Every tool call runs as the user who authorized it, so object permissions, field-level security and sharing rules do the access control and the API log attributes each action to a named user — there is no service account to provision and no second permission list to keep from drifting. How far an agent can reach is a choice of server, from query-only up to full CRUD, and anything the standard servers do not cover you assemble yourself on a custom server out of Flows, Apex invocable actions, Apex REST endpoints and Prompt Builder templates the org already maintains.
Salesforce's own servers for a single org, connected over standard OAuth from any MCP client — Claude, ChatGPT, Cursor, Postman or a custom agent. You configure the server once inside Salesforce instead of building an API integration for each AI tool your team uses.
- Four SObject servers, so how much an agent can do is a deployment choice: `platform/sobject-reads` can only query, `platform/sobject-mutations` adds create and update, `platform/sobject-deletes` is built around delete, `platform/sobject-all` does all of it.
- `getObjectSchema` hands the model a compact index of your business objects first and full field schema on request, carrying any admin-authored guidance about data quality and business definitions alongside the standard schema.
- `soqlQuery` for precise filtering and relationship traversal; `find` when the term could sit in any object — it searches across objects at once and returns a maximum of 2,000 records.
- Tableau Next asks questions in your data team's own definitions: `list_semantic_models` to find the model that covers the data, `analyze_data` to put a plain-English question to the Analytics Agent against it.
- Data 360 exposes three meta-tools — `search`, `payload_examples`, `execute` — that find the right Connect API at call time rather than loading all of them up front, which keeps token usage low however many Data 360 APIs exist.
- Headless 360 (Beta) reaches Setup and platform operations through four tools — Discover, Describe, Dispatch and a read-only Dispatch — backed by a library of operations that grows with each release.
- Standard servers ship with a fixed tool set: an administrator can switch a server on or off, but cannot edit what it exposes.
- An External Client App created in Setup with OAuth enabled — Connected Apps are not supported. Allow up to 30 minutes before it is operational, then copy its consumer key for the client.
- Two OAuth scopes on that app: Access MCP servers (`mcp_api`) and Perform requests at any time (`refresh_token`). Under Security, select Issue JSON Web Token (JWT)-based access tokens for named users.
- A callback URL that matches your client exactly — `https://claude.ai/api/mcp/auth_callback` for Claude, `http://localhost:8787/callback` for recent Cursor versions, `https://oauth.pstmn.io/v1/callback` for Postman over HTTP.
- An administrator to turn the servers on, from Setup → Quick Find → MCP Servers under API Catalog. They are off by default, and a server takes up to 2 minutes to become active after it is enabled.
- If you connected during the pilot or beta: the `v1-beta.2` URL path stops working, and the beta scopes (`api`, `sfap_api`, `refresh_token`, `einstein_gpt_api`) are replaced by `mcp_api` and `refresh_token`. Update the URL and scopes in each client, then have every user authorize again.
- Room in your plans for version turnover — each hosted server version is supported for a minimum of three years from first release, with at least one year's notice before support for a version ends.
One command plus a key — https://api.salesforce.com/platform/mcp/v1/platform/headless-360, then supply credentials