What does Salesforce MCP server mean today?
Today the phrase Salesforce MCP server covers three official things. Salesforce Hosted MCP Servers are Salesforce-managed endpoints that expose an org's data, flows, Apex actions and queries to any MCP client, generally available since April 2026 for Enterprise Edition and above. The Salesforce DX MCP Server is a local developer tool on GitHub and npm that works against orgs authorized through the Salesforce CLI. Agentforce sits on the other side of the protocol as an MCP client.
The hosted servers are the production path for Claude. An administrator activates each one in Setup under API Catalog, MCP Servers; nothing is exposed until then, and every call runs as the signed-in user. The DX server is for developers: its toolsets deploy metadata and assign permission sets, and Salesforce has set its end of life for November 2, 2026.
How do you connect Claude to a Salesforce MCP server?
Claude connects to a Salesforce Hosted MCP Server as a custom connector over remote MCP, authenticating through an External Client App created in the org. Salesforce supports neither Connected Apps nor dynamic client registration here: the app needs OAuth with PKCE, the mcp_api and refresh_token scopes and JWT-based access tokens for named users, and in Claude you add it as your own OAuth client. The mcp_api scope opens the MCP endpoints without opening the general REST API, narrower than an integration user with the api scope.
On the Claude side, an Owner or Primary Owner adds the connector for a Team or Enterprise organization, and each person signs in to Salesforce individually, so Claude only reaches records that person can already see. The MCP authorization specification requires the server to publish protected resource metadata, binds each token to that server as its audience, and forbids passing a token through to another system.
Related: See Salesforce AI analytics and MCP data access
Do Salesforce permissions still apply through MCP?
Yes. Every tool call on a hosted server runs with the object permissions, field-level security and sharing rules of the user who authorized the connection, and the action is attributed to that named user in the audit trail. Salesforce states the rule plainly: anything a user cannot do in the Lightning UI or the REST API, they cannot do through MCP. There are no service accounts and no machine-to-machine flows.
That inheritance moves the governance question rather than removing it. Those permissions were set for people reading records one at a time, not an assistant summarizing thousands. A sales operations user with View All on Opportunity gets the complete pipeline; a representative gets only the deals they own or that sharing rules extend, so a total pipeline figure from that session is a personal view. By default any org user can authenticate through the External Client App, so require a custom permission set in its OAuth policies for approved users only.
Which tools should a governed Salesforce MCP server expose?
Expose read tools first, and prefer defined queries over open SOQL. Salesforce ships four standard SObject servers, from sobject-reads for read and query only, through sobject-mutations and sobject-deletes, to sobject-all, and its guidance is to start with the most restrictive configuration that meets the use case. A Named Query turns an administrator-written SOQL statement into a reusable API, so the assistant can ask about open opportunities by stage and close quarter without seeing every field.
Write tools deserve a separate decision. Custom servers can expose flows and Apex invocable actions, embedding conditional logic that standard permissions cannot express. If a write tool must exist, keep it on its own server, enable it for a smaller population, and disable write tools in Claude before a Research run, where tools execute without a per-call prompt. The MCP specification backs least privilege: servers state the scopes an operation needs and clients request only those.
How do you log and review what Claude did in Salesforce?
Start with the API Total Usage event log file, because every hosted MCP call lands there with full user attribution. Salesforce tags this traffic with the client category SALESFORCE_HOSTED_MCP and records the user, the API resource and the object touched, so a daily CSV download or an EventLogFile query shows what each person's assistant did and when. Enterprise, Unlimited and Developer editions get this event type at no extra cost with one day of retention, and Event Monitoring extends both retention and frequency.
Review a short list of questions on a schedule: which users authorized the connector, which servers and tools are active, how many calls came from read versus write tools, and whether any tool definitions changed, since Anthropic warns that server developers may update tool behavior unexpectedly. Record the answers in a connector register with a named owner, and treat a new server, scope or user population as a change that needs re-approval.
Why does a semantic layer still matter once access is governed?
Because permissions decide who may see a row, not what a question means. Ask Claude for pipeline this quarter against raw Opportunity records and it must guess whether to count every open stage or only the Pipeline, Best Case and Commit forecast categories, whether to use Amount or Expected Revenue, and how to convert multi-currency deals under dated exchange rates. Two users with identical permissions can get two different numbers, and neither answer carries its definition.
A governed semantic layer fixes the definition once and applies it on every path. Nexatron's Salesforce connector is live and exposes governed query tools to any MCP client, including Claude, so a certified pipeline metric with its stage filter, currency conversion and date logic is the only version an assistant can return. Each answer shows the query it ran, the certified pipeline definition it used and the row-level policies it applied, so a sales leader can check a number instead of trusting it. Before connecting Claude, list the metrics your executives ask for most and who owns each definition, then Book a Demo to see how those definitions travel with every answer.