Salesforce MCP server

What is an MCP server for Salesforce?

Outdated stages, half-maintained leads, opportunities without a next step: in a long-established Salesforce org, manual data upkeep eats sales time and undermines the forecast. This is exactly where an MCP server for Salesforce comes in: it connects AI agents (Claude, GPT, Gemini, Copilot) to your Salesforce org through the open Model Context Protocol. The agent then accesses the Salesforce REST and Bulk API in a standardised way: reading leads, accounts, contacts and opportunities, running SOQL queries and, after approval, writing records. Instead of maintaining separate Apex triggers or middleware scripts for each AI integration, you define clean MCP tools once.

Technically, Salesforce is well suited to MCP, because the platform offers a consistent object model, a mature query language (SOQL) and established OAuth flows via External Client Apps. The real work is not in the API connection but in the modelling: which objects, which fields, which write permissions, and where a human approval step is mandatory. This is exactly what makes the topic a consulting case instead of plug-and-play.

Typical interested parties are Salesforce admins, CRM owners and IT heads in companies with a real sales ops budget, where manual data upkeep noticeably eats sales time and data quality decides the forecast.

Use cases: what can a Salesforce MCP server do in practice?

1. Automatic lead enrichment A new lead lands in Salesforce. The AI agent checks company name, domain and industry against public sources, fills in missing fields, detects duplicates against existing accounts and proposes a rating before sales takes over.
2. Forecast briefings from pipeline data “What does my pipeline for Q3 look like, filtered to deals above €50,000?” The agent translates this into a SOQL query across opportunities, summarises stage, close date and probability and delivers a compact briefing, without click paths through reports.
3. Duplicate cleanup The agent compares accounts and contacts by email, domain and company name, flags suspected candidates and proposes merges. Merging happens only after approval: no silent deletion of records.
4. Quote drafts from account context “Create a quote draft for account X based on the last opportunity.” The agent reads account history, open opportunities and notes and builds a structured draft; sales reviews and finalises it.
5. Activity logging & follow-up tasks After a meeting, sales dictates a short note. The agent creates the activity on the right contact, sets a follow-up task with a due date and updates the opportunity stage as a suggestion.
6. Data quality routines Recurring checks: missing mandatory fields, outdated stages, opportunities without a next activity. The agent creates a short list with a recommended action instead of yet another ignored report.

These use cases are an anonymised, realistic sketch of typical sales ops requirements, not a specific reference. Which of them can be implemented for you depends on your object structure and your profiles.

How the integration works

Architecture overview for Salesforce:

AI agent ↔ MCP server (your EU host) ↔ Salesforce REST/Bulk API (OAuth 2.0, External Client App)

Concrete technical steps:

• OAuth setup via External Client App: You authorise the MCP server with a dedicated integration user. Tokens are stored encrypted on the EU host, with rotation and a defined revocation strategy.
• Tool mapping: We define MCP tools such as query_soql, get_account, enrich_lead, update_opportunity_draft, find_duplicates, each with a JSON schema, validated inputs and clear error messages.
• SOQL guardrails: Natural-language questions are translated into checked SOQL queries. We set limits, read scopes and whitelists for objects so that no uncontrolled full-table scan occurs.
• Read vs. write separation: By default, the agent only creates drafts and suggestions. Write actions on opportunities, leads or merges require human approval, configurable per object.
• Logging: Every API action is logged with timestamp, integration user and diff, which matters for sales ops governance and audits.

Self-hosted vs. Salesforce Hosted MCP Servers

Salesforce operates its own MCP servers: the Salesforce Hosted MCP Servers have been generally available since April 2026, for every org from Enterprise Edition upwards according to Salesforce (Salesforce Developers Blog). Any MCP-capable client, such as Claude, ChatGPT or Cursor, connects to your org through them via OAuth. The connection runs via an External Client App; Salesforce does not support Connected Apps for this (Salesforce docs). Both routes have their place:

• Salesforce Hosted MCP Servers are operated by Salesforce itself. Your existing permissions (object and field rights, sharing rules) apply automatically, and every action runs under the signed-in user. There are prebuilt servers, such as a read-only one for standard objects, and custom servers built from flows, Apex actions and named queries. Makes sense if you want to start without your own infrastructure.
• A self-hosted MCP server connects any MCP-capable AI agent, with your own tools, fixed rights per agent, your own audit log and full control over hosting location, data flow and approval logic, with a locally run model on request. This is usually the crux for GDPR-driven requirements in German mid-sized companies.

Which route fits, we clarify in the AI Check; we also check the licensing question for your org in the process. In setups we know, the self-hosted variant is the first choice when EU data residency, vendor independence or an existing AI stack are the priority. You will find more on the general decision in our guide MCP vs. API & function calling.

GDPR, hosting & security

Salesforce data is generally highly sensitive: customer contacts, revenue potential, internal notes. To make sure the whole chain can be designed in line with data protection requirements, we look at the following for every MCP server for Salesforce:

• EU hosting of the MCP server (Hetzner or the Azure region Germany West Central in Frankfurt), no US edge.
• OAuth tokens encrypted, External Client App with minimal scopes, rotation and revocation strategy defined.
• DPA (data processing agreement) with the AI provider with EU data residency (Claude via AWS Bedrock in the EU region Frankfurt or Google Vertex AI EU, OpenAI Enterprise EU, Azure OpenAI in an EU region).
• Field-level security applies: Salesforce profiles and permission sets determine which fields the integration user can see at all; encrypted or locked fields stay invisible to the agent.
• Minimise personal data from note fields: Free-text fields such as account notes or activity logs can contain sensitive data. We deliberately narrow read scopes instead of releasing the whole org.
• Sandbox and org separation: The production org, sandboxes and individual teams run through separate External Client Apps, so test and real data are never mixed in the MCP flow.

You will find details of the security concept in the guide MCP server: security & GDPR.

What does it cost?

Salesforce MCP projects are more demanding than pure accounting integrations, because the data model has often grown historically. In concrete terms:

• First use case clearly scoped in production, often lead enrichment or read-only forecast briefings as a low-risk start.
• Clear scope per use case, no hours roulette. Scaling after that in small, clearly defined steps.
• Low-risk entry through a clearly scoped first use case instead of a big-bang rollout.

We name a concrete figure in the free initial call, depending on the complexity of your org, the number of connected objects and whether write access and duplicate logic are included. If you want to see the service framework, you will find it on the main service page MCP integration agency; the whole cluster is bundled in the MCP cluster hub.

Frequently asked questions

Do I need Salesforce Agentforce for an MCP server?

Not necessarily. Since April 2026, Salesforce offers Hosted MCP Servers, which according to Salesforce are available to every org from Enterprise Edition upwards; MCP-capable clients such as Claude or ChatGPT connect through them via OAuth. Alternatively, your own self-hosted MCP server connects any MCP-capable AI agent to the Salesforce REST/Bulk API, with full control over hosting, tools and data flow. Which licences your org specifically needs, we check case by case.

Can the AI agent run SOQL queries in natural language?

Yes. The MCP server translates natural-language questions into checked SOQL queries and returns structured results. Write access to opportunities or leads goes through an approval step by default, so that nothing is changed uncontrolled.

Can Salesforce plus MCP be operated in a GDPR-compliant way?

Yes, if the chain stays in the EU: MCP server in EU hosting, an AI provider with EU data residency and a DPA, and the Salesforce org ideally in an EU region. Data minimisation and field-based rights keep the data flow lean.

How are Salesforce permissions mapped in the MCP server?

Via OAuth and an External Client App with a dedicated integration profile; Salesforce does not support Connected Apps for MCP clients. The agent sees only the objects and fields that the profile releases, and the profile and permission set logic from Salesforce stays in charge.

What happens if the agent makes a write error?

In setups we know, the agent works by default only with drafts and suggestions. Every write action is logged, and critical objects such as opportunities or merges require human approval, so every step stays traceable.

Which AI models work?

In principle any model that speaks MCP, including Claude from Anthropic, OpenAI GPT, Google Gemini and Microsoft Copilot. Because the connection runs through the protocol and not through the individual model, you can change provider later without rebuilding the Salesforce integration.