Data 360 MCP Server
What Salesforce's Data 360 MCP servers offer, their stated status, and how to use them for queries and segments without losing control of data.
Data 360 holds unified profiles, engagement data and segments, which makes it attractive to AI clients and risky to expose carelessly. Salesforce provides its own Data 360 MCP servers, so the work is choosing the right one, limiting what it can do and deciding who approves changes. This page sets out what exists, using Salesforce's statuses exactly as stated, and how we would govern it.
The business use case
- Analysts and marketers ask what data exists, how a data model object is shaped, or how many profiles match a condition, without writing SQL by hand.
- Segment owners get an explanation of an existing segment, or a draft of new criteria, before building it themselves.
- Data teams retrieve API payload examples while building ingestion or activation.
What Salesforce offers, and the stated status
There is more than one Data 360 MCP server, and they differ in where they run and what they can do.
Data 360 MCP servers, as documented by Salesforce
| Server | Where it runs | Tools | Stated status |
|---|---|---|---|
| Data 360 Legacy MCP Server (data/data-cloud-queries) | Salesforce-hosted | get_dc_metadata and post_dc_query_sql, read-only | No status label stated; needs a Data 360 licence and the View Data 360 permission |
| Data 360 MCP Server (forcedotcom/d360-mcp-server) | Local, stdio, Java 17, open source | Three facade tools (search, payload_examples, execute) covering about 200 APIs | Developer Preview announced 6 May 2026; Salesforce's 19 Aug 2026 news story calls the Data 360 MCP Server "generally available now" |
| Hosted data360 server (data/data360) | Salesforce-hosted, OAuth | Read and write: CRUD, segment publish and deactivate, SQL | No separate status label on the reference page; needs API v66.0 or later |
Vendor server first, custom tools only for gaps
Salesforce's servers belong to Salesforce, and we evaluate them first. Their tool sets are fixed: standard hosted server tool sets cannot be modified, and the open-source server's execute tool reaches about 200 APIs. If you need the AI limited to a few reviewed queries, the options are an allowlist in your MCP host or gateway where it supports one, or a proposed GeekMidst server that exposes only parameterised queries your data team has written. That server does not exist yet. This is a proposed design; we validate the APIs, edition and permissions for each implementation. The surrounding pattern is in Data 360 architecture.
Proposed tool catalogue
Proposed tools and approvals
| Tool | Purpose | Read/write | Approval needed |
|---|---|---|---|
| describe_data_model | List objects and fields from metadata | Read | No |
| count_profiles | Run a reviewed, parameterised count query | Read | No |
| explain_segment | Describe an existing segment's criteria in plain words | Read | No |
| draft_segment_criteria | Return proposed criteria for a person to build | Read (returns a draft) | Segment owner reviews |
| publish_segment | Publish a segment (vendor hosted tool) | Write | Yes, segment owner |
| deactivate_segment | Deactivate a segment (vendor hosted tool) | Write | Yes, segment owner |
| Free-form SQL | Arbitrary queries | Read | Not exposed to the model in this design |
Authentication and access control
The hosted servers use OAuth through an External Client App with the mcp_api scope, and each call runs as the authenticated user with CRUD, field-level security and sharing enforced. The legacy server also needs the View Data 360 permission. The open-source server runs locally on a developer's machine; follow its repository documentation for authentication, keep it to sandbox or developer orgs, and never share credentials. Never give an AI direct database credentials or unrestricted SQL.
Read and write operations, and approvals
Start read-only: metadata and reviewed counts. Segment publish and deactivate change what downstream activations receive, so they need the segment owner's confirmation, shown with the segment name and the target. CRUD tools on the hosted server stay disabled in the host until there is a reviewed use case.
Data privacy
Prefer metadata and aggregates over profile rows. Unified profiles often contain personal data; decide which fields may reach a model, mask what is not needed, and check with your legal adviser on the data protection rules that apply to you. Consent and governance patterns are in data governance.
Limits, credits and licensing
Salesforce states that hosted data360 calls count toward Connect API limits and Flex Credits, and that hosted MCP servers are intended only for customers with Flex Credits, for Enterprise Edition and above. We do not quote numeric limits; check Salesforce's limits for your org.
Auditability, errors and environments
Hosted calls are attributed to the user. Log each tool call, its outcome and duration in the host or gateway too, without storing query results. A failed query returns a tool error with the reason. Build in a sandbox, test with the MCP Inspector CLI, and include users who lack the View Data 360 permission to prove access is refused.
Implementation stages
- 01
Pick questions
List the questions people actually ask of Data 360 and who owns each data area.
- 02
Choose the server
Decide between the hosted servers and the local open-source server for development use.
- 03
Set permissions
Create a pilot permission set and review field-level security on sensitive fields.
- 04
Write reviewed queries
Have the data team write parameterised queries for common questions.
- 05
Test in a sandbox
Test access refusal, empty results and errors, then trial segment approvals.
- 06
Pilot and monitor
Watch Flex Credit use and the audit trail before widening access.
Available today vs proposed
| Item | Status |
|---|---|
| Data 360 MCP Server | Developer Preview 6 May 2026; "generally available now" per Salesforce, 19 Aug 2026 |
| Hosted data360 and legacy query servers | Documented by Salesforce; no separate status label |
| GeekMidst reviewed-query server | Proposed design |
Related
Data 360 consulting
Data 360 design, ingestion and governance
→Salesforce Data 360 solution
How we approach Data 360 projects
→Real-time segmentation
Segment design and activation patterns
→Data 360 implementation guide
A longer planning guide
→MCP integration overview
All vendor servers and their status
→Questions we hear
Is there an official Data 360 MCP server?
Can the AI write to Data 360?
Do MCP calls cost anything?
Should the AI run any SQL it likes?
Sources
Plan Data 360 access for AI clients
Tell us which questions your teams ask of Data 360. We can map them to the right server, permissions and approvals.
