Agentforce and MCP
How Agentforce connects to MCP servers, what Salesforce says about status, and how to register, allowlist and govern external tools.
Agentforce agents become more useful when they can call tools outside Salesforce: an order system, a knowledge service or another vendor's MCP server. MCP gives Agentforce a standard way to do that, as long as every tool is registered, allowlisted and governed. This page sets out what Salesforce says exists and how we would approach a connection.
Status, as Salesforce states it
Agentforce MCP capabilities and stated status
| Capability | Stated status | Source date |
|---|---|---|
| Agentforce native MCP client | Pilot with the July 2025 release | 23 Jun 2025 |
| Agentforce MCP Support | Beta, "rolling out"; customers join through their account executive | 15 Jan 2026 |
| Agentforce MCP Support GA | Status not confirmed; a third-party blog reports a Summer '26 release note from mid-May 2026 | not confirmed |
| Importing external servers via API Catalog | Described in a Salesforce developer article | 11 Aug 2026 |
| Per-user or service-account authentication | Described in a Salesforce blog | 28 Jul 2026 |
| MuleSoft MCP servers in API Catalog | Described; no release stage stated | 25 Jun 2026 |
| Agentforce agents exposed as MCP tools | Status not stated | Winter '27 materials |
How a connection works
Salesforce documents two registration routes. External and third-party servers go through the Agentforce Registry; MuleSoft and Salesforce standard or custom servers go through API Catalog. The path is Setup → API Catalog → MCP Server → import external server. Salesforce then sends initialize and tools/list to the server and creates GenAiFunction records, and an admin must allowlist tools before they appear in Agent Script. Only allowlisted tools enter the Agentforce Asset Library, and you then add a tool to an agent as an agent tool.
Salesforce describes the external server as needing OAuth 2.0 with client credentials in that import flow, and a separate July 2026 blog describes two options:
- Per-user OAuth through a named credential plus an external credential with a Per-User Principal, so each call carries the user's identity.
- A service account using client credentials, where the agent acts with one shared identity.
We prefer per-user authentication wherever the external system supports it, because it keeps the target system's permissions and audit trail meaningful. Named credential basics are in named credentials and external credentials explained.
Governance Salesforce provides
- Centralised MCP Server Registry: Salesforce describes it as the system of record, with authentication, granular access controls, policy enforcement and rate limiting.
- Agentforce Gateway: sets MCP usage policies per agent and tool, such as call-volume limits, and provides monitoring.
- Einstein Trust Layer and zero data retention apply to MCP tool use, according to Trailhead. Some 2026 Salesforce copy calls it the Agentforce Trust Layer.
- AgentExchange offers "verified MCP server support from AgentExchange partners", without naming servers or statuses.
- MCP Risk Scores appear in Security Center in Winter '27, GA per Salesforce's platform blog.
Connecting to an external server safely: our approach
We evaluate the vendor's own server first; where a system has no MCP server, we can propose a GeekMidst-built one. Any such server is a proposed design; we validate the APIs, edition and permissions for each implementation. The pattern is in Agentforce architecture.
Example proposed tool set for an order-status server
| Tool | Purpose | Read/write | Approval needed |
|---|---|---|---|
| get_order_status | Status and dates for an order the customer owns | Read | No |
| get_shipment_tracking | Carrier and tracking events | Read | No |
| create_return_request | Open a return for an eligible order | Write | Yes, confirmed in conversation or by a service agent |
| cancel_order | Cancel an order | Write | Not allowlisted; handed to a human |
Approvals for write tools
Agent Script mixes deterministic logic with LLM reasoning, so a confirmation step can be written as fixed logic rather than left to the model: the agent states the exact change and proceeds only on a clear yes, or hands off to a person. Destructive tools are simply not allowlisted. For test design, see Agentforce agent testing and guardrails.
Privacy, limits and auditability
Send the external server only the fields a tool needs. Use Agentforce Gateway call-volume policies, and check the external system's own limits; we do not assume numbers. Keep logs on both sides: who or which agent called which tool, when and with what outcome.
Errors, environments and testing
External servers should return tool failures with isError: true and a clear reason, so the agent can explain or hand off. Register sandbox endpoints first, test refusals as well as successes, and re-check the allowlist whenever the server adds tools.
Licensing
Salesforce describes Agentforce's commercial model as Flex Credits, Resolutions or per-user licensing; MCP Support was offered in beta through account executives. Confirm entitlements with Salesforce.
Available today vs proposed
| Item | Status |
|---|---|
| Agentforce MCP Support | Beta from 15 Jan 2026; GA status not confirmed |
| Agentforce Registry, API Catalog import and allowlisting | Documented by Salesforce |
| Agentforce Gateway | Documented on Trailhead; no release stage stated |
| GeekMidst external MCP servers for Agentforce | Proposed, per implementation |
Related
Agentforce and AI automation
Agent design and build
→Agentforce testing and governance
Testing and guardrails for agents
→MuleSoft and MCP
Turning APIs into governed MCP tools
→MCP host, client and server
The reference architecture
→MCP integration consulting
Evaluating servers and governance
→Questions we hear
Is Agentforce MCP support generally available?
Do all tools on a server become available to the agent?
Should we use a service account or per-user OAuth?
Does the Einstein Trust Layer cover MCP tools?
Sources
Connect Agentforce to the right tools
Tell us which systems your agents need. We can review registration, allowlists and approvals before anything goes live.
