Salesforce MCP server: setup, auth, production

What is the Salesforce MCP server?

A Salesforce MCP server implements the Model Context Protocol and exposes Salesforce's capabilities as typed tools an agent can discover and call in the middle of a task. Servers here are community-maintained, which makes provenance and pinning part of the setup rather than an afterthought. What this setup has in common with every other integration in the Payments & business category is covered under Payments & business on the MCP index.

A real Salesforce workflow

The agent summarizes an account’s full history for a QBR, pulls opportunity context into a report, and drafts record updates for a human to approve — CRM hygiene without the manual data entry.

What an agent can do with Salesforce

• Have an agent summarize an account’s history
• Pull opportunity context for a report
• Draft record updates for review

Read-only is the right default: let the agent observe and reason first, then grant specific write actions deliberately — each behind audit logging and, for anything high-impact, human approval.

Setting up the Salesforce MCP server

Use Salesforce OAuth with a permission set scoped to the specific objects and fields the agent needs. Salesforce’s object/field-level security is granular — use it rather than a blanket profile.

Auth: Salesforce OAuth with a permission set scoped to needed objects. Credentials belong in the environment or a secret store — never in the repo or the agent's sandbox. Wiring a server into Claude Code or Cursor is the same for every tool; the step-by-step lives in the MCP connection guide.

The risk to watch with Salesforce

CRM data is customer PII and revenue data. Object- and field-level scoping plus a gate on record writes keep an agent from over-reading or corrupting the pipeline.

Scoping a Salesforce server down

Salesforce's permission model is rich enough to do this properly and complicated enough that most teams do not. Create a dedicated integration user with a permission set granting read on named objects and fields, and use field-level security to exclude anything you would not want copied into a model's context — which for a CRM usually means contact details and anything commercially sensitive about a deal. Set login IP restrictions on the user while you are there. Writes should stay out of scope: Salesforce automation frequently fires on record changes, so an agent editing an opportunity can trigger notifications and workflows nobody anticipated.

More broadly, a production-grade Salesforce integration needs object-level permission scoping and guardrails on record writes. The MCP security checklist applies to every integration — we build servers with these controls baked in.