Salesforce and MCP: Connecting AI Assistants to Salesforce Safely

What MCP is, in plain English

MCP, the Model Context Protocol, is an open standard that lets AI assistants such as Claude or ChatGPT connect to business systems like Salesforce through one common, secure interface. Anthropic introduced it in November 2024. In December 2025 it was donated to the Agentic AI Foundation, part of the Linux Foundation, so it is now run as a neutral, open project.

On Salesforce, MCP now works in both directions:

• AI assistants into Salesforce. Claude, ChatGPT, Cursor and other MCP clients read your Salesforce data, and change it if you allow that, through MCP servers that Salesforce runs for you.
• Agentforce out to other systems. Your Agentforce agents use tools on outside MCP servers, such as a partner app from AgentExchange.
• Your agents as tools. An Agentforce agent can itself be offered as a tool that Claude or ChatGPT can call.

The official options, as of October 2026

How to connect Claude or ChatGPT to Salesforce

These are the steps in Salesforce's Hosted MCP Servers guide. You need System Administrator rights or the equivalent.

1. Create an External Client App. In Setup, search for External Client App Manager and create a new app. Turn on OAuth, add your AI client's callback URL, and add two scopes: Access MCP servers (mcp_api) and Perform requests at any time (refresh_token). Under Security, choose JWT-based access tokens for named users. Connected apps are not supported for MCP. A new app can take up to 30 minutes to start working.
2. Turn on the servers you need. They are all off by default. Search Setup for MCP Servers and activate them. Start with SObject Reads, which can only read and query.
3. Connect the client. In Claude, add a custom connector with the server URL, such as https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads, and paste the app's consumer key as the OAuth client ID. Salesforce also documents ChatGPT, Cursor and Postman.
4. Try it in a sandbox first. Sandbox URLs add /sandbox after v1. Salesforce suggests testing with Postman before an AI client, because it shows the raw tool calls with no AI model in between.
5. Each person signs in with their own Salesforce login. From then on, every call runs with that person's permissions.

Agentforce Vibes, Salesforce's own coding tool, needs no External Client App. The servers appear there once an admin activates them.

What to settle before you switch it on

• Every call runs as the person who signed in. Their object permissions, field-level security and sharing rules all apply, and the audit trail names them. Hosted MCP has no shared integration user, and Salesforce calls one an anti-pattern.
• Start read-only. Turn on SObject Reads first. Add SObject Mutations (create and update) or SObject All (which can also delete) only for the people who need them, and set the AI client to ask before any tool that changes data.
• Decide who can connect. By default, any user can sign in through the app. Limit it to a permission set, use one app per AI client, and consider IP restrictions.
• Keep the data narrow. A custom server can offer only the flows, Apex actions and named queries you choose, instead of every object.
• Plan for sign-ins. From October 21, 2026 in sandboxes and November 4 in production, a connection left unused for 30 days asks its user to sign in again, and Salesforce revokes every existing access token once when the limit starts. You can also turn on token rotation and revoke tokens in Setup under OAuth Usage.
• Know where the data goes. The standard hosted servers run no AI model of their own. The model belongs to your AI client, so what happens to data once it reaches Claude or ChatGPT depends on that vendor's terms.
• Watch the logs. MCP calls appear in Salesforce's API event logs under the person who made them. Filter the API Total Usage event for API_CLIENT_CATEGORY = SALESFORCE_HOSTED_MCP.
• Count the API calls. Salesforce's MCP wiki says tool calls count against your org's daily API limit, and calls to the Data 360 server count toward Data 360 limits and Flex Credits.
• Use the hosted servers rather than a homemade wrapper around Salesforce's APIs. Salesforce notes that a wrapper bypasses its security controls and loses request logging.

If Agentforce calls outside servers: an admin registers each server in Agentforce Registry, or installs it from AgentExchange, and approves its tools one at a time. Salesforce rates each server and tool Low, Medium or High risk at registration, blocks a tool whose definition changes later, and lets Agentforce Gateway policies limit how tools are used. The risk scores are recommendations, so review each tool yourself. MCP tool actions are billed like other agent actions.

How we connect assistants safely

We built our own MCP connection for the Odoo products we run, and we hold Salesforce work to the same rules:

• Every call runs as one signed-in person, never as a shared admin account.
• Reading comes first. Changes stay off until a person or a manager turns them on, and the assistant asks before each one.
• Delete tools stay off. Where something needs removing, we build a tool that archives or flags it instead.
• No money moves. An assistant never charges a card, issues a refund or starts a payment.
• Every call is logged under the person who made it.
• We test in a sandbox, signed in as real users with their real permission sets, before anything reaches production.

Good first uses are read-only: asking about your pipeline in plain language, pulling up an account's history before a call, or finding records with missing or inconsistent data.

How DewWow can help

Most of our client work is Salesforce development. For MCP we can:

• set up hosted MCP servers, External Client Apps and permission sets, starting read-only in a sandbox
• build custom MCP tools from flows, Apex or named queries, so an assistant sees only what it should
• register and review outside MCP servers for Agentforce, tool by tool
• move older connected apps and CLI logins to External Client Apps before connected apps lose support in Summer '27

If your data cannot go to an outside AI service, see Private AI Delivery. For help choosing what to automate, see AI consulting.

Sources: Salesforce's Hosted MCP Servers guide, the Salesforce Developers blog, Salesforce Help, the Winter '27 release notes, and modelcontextprotocol.io, read on October 16, 2026.

More guides

• Salesforce Winter '27: release updates and deadlines
• Odoo 20, AI agents and MCP
• All guides