builders programme and more than 1,000 Agentforce agents and tools in the catalogue.

What is on sale today is varied: standalone actions (signing a contract, for example), prompt templates, topics that group instructions and actions, agent templates, subagents, tools, MCP servers, conventional apps and Slack integrations. MCP server providers include Amazon Web Services, Box, Cisco, Google Cloud, IBM, Notion, PayPal, Stripe, Teradata and WRITER.

The most recent case is Demandbase, which on 15 October presented itself as a featured MCP partner and intent data provider for Hunter, Salesforce's outbound sales agent. According to another PPC Land piece, agents query that server in natural language at runtime, without copying the data into Salesforce objects.

Security review as a selling point

For technical teams, the most interesting part is the mandatory review. Each partner packages its solution and submits it to Salesforce, whose reviewers trace where prompts come from, check that user input cannot rewrite system instructions, treat model output as untrusted and require human confirmation before deleting, sending or paying.

These are reasonable controls against risks already documented in MCP, such as the tool poisoning flagged in July 2025. But PPC Land cites a SalesforceDevOps.net analysis calling them "necessary but not sufficient", and notes that Salesforce has not published approval rates or review timelines. With 13,600 listings, keeping standards consistent is not trivial.

On the buyer side, administrators search a semantic catalogue backed by Data 360 from within Agentforce Builder, can negotiate private offers, pay on their regular Salesforce invoice and keep control over data permissions, API scopes and access by user, role or profile.

Curated versus open

The contrast with HubSpot appears in the article itself. On 4 May 2026 HubSpot committed to full API parity and MCP server support so that any agent can run its CRM. Salesforce is betting on the opposite: a controlled channel where the MCP server is one more item in the catalogue, with its own review and conditions.

The criticism follows the same line. In June 2025 Salesforce changed the Slack API terms to stop third-party apps from indexing, copying or retaining long term the data they pull; Tim Glomb, of RavenEQ.ai, described it as "a playbook designed to lock customers in, block out competition". A2A (Agent-to-Agent) support is limited to MuleSoft, and portability outside Salesforce is undocumented.

There is one nuance worth keeping in mind: on 26 August Salesforce embedded 37 sales skills inside Claude, with actions routed through its platform. It opens the door to other assistants, but keeps execution in house.

Who this matters to

1. Teams that already have an MCP server and sell to Salesforce customers: AgentExchange is a distribution channel with built-in billing, in exchange for passing review and accepting its rules.
2. Salesforce administrators who want to connect agents to external data without custom development.
3. Companies assessing vendor dependency: the curated model offers guarantees, but it also ties you in.

At ElephantPink we find it useful that a player of this size sets an explicit security bar for MCP servers, although we miss public data on how many clear it. For clients with a mixed stack, we still recommend designing the MCP server once and also publishing it outside any single marketplace.