Salesforce Hosted MCP Servers: what they do, access and how to connect

Salesforce hosts official remote MCP servers. One is read-only; others create, update or delete records as the signed-in user. An admin enables them; users sign in with OAuth. Verified 21 Oct 2026.

Official remote MCP servers · read, write & delete

Hosting: Remote HTTP, hosted by Salesforce (https://api.salesforce.com/platform/mcp/v1/{server}; sandboxes add /sandbox/; a My Domain form .../mcp/v1/d/{mydomain}/{server} is also documented). Experience Cloud custom domains aren't supported yet, per Salesforce's wiki
Auth: OAuth 2.0 authorization code flow with PKCE through an External Client App you create; scopes mcp_api and refresh_token
Read / write: By server: SObject Reads read-only; Mutations creates and updates; Deletes deletes; All does all three
Works with: Claude (web, Desktop; Claude Code inherits it), ChatGPT developer mode, Cursor, Postman, Agentforce Vibes; other OAuth-with-PKCE clients
Plan requirement: Enterprise Edition and above, or Developer Edition (per Salesforce's wiki); Salesforce says the servers are for customers with Flex Credits and usage may be billed, but publishes no per-call rate
Last changed: 7 May 2026, per the dataset; Salesforce's release notes could not be opened to confirm the change
Verification: Verified 21 Oct 2026 by theFinanceStack · confidence: high

What can an agent do with Salesforce through MCP?

Query, search and read any object the signed-in user can see and, on write servers, create, update and delete records with that user's permissions.

Salesforce offers four standard SObject servers with fixed tool sets, all off until an admin enables one.

Where it runs

Server	Tools
SObject Reads	6 read tools: schema, SOQL query, cross-object search, current user, recent records and related records
SObject Mutations	Schema, query and search plus create, update and update-parent tools. It has no delete tool.
SObject Deletes	Query tools paired with two delete tools
SObject All	All 11
Product servers	Data 360, Tableau Next, CMS and beta features

Good to know

Writes go straight to the live record, with no draft step.
No tool is built to make payments.
Write tools reach every object the user can edit, which in some orgs includes quotes, orders or billing objects.

Can

Look up schemas, run SOQL queries and search across objects (all SObject servers)
Read the current user, recent records and related records (Reads, All)
Create records and update records or their parents (Mutations, All)
Delete records or parent records (Deletes, All)
Query Data 360 and Tableau Next KPIs (product servers)
Call admin-built Apex, Flow and Named Query tools (custom servers)

Cannot

Undelete a record; recovery is in the Salesforce UI for up to 15 days (per Salesforce)
Do anything the user can't do in Lightning or the REST API (per Salesforce)
Run as a service account; a named user signs in through a browser (per Salesforce)
Change a standard server's tool set (per Salesforce)
Use Connected Apps, Dynamic Client Registration or mcp-remote (per Salesforce)

What access does it get?

Exactly what the signed-in user can do: object permissions, field-level security and sharing apply to every call.

Where	Scopes and permissions (as documented)	Admin requirement
SObject Reads (platform/sobject-reads)	mcp_api (access MCP servers) and refresh_token on the External Client App; read-only tools	Admin enables the server in Setup › API Catalog › MCP Servers and creates the External Client App; by default any org user can sign in
SObject Mutations, Deletes and All	Same two scopes; write and delete reach every object the user can edit or delete	Same. Salesforce suggests a Permission Set on the app to limit who signs in, and one app per client
Product servers (Data 360, Tableau Next, CMS, beta servers)	Same two scopes; product permissions not documented by the vendor	Admin enables each server; Salesforce doesn't document product-server licensing on these pages, but the product (Data 360, Tableau Next, CMS) must be in the org

How do I connect it?

An admin enables a server and creates an External Client App; each user then adds the server URL as a custom connector and signs in.

Admin: in Setup › API Catalog › MCP Servers, turn on the narrowest server you need, e.g. platform/sobject-reads.
Admin: in Setup › External Client App Manager, create an app with OAuth, callback URL https://claude.ai/api/mcp/auth_callback and scopes mcp_api and refresh_token. Under Security, select Issue JWT-based access tokens for named users (Salesforce's wiki also enables Require PKCE) and deselect the other options. Copy the consumer key. Allow up to 30 minutes.
In Claude click Customize › Connectors › Add › Add custom connector, name it and enter the server URL, e.g. https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads.
Click Continue, choose Use your own OAuth client and paste the consumer key as OAuth Client ID. Leave OAuth Client Secret blank unless the app requires one; Salesforce suggests Require Secret for Web Server Flow for web clients such as claude.ai, so if enabled, paste the secret too. Then Connect and sign in.
Click Configure to switch off tools you don't want and require approval for the rest. Team/Enterprise: an Owner adds the URL and OAuth client in Admin settings › Connectors instead (per Salesforce's wiki).

What should a finance team watch for?

Writes and deletes land in the live org at once, so start read-only, restrict who can sign in and keep approval on write tools.

Writes post immediately. Deletes go to the Recycle Bin and can be recovered for up to 15 days, with no undelete tool; deleting a master record also deletes its detail records, per Salesforce.
Least privilege: enable platform/sobject-reads unless writes are needed, and prefer Mutations over All to rule out deletes.
By default any org user can sign in through a new External Client App, and refresh tokens stay valid indefinitely. For production, Salesforce suggests optional hardening: a Permission Set, refresh tokens of 30 days or less with rotation, and single logout to cut off departing staff.
Salesforce says the servers are for customers with Flex Credits and usage may be billed; it publishes no per-call rate, linking to its Flex Credits usage page and your account executive. Each call also uses the org's daily API quota. SOQL returns at most 50,000 records, search 2,000.
Notes, descriptions and emails are untrusted text: an injected line could push the agent to change an amount or stage, or delete records. Keep approval on write tools.
Keep any client secret out of shared files. Salesforce says its servers run no language model and logs calls under the user's name; for training, see your AI provider's terms.

How could finance teams and accounting firms use it?

Use the read-only server for pipeline and customer questions. Keep the write servers for updates a person approves first.

Inside a company

Pull open opportunities by stage and close date to sanity-check the bookings forecast.
List closed-won deals in a period to compare with what billing has invoiced.
Find accounts with past-due close dates or missing contract fields before quarter end.
Propose follow-up tasks or field corrections, with Claude set to ask for approval before each write tool runs.

At an accounting firm

Pull a client's closed-won deals for a period to tie out against the revenue schedule in the client's ledger, signed in as your own user in the client's Salesforce org.
Search notes and related records for contract terms such as start dates or discounts.
Summarise a client's pipeline by owner and stage ahead of a forecasting meeting.
Give each client its own read-only connector. You sign in to each one as a named user, in the one org that holds its External Client App.

Whatever the use, keep a person approving anything that changes Salesforce, and tie any revenue figures back to the ledger before relying on them.

Want Salesforce connected to Claude for your team?

We configure scoped connections and a review step before anything changes your books. Fixed fee.

Book a 30-minute setup call

Change log

Date	Change	Source
2026-10-21	Re-verified: scopes documented, Flex Credits note, new CMS and beta servers	developer.salesforce.com/docs/platform/hosted-mcp-servers/gu
2026-05-07	Last dated change recorded in the dataset	developer.salesforce.com/docs/platform/hosted-mcp-servers
2026-04	Generally available: v1 URLs, servers off by default, scopes mcp_api and refresh_token (per Salesforce's wiki)	github.com/forcedotcom/mcp-hosted/wiki/FAQ

FAQ

Is this official?

Yes. Salesforce builds and hosts these servers and documents them on its developer site and GitHub wiki. It has no Claude directory listing.

Is it free?

Salesforce says the servers are for customers with Flex Credits and usage may be billed. Its wiki lists Enterprise Edition and above, plus Developer Edition.

Does it change data in Salesforce?

Only on a write server. SObject Mutations creates and updates, SObject Deletes deletes, SObject All does both, straight into live records. SObject Reads changes nothing.

Is my data used to train models?

Salesforce says its MCP servers run no language model. Check Salesforce's and your AI provider's terms for training and retention.

Can my accountant use it on my behalf?

Salesforce doesn't document delegated access. Every call runs as one named user, so an accountant needs their own Salesforce user in the client's org, permitted on the External Client App. Salesforce doesn't document an MCP-only user type; check licensing with the client's Salesforce account team.

Something wrong or out of date? Tell us and we'll email you when it's fixed.

Sources

Verified by theFinanceStack, 21 Oct 2026. Vendor list on the CFO Software Market Map courtesy of Jason Staats; AI connectivity data by theFinanceStack. Not tax, compliance or financial advice.