Salesforce MCP Server Integration
How Salesforce Hosted MCP Servers work, when a custom tool set or adapter makes sense, and a proposed catalogue for Sales, Service and Platform.
Sales and service teams want to ask an AI assistant about accounts, opportunities and cases without exporting data. A Salesforce MCP server makes that possible with Salesforce's own permissions. Salesforce now runs its own: Salesforce Hosted MCP Servers became generally available (GA) on 29 April 2026, for Enterprise Edition and above. This page explains what they offer, when a custom tool set or adapter still makes sense, and the proposed catalogue we start from for Sales Cloud, Service Cloud and the Salesforce Platform.
The business use case
- Sales: a seller asks for open pipeline, recent activity on an account or a pre-call summary, bounded by their own access.
- Service: an agent gets a case summary, related history and a draft reply to edit, without switching tabs.
- Platform: an admin asks which fields an object has, or runs a pre-approved query instead of building a report.
The real questions are which tools the AI gets, whose permissions apply, and who confirms a change.
What Salesforce offers today
Salesforce announced a pilot on 23 June 2025, opened a beta on 9 October 2025 (self-enablement in sandbox, scratch and Developer Edition orgs only) and announced GA on 29 April 2026. The servers are remote endpoints hosted by Salesforce under https://api.salesforce.com/platform/mcp/v1/. Salesforce's documentation says they are "intended only for customers with Flex Credits" and that usage may be billed.
Standard Salesforce Hosted MCP Servers, as documented
| Server | What it does | Read/write |
|---|---|---|
| SObject Reads (platform/sobject-reads) | Read and query only | Read |
| SObject Mutations (platform/sobject-mutations) | Create and update, no delete | Write |
| SObject Deletes (platform/sobject-deletes) | Delete only | Write, destructive |
| SObject All (platform/sobject-all) | Full CRUD plus query and search | Read and write |
| Headless 360 | Discover, Describe, Dispatch, Dispatch Read Only | Beta (announced 14 Jul 2026) |
| Data 360 and Tableau Next | Covered on their own pages | No status label on the reference page |
Standard servers are disabled by default; an admin enables them in Setup → API Catalog → MCP Servers, and their tool sets cannot be modified. Custom hosted servers fill that gap inside Salesforce: they can expose Apex @InvocableMethod, @AuraEnabled and Apex REST methods, Flows, Named Queries, API Catalog REST APIs (including some Connect APIs) and Prompt Builder templates as MCP prompts. An MCP Server Definition is deployable metadata, and custom servers have a /sandbox/ URL variant.
Hosted servers first, a custom adapter only for gaps
We evaluate the hosted servers first. For most Sales and Service use cases the right build is a custom hosted server definition in your own org: a short, named tool list backed by Flows and Named Queries your team reviews. A separate GeekMidst adapter running outside Salesforce is a proposed option only where that cannot meet the need, for example one tool that combines Salesforce with another system, or an approval queue held outside the AI client. It is not an existing product. This is a proposed design; we validate the APIs, edition and permissions for each implementation, using the pattern in Salesforce CRM architecture.
Salesforce Hosted MCP with a custom tool set: proposed design
Proposed design: to be validated for each implementation
Select a component to see what it is responsible for and how data moves to and from it.
Components and data flows (text version)
| Component | Type | Responsibility |
|---|---|---|
| Sales or service userpilot group first | People | Asks questions and requests changes in an AI client. Sees only what their Salesforce permissions allow. |
| Approverconfirms writes | People | A named person who confirms each write, seeing the exact change before it is sent. |
| MCP hostAI client or agent | AI and agents | Holds the MCP client configuration, lists allowlisted tools and blocks write calls until they are confirmed. |
| External Client Appper-user OAuth | Identity, policy and governance | OAuth with scopes mcp_api and refresh_token, PKCE and JWT access tokens. mcp_api grants MCP access, not REST API access. |
| SObject Reads serverstandard, read and query | Salesforce product | Standard server for read and query only. Its tool set cannot be modified, so it suits read-only pilots. |
| Custom hosted MCP serverproposed tools, as metadata | Salesforce product | A short, named tool list defined as deployable metadata in your org. The tool set itself is a proposed design. |
| Sales and Service dataCRUD, FLS, sharing | Salesforce product | Accounts, contacts, opportunities and cases. CRUD, field-level security and sharing apply to every call. |
| Flows, Named Queries, Apexwhat custom tools call | Salesforce product | The reviewed logic each custom tool calls, so validation and business rules live in Salesforce rather than in prompts. |
| Audit and monitoringuser named on each call | Identity, policy and governance | Audit trail that names the user on each call, plus Security Center views such as MCP Risk Scores where licensed. |
Data flows
- Sales or service user → MCP host: questions and requests. Read questions run directly; change requests are held for confirmation.
- Approver → MCP host: confirm write. The approver confirms the before-and-after summary. Without it the call is never sent.
- MCP host → External Client App: OAuth with PKCE. Per-user sign-in. A new External Client App can take up to 30 minutes to become active.
- MCP host → SObject Reads server: read tool calls. Queries return only records and fields the user can access.
- MCP host → Custom hosted MCP server: allowlisted tool calls. Only the named tools exist on this server. Under the MCP spec, a call to an unknown tool is a protocol error.
- SObject Reads server → Sales and Service data: query as the user. Runs with the user's sharing and field-level security.
- Custom hosted MCP server → Flows, Named Queries, Apex: invoke Flow or query. A failing Flow returns a tool error; nothing is retried as a write without a new confirmation.
- Sales and Service data → Audit and monitoring: user-attributed activity. Calls and changes are attributed to the user for review.
Proposed tool catalogue
Tool names are ours; each is backed by the Salesforce feature shown, and every write needs confirmation.
Sales Cloud
Sales tools (proposed)
| Tool | Purpose | Read/write | Approval needed | Built on |
|---|---|---|---|---|
| find_account | Find accounts the user can see by name or domain | Read | No | SObject Reads or a Named Query |
| summarise_opportunity | Stage, amount, next step and recent activity | Read | No | Named Query |
| list_my_pipeline | The user's open opportunities by close date | Read | No | Named Query |
| update_next_step | Change next step and close date | Write | Yes | Flow |
| log_call_note | Create a task with a call summary | Write | Yes | Flow |
Service Cloud
Service tools (proposed)
| Tool | Purpose | Read/write | Approval needed | Built on |
|---|---|---|---|---|
| get_case_summary | Case details, history and related contact | Read | No | Named Query |
| draft_case_reply | A reply for the agent to edit; nothing is sent | Read (returns a draft) | Agent reviews | Prompt Builder template as an MCP prompt |
| update_case_status | Change status or priority | Write | Yes | Flow |
| escalate_case | Route to a queue with a reason | Write | Yes | Flow |
Salesforce Platform
Platform tools (proposed)
| Tool | Purpose | Read/write | Approval needed | Built on |
|---|---|---|---|---|
| describe_object | Fields and relationships the user can access | Read | No | Apex method on a custom server |
| run_named_query | Run one pre-approved, parameterised query | Read | No | Named Query |
| run_approved_flow | Run one allowlisted autolaunched Flow | Write | Yes | Flow |
Authentication and access control
- External Client App: hosted servers require one with OAuth scopes
mcp_apiandrefresh_token, PKCE required and JWT access tokens enabled. Allow up to 30 minutes for it to become active. Whether legacy connected apps work is not confirmed in the sources we used. - Per-user OAuth: each call runs as the authenticated user, with no anonymous service accounts, and CRUD, field-level security and sharing are enforced.
- Least privilege: start with SObject Reads or a read-only custom server, and use permission sets to limit the pilot group.
- Secrets: client secrets stay in server-side configuration, never in prompts.
Writes, approvals, privacy and audit
Read tools run without confirmation. Every write shows a before-and-after summary and waits for confirmation; if your MCP host cannot enforce that, write tools stay off. SObject Deletes stays disabled, and SObject All is avoided because its tool set cannot be narrowed. Field-level security decides what reaches a model, so review it before go-live and check with your legal adviser on the rules that apply to you. Usage may be billed against Flex Credits; check Salesforce's limits for your org. The audit trail names the user on each call, and Winter '27 adds MCP Risk Scores in Security Center (GA per Salesforce's platform blog). Failed Flows return tool errors.
Environments, testing and deployment
Build in a sandbox against the /sandbox/ endpoint, then deploy the MCP Server Definition through the same pipeline as your Flows, as described in CI/CD and release management.
Implementation stages
- 01
Choose use cases
Pick two or three read-first use cases and name an owner for each.
- 02
Confirm licensing
Check Enterprise Edition or above and Flex Credits with your account team.
- 03
Set up access
Create the External Client App and permission sets for a pilot group.
- 04
Build the tools
Write Named Queries and Flows, then the custom server definition.
- 05
Test in a sandbox
Test users with and without access, invalid input, and writes refused without confirmation.
- 06
Pilot and monitor
Enable for the pilot group, review the audit trail weekly, then widen.
Available today vs proposed
| Item | Status |
|---|---|
| Salesforce Hosted MCP Servers | GA 29 Apr 2026 (Salesforce) |
| Custom hosted MCP servers | Part of Salesforce's hosted offering; deployable metadata |
| Headless 360 MCP Server | Beta (Salesforce) |
| GeekMidst Sales, Service and Platform tool set | Proposed design |
| GeekMidst external Salesforce adapter | Proposed; only for gaps |
Related
Salesforce integration services
API, middleware and MCP integration work
→MCP integration consulting
Evaluate hosted servers and governance
→MCP security and authorisation
Trust boundaries and OAuth for MCP
→Agentforce and MCP
Connecting Agentforce to MCP servers
→MCP integration overview
All vendor servers and their status
→Questions we hear
Is there an official Salesforce MCP server?
Do we need Flex Credits?
Can we limit the AI to a few actions?
Does the AI bypass sharing rules?
Sources
- Salesforce Developers: Hosted MCP Servers are now GA
- Salesforce Developers: Hosted MCP Servers overview
- Salesforce Developers: Hosted MCP Servers reference
- Salesforce Developers: products supporting MCP
- Salesforce Developers: expose custom Apex as a hosted MCP tool
- MCP specification: authorization (2026-07-28)
Scope your Salesforce MCP pilot
Tell us which Sales or Service questions you want answered in an AI client. We can review licensing, permissions and a read-first tool set with you.
