Enterprise MCP Servers: The 2026 Agent Action Layer

An enterprise MCP server is a vendor-run endpoint that lets any AI agent call a business system's real operations — not just read its records. Docusign said on September 4, 2026 that it will open its Model Context Protocol server to every AI agent on September 30, making agreement workflows callable from Claude, ChatGPT, Gemini, Copilot, Slack, and any MCP client.¹

TL;DR

Plenty of software companies run MCP servers. What separates this group is what the server is allowed to do: execute work inside the platform, under the platform's own permission model, on behalf of an agent the vendor did not build.

Docusign is the latest large enterprise platform to move an MCP server toward that footing. Salesforce took Hosted MCP Servers generally available on April 29, 2026, and ServiceNow shipped a Now Assist MCP server in its Zurich Patch 4 release before expanding the surface with Action Fabric on May 5, 2026.²³⁴

Forrester predicted that thirty percent of enterprise app vendors would launch their own MCP servers during 2026.⁵ The interesting part is not the count. It is that the hard problem has moved from integration to authorization.

What You'll Learn

• What Docusign is actually opening on September 30, and to which clients
• How Salesforce and ServiceNow got there first, and how their permission models differ
• Why these three vendors all reach for governance language rather than capability language
• Why the 2026-07-28 MCP spec arrived after two of the three launches, not before
• What changes for your team if agents can now act inside your systems of record

What Docusign announced

Docusign (Nasdaq: DOCU) announced from San Francisco on September 4, 2026 that its MCP Server becomes generally available globally on September 30.¹

This is a promotion, not a debut. Docusign's developer documentation has carried the server under a "(Beta)" label since at least February 4, 2026, aimed at developers connecting tools like Claude, Copilot, and Postman.⁶ The company also listed "Released the Docusign Model Context Protocol (MCP) server" among the business highlights of the quarter that ended July 31, 2026.⁷ What changes on September 30 is the audience and the support commitment.

The company frames what is exposed as "agreement intelligence and governed action," powered by its AI engine, Iris. Agents will draw on past negotiations, accepted terms, clauses, and company policy across Intelligent Agreement Management and, in Docusign's words, "even in advanced CLM workflows."¹

The server is described as built for the enterprise, with account-level admin controls, global multi-region infrastructure, and multilingual support.¹

Allan Thygesen, Docusign's CEO, put the thesis plainly: "For enterprise AI to truly succeed, it must integrate with the foundational systems that businesses rely on, like agreement management."¹

The financial context explains why this is a business decision rather than a developer-relations gesture. Docusign reported $875.7 million in revenue for its second fiscal quarter ended July 31, 2026, up 9% year over year, with Intelligent Agreement Management reaching 15.1% of total ARR — up from 12.6% three months earlier.⁷

Thygesen tied that result directly to agents in the earnings release: "We said IAM would be the agreement system of action, and this quarter we delivered. Our AI agents are now securely executing contract workflows end-to-end."⁷

IAM is the fast-growing part of the business, and the MCP server is how Docusign puts it in front of agents that live in someone else's product.

The pattern: three platforms, one bet

Docusign is joining a wave rather than starting one, and the wave is older than the Docusign announcement suggests.

ServiceNow was the most explicit about the distinction it thinks matters. "Other platforms let agents read and write data," its Action Fabric announcement argued. "ServiceNow enables agents to execute governed work: flows, playbooks, approvals, catalogs — the full system of action."²

Its example is concrete. The playbook that powers a password reset through the ServiceNow UI can now power that same reset directly from Claude, headlessly, without a traditional user interface in the loop.²

Anthropic is ServiceNow's first design partner for Action Fabric, connecting Claude Cowork to the platform.² Salesforce, meanwhile, appears on Docusign's side of the table: Joe Inzerillo, Salesforce's President, Enterprise & AI Technology, said Agentforce and Slackbot "will read and act on contract terms in real-time."¹

That cross-vendor quoting is the tell. Each platform wants to be the layer other companies' agents call.

From context to action

For most of MCP's life, the interesting question was retrieval — how an agent gets the right context into a prompt. These launches are about the opposite direction, and all three vendors describe it in governance terms rather than capability terms.

Forrester's prediction spelled out the mechanism, and the claim embedded in it: "With the MCP server working with the platform's APIs, AI agents can only access and act on authorized data, just like a human user."⁵

That sentence is doing a lot of work. It says the vendor's existing permission model — not a new agent-specific one — is what constrains the agent.

The two vendors already in general availability implement that differently, and the difference matters more than the marketing.

ServiceNow routes every action through its AI Control Tower, so it is identity-verified, permission-scoped, and fully auditable, with managed OAuth, enterprise audit trails, session management, and role-based tool packages in the MCP Server Console.²

Salesforce binds the agent to a person instead. "Every transaction runs as the authenticated user, without anonymous service accounts or a new security model to learn," its GA announcement states, with OAuth and PKCE controlling access, and existing CRUD, field-level security, and sharing rules applying automatically.³

Salesforce draws the audit consequence out explicitly: "If the agent updates a record, that person's name appears in the audit trail. If their permissions don't allow an operation, the agent can't do it either."³

That is a real architectural fork. Run-as-user gives you attribution for free and caps the agent at one human's permissions. A scoped service identity decouples the agent from any individual, which is more flexible and considerably easier to over-provision.

The spec caught up to the vendors

It is tempting to credit the protocol for this wave. The timeline does not support it.

MCP's current revision, 2026-07-28, replaced the stateful session model with a stateless protocol core, so any request can land on any server instance behind a plain round-robin load balancer.⁹ That is the difference between a demo server and something a vendor can run across multiple regions.

But it published on July 28, 2026 — after ServiceNow's MCP server shipped and roughly three months after Salesforce's GA.⁹³⁴ ServiceNow's own MCP client FAQ, written against the Zurich Patch 4 release, lists the supported protocol version as 2025-06-18.⁴

So the vendors built enterprise MCP servers on the older, session-based spec and solved scale and authorization in their own infrastructure. The new revision ratifies that work rather than having enabled it.

What the revision does change is how much of that work stays bespoke. It hardened authorization with RFC 9207 issuer validation, credentials bound to the issuer that minted them, and a formal shift away from Dynamic Client Registration toward Client ID Metadata Documents.⁹ It also moved Tasks out of the experimental core into a formal extension for long-running work — which is what a contract approval chain actually is.⁹

We covered the stateless 2026-07-28 specification and its authorization changes when it landed. The vendors will migrate to it on their own schedules.

Adoption numbers support the maturity claim even if the causality does not. MCP's maintainers reported close to half a billion downloads a month across the Tier 1 SDKs, with the TypeScript and Python SDKs each crossing a billion total downloads.⁹

One data point from inside a production system is more telling than either. Honeycomb's Austin Parker reported that "nearly 20% of all monthly interactive queries are now made by agents."⁹

What this changes for teams

If you run an agent platform, the practical effect is that the integration work you were planning may already be someone's product.

The counterweight is that permission design becomes urgent. A read-only MCP integration that returns the wrong document is an annoyance; a write-capable one that sends the wrong agreement is an incident.

Three things are worth settling before you wire an agent to any of these servers.

Find out whose identity the agent is using. This is not uniform across vendors. Salesforce runs every MCP transaction as the authenticated user and says so explicitly.³ If a platform instead lets you connect a scoped integration identity, the blast radius of the agent is exactly the scope of that token, so provision narrowly per workflow rather than reusing an admin connection.

Check what your audit trail actually attributes. Salesforce puts the authenticated user's name on agent-made record changes,³ and ServiceNow lists enterprise audit trails and session management in its MCP Server Console.² If you aggregate logs centrally, confirm that the agent, the prompt, and the human behind them survive the trip into your SIEM.

Decide where the human checkpoint sits. The 2026-07-28 revision preserves mid-call user input through Multi Round-Trip Requests, so a server can pause and ask for a confirmation or a missing parameter before acting.⁹ Whether your agreement-sending tool uses it is a design choice you should make deliberately, not discover in production.

The open question is liability, and it is not one MCP answers. When an agent acting on delegated authority takes an action the principal did not intend, who pays remains unresolved.

How big does this get

IDC projects the number of active AI agents globally will grow from roughly 28.6 million in 2025 to more than 2.2 billion by 2030 — a figure ServiceNow cited in making its own case for the model.²¹⁰

Treat that as a vendor-selected forecast rather than a settled fact; the underlying report is subscription-gated. The directional point survives the skepticism: if even a fraction of those agents act inside enterprise systems, every one of them is a channel into a platform, and the platforms know it.

That is the strategic logic under all three launches. An MCP server is not a feature. It is a claim on being the system other companies' agents route through.

The bottom line

The interesting part of 2026's agent story is not model capability. It is that the companies holding enterprise workflow and record systems decided, over the course of this year, to let agents they do not control execute work inside them.

Forrester's thirty-percent prediction was about how many vendors would ship.⁵ The more useful signal is what they shipped: not read-only context endpoints, but write access to core business operations, wrapped in whatever permission model the platform already had.

For teams building on this, the work has shifted. Discovery is standardized, transport is increasingly stateless, and the vendor runs the server. What is left is deciding exactly what your agent may do, knowing whose identity it does it under, proving afterward that it did only that, and knowing where an agent's discovery of these endpoints comes from in the first place.

Those were always the hard parts. They are the ones still left.

References