Salesforce MCP server: what AI agents can read and change - Relaticle Salesforce MCP server: what AI agents can read and change ========================================================= Salesforce's hosted MCP servers let Claude and ChatGPT work in an org with the signed-in user's permissions. Here is what each server can do, what setup takes, and how confirmation works. Manuk Minasyan · November 12, 2026 · 5 min read ![Salesforce MCP server: what AI agents can read and change](https://relaticle.com/storage/ink/01M6A3KW13HVNVXCFBQ8ZC2HKT.png) Salesforce runs hosted MCP servers that let Claude, ChatGPT and other MCP clients read and change data in a Salesforce org. They are generally available on Enterprise Edition and above, and on Developer Edition. An administrator turns on each server, and every tool call runs with the signed-in user's permissions. We build Relaticle, an open-source CRM with its own MCP server, so we track how other CRMs let agents in. This page covers which servers Salesforce offers, who decides what an agent can do, and what setup takes. We update it when Salesforce changes the servers. Last checked: November 1, 2026. [](#which-servers-salesforce-offers "Permalink")Which servers Salesforce offers ------------------------------------------------------------------------------- Salesforce's [standard servers reference](https://developer.salesforce.com/docs/platform/hosted-mcp-servers/references/reference/servers-reference.html) lists four servers for CRM records: | Server | What it can do | |---|---| | SObject All | Create, read, update and delete, plus query and search, across all objects | | SObject Reads | Read and query only | | SObject Mutations | Create and update, no delete | | SObject Deletes | Delete only | Other standard servers cover CMS content, Data 360, Tableau Next and analytics, and some are in beta. Standard servers have fixed tool sets. An administrator can also build a custom server from Flows, Apex actions or Named Queries. [](#who-decides-what-the-agent-can-do "Permalink")Who decides what the agent can do ----------------------------------------------------------------------------------- The agent never gets more than the person who signs in. Salesforce's [security guide](https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) says the agent "inherits the authenticated user's full security context": - Object permissions decide which records it can read, create, update or delete. - Field-level security hides fields the user cannot see and locks fields the user cannot edit. - Sharing rules keep private records private. - An update shows the signed-in user as the editor in the audit trail. Three controls narrow it further: 1. **The server you enable.** SObject Reads has no tool that writes. Salesforce recommends it as the place to start. 2. **Custom tools.** A Named Query or a Flow exposes exactly the data or action an administrator defines. 3. **The External Client App.** Linking it to profiles and permission sets decides which users can connect through which client. [](#what-setup-takes "Permalink")What setup takes ------------------------------------------------- Setup is an administrator's job, and it has more steps than most MCP servers. - Servers are off by default. An administrator turns each one on under Setup, API Catalog, MCP Servers. - Each client needs an External Client App with the `mcp_api` and `refresh_token` scopes. Older Connected Apps do not work. - Only the OAuth authorization code flow with PKCE is supported. There are no service accounts. - Clients that rely on Dynamic Client Registration cannot connect. Salesforce [names](https://github.com/forcedotcom/mcp-hosted/wiki/Known-Limitations) Claude, ChatGPT, Cursor and Postman as clients that work. - A new External Client App can take up to 30 minutes to work everywhere. - Every tool call counts against the org's daily API quota. [](#how-confirmation-works "Permalink")How confirmation works ------------------------------------------------------------- Salesforce does not stop a write on the server. Its delete tool tells the model to "Confirm with the user before deleting." Delete tools also carry the MCP `destructiveHint` annotation. Salesforce's [best practices](https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/general-best-practices.html) say well-behaved clients use these hints, "auto-executing read-only tools and requiring confirmation for destructive ones." Whether a person approves a change therefore depends on your client. A deleted record goes to the Recycle Bin and can be recovered in the Salesforce UI for up to 15 days. No undelete tool is available over MCP. HubSpot is stricter about writes. Its record-writing tool asks for confirmation before any create or update, as our [HubSpot MCP page](https://relaticle.com/blog/hubspot-mcp-server-what-ai-agents-can-read-and-change) describes. [](#four-checks-before-you-connect-an-agent "Permalink")Four checks before you connect an agent ----------------------------------------------------------------------------------------------- Run these in a sandbox or on a test record before you trust the connection with a real pipeline. 1. **Identity.** Ask the agent which user and org it is connected as. It should name the user you intended. 2. **A hidden field.** Ask for a field that user's field-level security hides. The agent should not see it. 3. **A denied write.** Connect through SObject Reads and ask for an update. No tool should be able to update the record. 4. **Revocation.** Revoke the connection, then repeat a read. It should fail. Our [access checklist for AI agents](https://relaticle.com/blog/crm-ai-permissions-before-connecting-an-agent) turns these into a worksheet you can keep per connection. [](#how-relaticle-handles-the-same-questions "Permalink")How Relaticle handles the same questions ------------------------------------------------------------------------------------------------- Relaticle has a shorter setup and fewer access controls than Salesforce. - **Setup.** There is no server to enable. You add the MCP server's URL to your client and sign in, or use a personal access token. - **Credential limits.** A personal access token carries chosen abilities: read, create, update and delete. A read-only token rejects writes at the server, much like SObject Reads. - **Permissions.** Access follows the user's workspace role: owner, admin, member or viewer. There is no field-level security. Use a separate workspace for data an agent should never reach. - **Writes over MCP commit directly.** Like Salesforce, Relaticle's MCP server has no confirmation step of its own. Read tools are marked read-only and delete tools destructive, so a client that honours the hints can ask before a delete. - **Rela works the other way.** Rela, the built-in AI assistant, proposes each change as a card you approve. - **A record of what the agent did.** The activity log shows who changed each record and through which channel, MCP included. To set up a connection, start with [how to connect Claude to your CRM with MCP](https://relaticle.com/blog/how-to-connect-claude-to-your-crm-with-mcp). [](#change-log "Permalink")Change log ------------------------------------- - **November 1, 2026:** First version. Tagged [ #mcp ](https://relaticle.com/blog/tag/mcp) On this page Keep reading Related posts. ---------------- - [ Nov 5, 2026 Comparisons ### HubSpot MCP server: what AI agents can read and change HubSpot's remote MCP server reads most CRM objects, confirms each record write, and follows the connected user's permissions. Since October 30, 2026, a beta lets AI connectors read Sensitive Data. ![](https://relaticle.com/storage/ink/01M66YM4VGJRY0HJ3M105DX9PZ.png) ](https://relaticle.com/blog/hubspot-mcp-server-what-ai-agents-can-read-and-change) - [ Sep 25, 2026 Comparisons ### Relaticle vs HubSpot: An Honest Comparison HubSpot offers a broad customer platform with free AI and official MCP. Relaticle offers self-hosting and flat hosted CRM pricing. ![](https://relaticle.com/storage/ink/01M17KWTZTX58HNQR895414XWY.png) ](https://relaticle.com/blog/relaticle-vs-hubspot-an-honest-comparison) - [ Sep 15, 2026 Comparisons ### Relaticle vs EspoCRM: An Honest Comparison Compare Relaticle and EspoCRM on AI, MCP, deployment, extensions, and pricing. Check the core and extension features your team needs. ![](https://relaticle.com/storage/ink/01M17KWNQDZWRT04M9TG1VY7HE.png) ](https://relaticle.com/blog/relaticle-vs-espocrm-an-honest-comparison)