Salesforce MCP Server: Tools, Setup and Security

Salesforce's hosted MCP servers let AI apps such as Claude, ChatGPT and Cursor read and update Salesforce data using the signed-in user's own permissions. Salesforce runs the servers, and an admin turns each one on in Setup before anyone can connect.

Checked against: Salesforce's hosted MCP servers repository and wiki on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

Salesforce offers several hosted servers, and admins can also build custom ones. The repository's FAQ names two starting points:

• platform/sobject-reads: read-only access to records. Salesforce says "there is physically no tool available that can create, update, or delete a record."
• platform/sobject-all: read, write and delete, plus prompt templates (usable in Claude and Cursor) such as account review briefings.

The Quick Start Guide uses a getUserInfo tool to test a new connection. For the full list of servers and tools, Salesforce points to its official servers reference on developer.salesforce.com. That page blocked our automated check, so this profile does not reproduce the full tool list.

Admins can also attach APIs and Flows to custom servers. The Security and Permissions page describes custom tools built from Named Queries, Apex Invocable Actions, Apex REST endpoints and Flows.

Salesforce also notes that its server is deterministic: no language model runs on the Salesforce side. If you want MCP for Salesforce development work rather than CRM data, Salesforce points to the separate Salesforce DX MCP Server.

How to connect it

The Confirming Availability page and Quick Start describe these steps:

1. Confirm your org is Enterprise Edition or above. If MCP is missing, Salesforce says to ask Support to enable the MCPService permission.
2. In Setup → API Catalog → MCP Servers, toggle on the servers you need. Changes can take up to 2 minutes.
3. Create an External Client App (Connected Apps are not supported). The Quick Start uses scopes mcp_api and refresh_token, with PKCE enabled. A new app can take up to 30 minutes to propagate.
4. In your client, enter the server URL, client ID and client secret.

The connection guide lists URL patterns. For production orgs:

https://api.salesforce.com/platform/mcp/v1/{servername}
https://api.salesforce.com/platform/mcp/v1/d/{mydomainname}/{servername}

Salesforce recommends the My Domain (/d/) form for all orgs. Sandboxes use a /sandbox/ path. Salesforce suggests testing in Postman first, then connecting Claude, ChatGPT, Cursor or Microsoft Copilot Studio using its per-client guides.

Security notes

• User context only. Salesforce says the agent gets "the same permissions as the human who authenticates," including CRUD, field-level security and sharing rules. There are no service accounts.
• Audit trail. If the agent edits a record, the user's name appears as the editor.
• Start read-only. Salesforce recommends platform/sobject-reads for most organizations first.
• Narrow further with custom tools. Named Queries let an admin fix exactly which objects and fields a tool can query.
• Off by default. Every server must be activated by an admin.
• API quota. Each tool call uses one or more API calls from your daily limit.
• No mcp-remote. Clients that need the mcp-remote npm bridge are not supported.

A user with broad permissions gives the agent broad permissions too. Read MCP excessive permissions and the MCP Security Center before enabling sobject-all.

Alternatives

• HubSpot MCP server: a hosted server covering CRM, content and marketing email.
• Zoho CRM MCP server: pre-built servers split by task, including a read-only one.
• Gong MCP server: read-only revenue insights from calls and emails.

Next step

Most teams should start with sobject-reads in a sandbox and a small pilot group. If you want help scoping custom tools or Flows for an agent, see our MCP development service or browse the MCP server directory.

Frequently asked questions