Salesforce MCP: What It Actually Does (and How to Set It Up)

Salesforce MCP usually refers to Salesforce Hosted MCP Servers: remote, Salesforce-managed Model Context Protocol endpoints that let Claude, ChatGPT, Cursor and other MCP clients read and change Salesforce data as the signed-in user, with field-level security and sharing rules applied. They have been generally available since April 29, 2026. Salesforce also ships a local DX MCP server for developers, in beta until its end of life on November 2, 2026, and an MCP client inside Agentforce.

I read Salesforce's docs, release notes and GitHub repositories on October 6, 2026, and link them throughout.

What does "Salesforce MCP" refer to?

Several Salesforce products support MCP. These four work with your Salesforce org:

Heroku, MuleSoft and Marketing Cloud Engagement have separate MCP servers. The rest of this post covers the hosted servers.

What tools does the Salesforce MCP server expose?

Salesforce's standard servers have fixed tool sets. They are off by default, and an admin can switch them on but cannot edit them (servers reference). Four cover records:

Other standard servers cover Data 360, Tableau Next, Backup and Recover, and CMS content. Two are in beta: CRM Analytics (read-only, sandbox and scratch orgs only) and Headless 360, which since July 2026 puts dozens of mostly admin operations behind four tools: discover, describe, dispatch and dispatch_readonly.

Custom servers expose Apex invocable actions, @AuraEnabled methods, Apex REST, Flows and Named Query APIs as tools, and Prompt Builder templates as MCP prompts (overview, Products Supporting MCP). Since June 2026 they can also expose Agentforce agents built with Agent Script Builder (release note, agent docs).

SOQL queries cap at 50,000 records per transaction, and deleted records go to the Recycle Bin for up to 15 days, with no undelete tool over MCP (SObject All reference).

How do you turn on Salesforce MCP?

An admin sets it up once (setup docs):

1. In Setup, search Quick Find for MCP Servers and, under API Catalog, toggle on the servers you need. Activation takes up to 2 minutes.
2. Create an External Client App (Connected Apps are not supported) with OAuth enabled, your client's callback URL, the mcp_api and refresh_token scopes, and JWT-based access tokens for named users. A new app can take up to 30 minutes to start working (steps).
3. Share the server URL, such as https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads for a production org. Sandboxes and scratch orgs use /v1/sandbox/ in place of /v1/.

Before authorizing, users should log out of other orgs and log in to the target org in their default browser, because the MCP spec does not handle multitenant systems like Salesforce (log in to your org). Salesforce suggests testing in Postman first, starting with sobject-reads in a sandbox, and puts total setup at under 30 minutes.

How do you connect Salesforce MCP to Claude, ChatGPT and Cursor?

Salesforce has tested Claude, ChatGPT, Cursor, Postman and Agentforce Vibes, and says other clients that support the OAuth 2.0 authorization code flow with PKCE should work (client docs). Clients that need the mcp-remote bridge are not supported (FAQ).

Claude and Claude Code

Per Salesforce's Claude guide, add https://claude.ai/api/mcp/auth_callback as the app's callback URL. In claude.ai or Claude Desktop, go to Customize, Connectors, Add, then Add custom connector. Enter a name and the server URL, choose Use your own OAuth client, paste the consumer key as the OAuth Client ID, click Connect and sign in. Claude Code inherits the connector.

Developers building on Salesforce can also install Salesforce's Development plugin, which brings Salesforce skills and Salesforce-hosted MCP servers into Claude Code (Winter '27 developer guide):

/plugin install salesforce-development@claude-plugins-official

Sales teams have a third option: Salesforce in Claude, a beta plugin for organizations Salesforce approves, which needs the latest Sales Cloud enterprise edition. A Claude owner enters the app's consumer key and secret once, and each seller signs in with their own Salesforce account. The Claude MCP guide covers the Claude side.

ChatGPT

ChatGPT connects through developer mode (ChatGPT guide). Go to Settings, Apps, Create App, and enter the server URL. Under Advanced settings, choose User-defined OAuth client and copy ChatGPT's callback URL into your External Client App. Paste the consumer key and secret (Salesforce requires the secret even though ChatGPT marks it optional), uncheck OIDC enabled, and create the app. Then pick Salesforce under the plus (+) button in the prompt. The ChatGPT MCP guide covers which plans include developer mode.

Cursor

In Cursor Settings, open Tools & MCP, click New MCP Server, and put the server URL and consumer key in mcp.json (Cursor guide):

{"mcpServers": {"Salesforce": {"url": "https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads", "auth": {"CLIENT_ID": "CONSUMER-KEY"}}}}

Cursor versions use different callback URLs, so Salesforce suggests adding both http://localhost:8787/callback and cursor://anysphere.cursor-mcp/oauth/callback to the External Client App.

What about the Salesforce DX MCP server?

The DX MCP server is a local, open-source (Apache 2.0) npm package, @salesforce/mcp, with more than 60 developer tools such as run_soql_query, deploy_metadata, run_apex_test and run_agent_test. It uses the encrypted auth files already on your machine and touches only the orgs you allowlist. On October 5, 2026, Salesforce posted in the server's GitHub repositories that it reaches end of life on November 2, 2026: the repositories will be archived and the package deprecated, though pinned setups keep working. Salesforce now ships this tooling as skills.

How do permissions, limits and billing work?

Every call runs as the user who authorized the connection, with that user's object permissions, field-level security and sharing rules, and the user's name in the audit trail (security docs). Only the OAuth authorization code flow with PKCE is allowed: no service accounts, no machine-to-machine flows and no dynamic client registration. The mcp_api scope opens MCP without opening the REST APIs, and MCP calls appear in API logs as SALESFORCE_HOSTED_MCP.

Hosted servers run on Enterprise, Performance, Unlimited and Developer editions (release note). Each tool call counts as one or more API calls against your org's daily quota, and Experience Cloud custom-domain URLs are not supported yet (known limitations).

On cost, Salesforce's overview says the servers are "intended only for customers with Flex Credits" and usage may be billed. A Help article from September 17, 2026 adds that, targeting November, admins will register each agent that connects, MCP clients included, with its own identity and optionally a narrower permission set. Each successful call by a registered agent, over MCP or the API, will then be metered against Flex Credits. The rate is still TBA and metering has not started; Salesforce promises 30 days' notice and exempts sandboxes, scratch orgs and Developer Edition orgs. Registration becomes required for any Salesforce MCP server within three months of Salesforce's notice. For Agentforce's own pricing, see the Agentforce pricing breakdown.

Where does a single-vendor Salesforce MCP server stop?

These limits come with any single-vendor server, HubSpot's included:

• One system. In Salesforce's own cross-system example, the assistant connects to Salesforce alongside an ERP and does the reconciling itself.
• No learning. Salesforce describes the server as deterministic, with no model on its side; it returns records, schema and whatever guidance or prompt templates admins set up.
• Context cost. Salesforce warns that switching on all 60+ DX tools can overwhelm the model's context, and Headless 360 exposes four tools instead of thousands to keep the tool surface small.
• Per-team wiring. Each client and each user is set up separately, and Salesforce's GA post points multi-vendor setups to MCP gateways.

Salesforce MCP vs Coworker MCP: how do they compare?

Salesforce's server reaches deeper into Salesforce, through custom Apex, Flows, Named Queries, Data 360, Tableau Next and Agentforce agents, none of which Coworker's MCP page describes. If your AI work stays inside Salesforce, that depth matters more.

What should you check before connecting Salesforce MCP?

From Salesforce's External Client App, security and best practices guidance:

• Start with platform/sobject-reads in a sandbox before enabling writes or deletes.
• Require a custom permission set on the External Client App so only chosen users can sign in.
• Set refresh tokens to 30 days or less (by default they never expire), with rotation and single logout.
• Require a client secret only for web clients that store it server-side, and confirm your client's IP ranges before adding IP restrictions.
• Watch API logs for SALESFORCE_HOSTED_MCP, along with daily API usage.
• Set readOnlyHint and destructiveHint on custom tools, knowing not every client honors them.

Roll out read-only to one team first, and build a custom server around its Flows and Named Queries before turning on writes. The MCP security and enterprise MCP guides cover wider risks.

Where does Coworker MCP fit?

If Salesforce is the only system your AI tools need, use Salesforce's hosted server. It is first-party, and it applies Salesforce's own permission model to every call.

Coworker MCP is for one connection across 50+ tools, Salesforce included through Coworker's Salesforce connector, in Claude, Claude Code, ChatGPT, Cursor, Windsurf or any MCP client. For large organizations, OM2, Coworker's organizational memory, sits behind it: documents, messages and tickets become atomic facts linked to people, companies, projects and deals, and source permissions are enforced on traversal (OM2 launch post). Your admin enables MCP access, and people sign in with their existing Coworker login, SSO included (Coworker MCP).

In Coworker's benchmark, Claude with Coworker MCP and OM2 ran at 9x lower token cost and 64% faster than Claude with its native connectors in the best case (retrieval-heavy tasks, with Coworker Learning), and its answers were preferred 84.5% of the time in blind pairwise review.* Salesforce was not among the sources tested.

Coworker will run that benchmark on your data and hand you a Context Impact Report, or you can book a demo to see Coworker MCP across Salesforce and the rest of your stack.

*Statistically significant benchmarks comparing Coworker MCP vs. Claude Native Tooling: 100 tasks across 7 categories, with Google Drive, Gmail, Google Calendar, HubSpot, GitHub, Jira, Slack, Notion and Stripe connected. Across all 7 categories the same setup was 75.5% cheaper and 45.6% faster (benchmarks).

Frequently asked questions

Does Salesforce have an official MCP server?

Yes. Salesforce Hosted MCP Servers, generally available since April 29, 2026, are built and hosted by Salesforce and connect Claude, ChatGPT, Cursor and other MCP clients to your org, with read-only and write servers to choose from. The DX MCP Server for developers is in beta and reaches end of life on November 2, 2026.

Is Salesforce MCP free?

Salesforce intends hosted MCP servers for customers with Flex Credits, says usage may be billed, and counts each tool call against your org's daily API quota. Per-call metering for registered agents is targeted for November 2026, at a rate still listed as TBA, and sandboxes, scratch orgs and Developer Edition orgs are exempt.

How do I turn on Salesforce MCP?

An admin activates servers in Setup under API Catalog, MCP Servers, since they are off by default. The admin then creates an External Client App with the mcp_api and refresh_token scopes and your client's callback URL. Users add the server URL to Claude, ChatGPT or Cursor and sign in with their own Salesforce account.

What is happening to the Salesforce DX MCP server?

On October 5, 2026, Salesforce posted on GitHub that the local DX MCP server (@salesforce/mcp) reaches end of life on November 2, 2026. The repositories will be archived and the npm package deprecated, though pinned versions keep working. Salesforce now delivers that tooling as skills in forcedotcom/sf-skills.

Can Agentforce connect to other MCP servers?

Yes. With MCP for Agentforce, a native MCP client, admins register servers in Agentforce Registry, allowlist their tools and add them to agents as actions. It entered beta in January 2026 and rolled out in the Summer '26 release from May 18, 2026.

What is the difference between Salesforce MCP and Coworker MCP?

Salesforce's hosted MCP servers give AI clients governed access to one Salesforce org, including custom Apex, Flows and Agentforce agents. Coworker MCP gives the same clients one connection to 50+ tools, Salesforce among them, backed by OM2 organizational memory for large organizations. If Salesforce is the only system you need in Claude or ChatGPT, Salesforce's server is the simpler choice.

Related reading

• Coworker MCP
• Coworker + Salesforce
• Salesforce Agentforce pricing
• HubSpot MCP
• Glean MCP vs Coworker MCP
• Claude MCP
• ChatGPT MCP
• What is MCP?
• MCP security
• What is a context layer?