Salesforce MCP server: what AI agents can read and change

Salesforce offers four generally available hosted MCP servers — SObject All, SObject Reads, SObject Mutations and SObject Deletes — that let Claude, ChatGPT, Cursor and Postman read and change CRM records in Enterprise Edition and above and Developer Edition orgs, with every tool call running under the signed-in user's permissions, according to Salesforce's hosted MCP servers documentation. Servers are off by default and require an administrator to enable them under Setup, API Catalog, MCP Servers, plus an External Client App with the mcp_api and refresh_token scopes; only the OAuth authorization code flow with PKCE is supported, Dynamic Client Registration clients cannot connect, and a new External Client App can take up to 30 minutes to work everywhere. Salesforce does not block writes server-side — its delete tool instructs the model to "Confirm with the user before deleting" and carries the MCP destructiveHint annotation — so whether a person approves a change depends on the client, and deleted records sit in the Recycle Bin for up to 15 days with no undelete tool available over MCP.

Salesforce runs hosted MCP servers that let Claude, ChatGPT and other MCP clients read and change data in a Salesforce org. They are generally available on Enterprise Edition and above, and on Developer Edition. An administrator turns on each server, and every tool call runs with the signed-in user's permissions. We build Relaticle, an open-source CRM with its own MCP server, so we track how other CRMs let agents in. This page covers which servers Salesforce offers, who decides what an agent can do, and what setup takes. We update it when Salesforce changes the servers. Last checked: November 1, 2026. Salesforce's standard servers reference https://developer.salesforce.com/docs/platform/hosted-mcp-servers/references/reference/servers-reference.html lists four servers for CRM records: | Server | What it can do | |---|---| | SObject All | Create, read, update and delete, plus query and search, across all objects | | SObject Reads | Read and query only | | SObject Mutations | Create and update, no delete | | SObject Deletes | Delete only | Other standard servers cover CMS content, Data 360, Tableau Next and analytics, and some are in beta. Standard servers have fixed tool sets. An administrator can also build a custom server from Flows, Apex actions or Named Queries. The agent never gets more than the person who signs in. Salesforce's security guide https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions says the agent "inherits the authenticated user's full security context": - Object permissions decide which records it can read, create, update or delete. - Field-level security hides fields the user cannot see and locks fields the user cannot edit. - Sharing rules keep private records private. - An update shows the signed-in user as the editor in the audit trail. Three controls narrow it further: 1. The server you enable. SObject Reads has no tool that writes. Salesforce recommends it as the place to start. 2. Custom tools. A Named Query or a Flow exposes exactly the data or action an administrator defines. 3. The External Client App. Linking it to profiles and permission sets decides which users can connect through which client. Setup is an administrator's job, and it has more steps than most MCP servers. - Servers are off by default. An administrator turns each one on under Setup, API Catalog, MCP Servers. - Each client needs an External Client App with the mcp api and refresh token scopes. Older Connected Apps do not work. - Only the OAuth authorization code flow with PKCE is supported. There are no service accounts. - Clients that rely on Dynamic Client Registration cannot connect. Salesforce names https://github.com/forcedotcom/mcp-hosted/wiki/Known-Limitations Claude, ChatGPT, Cursor and Postman as clients that work. - A new External Client App can take up to 30 minutes to work everywhere. - Every tool call counts against the org's daily API quota. Salesforce does not stop a write on the server. Its delete tool tells the model to "Confirm with the user before deleting." Delete tools also carry the MCP destructiveHint annotation. Salesforce's best practices https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/general-best-practices.html say well-behaved clients use these hints, "auto-executing read-only tools and requiring confirmation for destructive ones." Whether a person approves a change therefore depends on your client. A deleted record goes to the Recycle Bin and can be recovered in the Salesforce UI for up to 15 days. No undelete tool is available over MCP. HubSpot is stricter about writes. Its record-writing tool asks for confirmation before any create or update, as our HubSpot MCP page https://relaticle.com/blog/hubspot-mcp-server-what-ai-agents-can-read-and-change describes. Run these in a sandbox or on a test record before you trust the connection with a real pipeline. 1. Identity. Ask the agent which user and org it is connected as. It should name the user you intended. 2. A hidden field. Ask for a field that user's field-level security hides. The agent should not see it. 3. A denied write. Connect through SObject Reads and ask for an update. No tool should be able to update the record. 4. Revocation. Revoke the connection, then repeat a read. It should fail. Our access checklist for AI agents https://relaticle.com/blog/crm-ai-permissions-before-connecting-an-agent turns these into a worksheet you can keep per connection. Relaticle has a shorter setup and fewer access controls than Salesforce. - Setup. There is no server to enable. You add the MCP server's URL to your client and sign in, or use a personal access token. - Credential limits. A personal access token carries chosen abilities: read, create, update and delete. A read-only token rejects writes at the server, much like SObject Reads. - Permissions. Access follows the user's workspace role: owner, admin, member or viewer. There is no field-level security. Use a separate workspace for data an agent should never reach. - Writes over MCP commit directly. Like Salesforce, Relaticle's MCP server has no confirmation step of its own. Read tools are marked read-only and delete tools destructive, so a client that honours the hints can ask before a delete. - Rela works the other way. Rela, the built-in AI assistant, proposes each change as a card you approve. - A record of what the agent did. The activity log shows who changed each record and through which channel, MCP included. To set up a connection, start with how to connect Claude to your CRM with MCP https://relaticle.com/blog/how-to-connect-claude-to-your-crm-with-mcp . - November 1, 2026: First version. mcp https://relaticle.com/blog/tag/mcp