Salesforce Sales Cloud / Platform is included for generally available hosted MCP servers that can expose org records, SOQL/search, prompt templates, and administrator-curated Flow, Apex, REST, and API Catalog tools to external AI clients.
Concrete capability record
A field-by-field summary of what the reviewed first-party references actually support. Publisher update dates and BYO-UI review dates are shown separately below.
Standard and custom SObjects, schema, SOQL and search results; prompt templates; and curated tools backed by autolaunched Flows, Apex invocable or Aura-enabled methods, Apex REST, Named Queries, and cataloged REST endpoints, plus separately licensed product servers.
Use read-only SObject servers for schema, query, search, and relationship traversal, or expose selected read tools from prompts, Flows, Apex, REST, Named Queries, API Catalog, Data 360, and Tableau through a custom server.
Choose immutable standard servers for full CRUD, create/update without delete, or delete-only access; custom servers can invoke state-changing Flow, Apex, REST, or API Catalog tools selected by an administrator. Each operation remains constrained by the authenticated user.
Each client is registered as an External Client App and uses per-user OAuth 2.0 Authorization Code with PKCE. GA scopes are mcp_api and refresh_token; every call enforces the user's object permissions, field-level security, sharing rules, and underlying automation access.
Servers are disabled by default and require administrator enablement. Use scoped standard servers or persona-specific custom servers, preserve request telemetry and user audit attribution, and annotate custom tools accurately; annotations guide clients but do not enforce confirmation.
GA is documented for Enterprise Edition and above. Standard server toolsets are fixed, custom server behavior depends on selected org logic, not every REST endpoint is available through API Catalog, clients may ignore tool annotations, and broad SObject servers can expose every object permitted to the user.
First-party access
Agent access
Support: Official MCP server
Read scope: Read-only SObject schema/query/search/relationships plus administrator-selected prompt, Flow, Apex, REST, Named Query, API Catalog, Data 360, or Tableau reads exposed by the chosen standard or custom server.
Write scope: SObject All supports create/read/update/delete; SObject Mutations omits delete; SObject Deletes is delete-only. Custom Flow, Apex, REST, and catalog tools may have their own effects, so the active server and tool determine write risk.
Authentication: Per-user OAuth 2.0 Authorization Code with PKCE through an administrator-created External Client App; GA connections request mcp_api and refresh_token.
Approval boundary: Salesforce marks platform tools with read-only and destructive hints, but annotations are advisory and some clients ignore them. BYO-UI must require confirmation for delete servers and consequential custom tools, and should inspect custom annotations rather than treating them as enforcement.
Confirm the current tool catalog, plan, region, scopes, rate limits, terms, and write behavior before implementation.
Editorial assessment
A comparative architecture lens—not a quality score, market ranking, or buying recommendation. Scale: 1–5.
Proposed customer-shaped experiences
The output could be an export, report, graph, artifact, application, agent, workflow, or downstream feed. These proposals are derived from documented access—not claims that Salesforce ships them.
Evidence and dates
“Publisher updated” is shown only when the page exposes an update date. “BYO-UI reviewed” records when this research checked the reference. A missing publisher date is reported as missing—not replaced with the review date.
First-party API reference or API overview recorded for this platform.
Inventory source: structurally normalized; content was not individually reopened in this pass.
First-party developer documentation or platform overview.
Inventory source: structurally normalized; content was not individually reopened in this pass.
Reverified the named access facet exactly as bounded by the reviewed first-party record.
Full-profile first-party re-verification on 2026-07-12; see the private audit ledger.
First-party product homepage used to confirm product identity and current positioning.
Inventory source: structurally normalized; content was not individually reopened in this pass.
First-party MCP documentation or product announcement recorded for this platform.
Inventory source: structurally normalized; content was not individually reopened in this pass.
First-party webhook, event, SDK, embedded-app, or extension documentation.
Full-profile first-party re-verification on 2026-07-12; see the private audit ledger.
standard MCP server catalogs and write tiers
standard MCP server catalogs and write tiers reviewed from live first-party material on 2026-07-22.
hosted MCP client registration and authentication
hosted MCP client registration and authentication reviewed from live first-party material on 2026-07-22.
hosted MCP observability, annotations, and tool governance
hosted MCP observability, annotations, and tool governance reviewed from live first-party material on 2026-07-22.
Salesforce Hosted MCP GA status, plans, scopes, and audit
Salesforce Hosted MCP GA status, plans, scopes, and audit reviewed from live first-party material on 2026-07-22.
Tied to cited first-party evidence reviewed for this profile.
Official links recorded for deeper research but not necessarily reopened endpoint by endpoint.
System role, maturity interpretation, and architectural boundary.
Interface patterns and compositions—not vendor product claims.
