LabscoMCP early access ↗
MCP SERVER · OFFICIAL PROJECT

Salesforce Org Data

Your org's records and analytics, reached as the signed-in user under their own sharing rules.

by Salesforce ↗CRM & Sales Pipeline✓ Official

The plugin Knowledge Work Plugins includes connection settings for this server.

LABSCO SUMMARY

The agent gets exactly the reach the person already has.

Every tool call runs as the user who authorized it, so object permissions, field-level security and sharing rules do the access control and the API log attributes each action to a named user — there is no service account to provision and no second permission list to keep from drifting. How far an agent can reach is a choice of server, from query-only up to full CRUD, and anything the standard servers do not cover you assemble yourself on a custom server out of Flows, Apex invocable actions, Apex REST endpoints and Prompt Builder templates the org already maintains.

What it is

Salesforce's own servers for a single org, connected over standard OAuth from any MCP client — Claude, ChatGPT, Cursor, Postman or a custom agent. You configure the server once inside Salesforce instead of building an API integration for each AI tool your team uses.

What you get

  • Four SObject servers, so how much an agent can do is a deployment choice: platform/sobject-reads can only query, platform/sobject-mutations adds create and update, platform/sobject-deletes is built around delete, platform/sobject-all does all of it.
  • getObjectSchema hands the model a compact index of your business objects first and full field schema on request, carrying any admin-authored guidance about data quality and business definitions alongside the standard schema.
  • soqlQuery for precise filtering and relationship traversal; find when the term could sit in any object — it searches across objects at once and returns a maximum of 2,000 records.
  • Tableau Next asks questions in your data team's own definitions: list_semantic_models to find the model that covers the data, analyze_data to put a plain-English question to the Analytics Agent against it.
  • Data 360 exposes three meta-tools — search, payload_examples, execute — that find the right Connect API at call time rather than loading all of them up front, which keeps token usage low however many Data 360 APIs exist.
  • Headless 360 (Beta) reaches Setup and platform operations through four tools — Discover, Describe, Dispatch and a read-only Dispatch — backed by a library of operations that grows with each release.
  • Backup and Recover finds and inspects backups, manages the backup policy and walks through a guided restore; Content Read-Only and Content Write reach Salesforce CMS workspaces, channels, content and folders; CRM Analytics (Beta) runs SAQL queries and reads dataset, dashboard and lens metadata.
  • Archive Connect — searching, unarchiving and analysing archived records, and handling erasure requests — is reached through the Headless 360 server and needs an Archive license on the org.
  • Standard servers ship with a fixed tool set: an administrator can switch a server on or off, but cannot edit what it exposes.

Requirements

  • Flex Credits on the org. Salesforce offers the hosted servers only to Flex Credits customers, and server use may be billed; your account executive can add them.
  • An External Client App created in Setup with OAuth enabled — Connected Apps are not supported. Allow up to 30 minutes before it is operational, then copy its consumer key for the client.
  • Two OAuth scopes on that app: Access MCP servers (mcp_api) and Perform requests at any time (refresh_token). Under Security, select Issue JSON Web Token (JWT)-based access tokens for named users.
  • A callback URL that matches your client exactly — https://claude.ai/api/mcp/auth_callback for Claude, http://localhost:8787/callback for recent Cursor versions, https://oauth.pstmn.io/v1/callback for Postman over HTTP.
  • An administrator to turn the servers on, from Setup → Quick Find → MCP Servers under API Catalog. They are off by default, and a server takes up to 2 minutes to become active after it is enabled.
  • If you connected during the pilot or beta: the v1-beta.2 URL path stops working, and the beta scopes (api, sfap_api, refresh_token, einstein_gpt_api) are replaced by mcp_api and refresh_token. Update the URL and scopes in each client, then have every user authorize again.
  • Room in your plans for change. Salesforce may retire a server or a server version it judges to be of limited value, with advance notice, and tools can be upgraded or replaced from release to release.

Setup effort

Follow the published steps

See installation options