Salesforce MCP server: setup, auth, production
Last verified: June 2026· Salesforce MCP integration
Community MCP servers existYour CRM — accounts, opportunities, and contacts.
What is the Salesforce MCP server?
A Salesforce MCP server implements the Model Context Protocol and exposes Salesforce's capabilities as typed tools an agent can discover and call in the middle of a task. Your CRM — accounts, opportunities, and contacts.
Business-system access is where a wrong write moves money or touches a customer record, so the rule is absolute: read-only by default, restricted keys, and a hard human gate on anything that mutates. The value is answering real questions against live data, safely.
A real Salesforce workflow
The agent summarizes an account’s full history for a QBR, pulls opportunity context into a report, and drafts record updates for a human to approve — CRM hygiene without the manual data entry.
What an agent can do with Salesforce
- Have an agent summarize an account’s history
- Pull opportunity context for a report
- Draft record updates for review
Read-only is the right default: let the agent observe and reason first, then grant specific write actions deliberately — each behind audit logging and, for anything high-impact, human approval.
Setting up the Salesforce MCP server
Use Salesforce OAuth with a permission set scoped to the specific objects and fields the agent needs. Salesforce’s object/field-level security is granular — use it rather than a blanket profile.
Auth: Salesforce OAuth with a permission set scoped to needed objects. Credentials belong in the environment or a secret store — never in the repo or the agent's sandbox. Wiring a server into Claude Code or Cursor is the same for every tool; the step-by-step lives in the MCP connection guide.
The risk to watch with Salesforce
CRM data is customer PII and revenue data. Object- and field-level scoping plus a gate on record writes keep an agent from over-reading or corrupting the pipeline.
More broadly, a production-grade Salesforce integration needs object-level permission scoping and guardrails on record writes. The MCP security checklist applies to every integration — we build servers with these controls baked in.
Troubleshooting
If the Salesforce tools don't appear after setup, it's almost always auth or transport. See MCP server not connecting for the step-by-step fix — and note that hosted servers often need OAuth, not a plain API key. To understand how MCP relates to ordinary tool use, see MCP vs function calling.
Frequently asked questions
Is there an official MCP server for Salesforce?
Community MCP servers exist. Whichever you use, a production setup needs object-level permission scoping and guardrails on record writes.
How does authentication work for Salesforce over MCP?
Salesforce OAuth with a permission set scoped to needed objects. Credentials should never live in the sandbox or the repo; route them through your client's secret handling or a vaulted credential.
What can an agent actually do with Salesforce?
Have an agent summarize an account’s history; Pull opportunity context for a report; Draft record updates for review. Start read-only and add write access deliberately, behind audit logging.
Is it safe to give agents access to Salesforce?
Yes, when scoped correctly: least-privilege credentials, read-only by default, audit logs on every call, and human approval for any high-impact action. Object-level permission scoping and guardrails on record writes.