Salesforce MCP: What it is and how to govern it.

Salesforce MCP is the set of servers and clients with which Salesforce implements the Model Context Protocol, the open standard that allows an AI agent to read data and perform actions in an external system. In 2026, it stopped being a developer's issue and became an access channel for the org, with official servers hosted by Salesforce itself, a native client within Agentforce, risk scoring for third-party servers and, as of November, a registration and billing model for each agent that talks to the platform.

The difference for the IT manager is one of nature. A traditional integration has an owner, scope and contract. An MCP connection is opened by a user in three clicks within Claude, ChatGPT or Cursor, inherits that user's permissions and starts executing whatever the language model decides to execute. Salesforce has designed controls for this, but almost all of them are turned off by default and depend on an administrative decision: which servers to call, to whom, with what tools, with what registry, and at what cost.

This guide explains what the MCP is, where it appears in Salesforce, what the platform guarantees on its own, what your org is responsible for and what changes with Agentic Identity and charging in Flex Credits. We have already covered how Claudeforce puts Salesforce inside Claude and what Winter ‘27 imposes on your org. The MCP is the common infrastructure underneath the two.

What is Salesforce MCP?

Salesforce MCP is Salesforce's implementation of the Model Context Protocol (MCP), an open standard created by Anthropic and donated in December 2025 to the Agentic AI Foundation, from the Linux Foundation. In Salesforce it appears in three forms: Hosted MCP Servers, servers hosted by Salesforce that expose records, Flows, Apex, Data 360 and Tableau to clients such as Claude, ChatGPT and Cursor; MCP for Agentforce, a native client that allows an Agentforce agent to consume registered and risk-scored third-party servers; and Salesforce DX MCP Server, an open source tool for developers. Each call runs with the permissions of the authenticated user, requires an External Client App and, with Agentic Identity scheduled for November 2026, will be recorded and measured in Flex Credits.

The protocol's official documentation uses a helpful image: the MCP is the USB-C port for AI applications. Instead of a proprietary connector for each tool, a single standard connects any compatible client to any data source or system. Claude, ChatGPT, Visual Studio Code and Cursor already speak MCP. Salesforce describes its use with the same logic: you configure the server once and any MCP client connects via OAuth, instead of a bespoke integration for each AI assistant that the team adopts.

For Salesforce, MCP is also the backbone of a larger strategy. At TDX 2026 in April, the company presented Headless 360, the idea of decoupling the platform from the browser so that agents can build, act and deliver on any surface. At Dreamforce in September, the layer was named AIforce, and on October 9, 2026 Marc Benioff renamed it SIforce. The name changes, the architecture doesn't: the Headless Toolkit exposes each platform capability via API, MCP, or command line, and the MCP is the path that external agents use. On the integration side, the MuleSoft makes the movement symmetrical with MCP Bridge and Agent Fabric: transforms existing APIs into MCP tools and governs traffic between agents.

Where does MCP appear in Salesforce

The most common mistake is treating “the Salesforce MCP” as one thing. There are three products with different audiences, controls and billing models.

Shape	Salesforce is	Who uses it	What for	Main control
Hosted MCP Servers	Server	Users with Claude, ChatGPT, Cursor, Postman or Agentforce Vibes	Read and change records, run Flows and Apex, query Data 360 and Tableau from within an AI assistant	External Client App, servers linked by admin, user permissions
MCP for Agentforce	Customer	Agentforce Agents	Call third-party server tools (logistics, ERP, external bases) within an agent	Server log, tools allowlist, MCP Risk Scores
Salesforce DX MCP Server	Development tool	Developers on IDEs and code wizards	Deploy metadata, run tests, analyze code, operate DevOps Center using natural language	Allowlist of orgs on the server itself, open source

There are also MCP servers from neighboring products, such as Slack, Heroku, MuleSoft and Marketing Cloud Engagement, and the pre-built server that Anthropic and Salesforce deliver within the Salesforce in Claude plugin. They follow the same logic as Hosted MCP Servers: Salesforce as a source of data and actions, the AI assistant as an interface.

1. Salesforce as a server: Hosted MCP Servers

Salesforce Hosted MCP Servers are servers maintained by Salesforce that give an AI agent a governed path to interact with the org's data and automations. According to the documentation for developers, they allow operations on standard and custom objects respecting field-level security and sharing rules, expose Apex Invocable Actions, methods @AuraEnabled, Apex REST, Flows, and Named Queries as codeless connector tools provide access to Data 360 SQL queries and Tableau analytics, and deliver Prompt Builder templates as MCP prompts. Authentication is OAuth 2.0 per user, with PKCE required.

Salesforce made Hosted MCP Servers generally available in TDX 2026, and the list of servers has grown with each release ever since. Winter '27 brought the Content Read-Only server into general availability, with 18 tools for Salesforce CMS, the Content Write server, with 15 tools for creating and managing workspaces and content, and the Metadata Grounding server in beta, which gives development agents a semantic reading of the org's metadata.

The default servers

Default servers are preconfigured by Salesforce, come offline, and can be activated by your administrator, but the toolset for each cannot be changed. All require per-user authentication and apply the platform's default security model to each call.

Server	What it exposes	Status
SObject All	Create, read, update and delete records, query and search across all objects	Available
SObject Reads	Read and consult only, no changes	Available
SObject Mutations	Create and update, without deleting	Available
SObject Deletes	Deletion only	Available
Backup and Recover	Discover and inspect backups, manage policy, and conduct guided restore	Available
Content Read-Only and Content Write	Reading and writing Salesforce CMS assets, workspaces, channels, content, and folders	Read-Only General Availability Winter ‘27
Data 360	Query unified customer data in Data 360 by SQL	Available, consumes Flex Credits
Headless 360	Full range of Setup and platform through four tools: Discover, Describe, Dispatch and read-only Dispatch	Beta
Metadata Grounding	Discover and reuse objects, fields, LWC, users, permission sets, Flows and Apex classes from a connected org	Beta
Tableau Next	Discover semantic models, query KPIs, and run analytics	Available
CRM Analytics	Discover apps, inspect datasets, run SAQL and read dashboard metadata	Beta, read only, only in sandbox and scratch org

The Headless 360 server deserves separate attention because it is the closest to the promise of AIforce. Instead of exposing thousands of resources as individual tools, it offers four: Discover performs a semantic search on the platform's index of operations, Describe returns the technical contract for an operation, Dispatch executes, and Dispatch read-only executes queries only. The examples in the documentation give the dimension: creating a user and assigning a permission set, deactivating the account of someone who left, creating a Named Credential, setting up an integration that sends events to AWS when accounts change. Salesforce itself recommends configuring the client to ask for approval before any tool that changes configuration or data, and testing in a sandbox before production. Requires API 67.0 or higher and an External Client App with the scope mcp_api.

Customized servers

Default servers are immutable. To combine tools from different servers into a single URL, or to expose the org's own logic, the administrator creates custom servers in Configuration, in Integration, in Salesforce MCP Servers. The documentation uses the image of the buffet and the plate: Salesforce, ISVs, and internal developers put tools on the buffet; the admin assembles each persona’s dish. One team only receives CRM reading tools; another receives writing and a specific Flow.

A custom server can include autolaunched Flows, Apex classes with @InvocableMethod, methods @AuraEnabled that already serve Lightning components, Apex REST endpoints, and APIs registered in the API Catalog, and can be deployed between sandbox and production via Metadata API. Managed packages from ISVs do not yet load MCP server configurations; What the ISV can do is deliver Apex and Flows with these annotations, and the subscribing admin sets up the server in the org itself.

The documentation gives examples of dishes: a sales server with reading and writing records, a Flow that records meeting notes as activities and an Apex action that enriches leads; a data hygiene server with query, deletion and a deduplication Flow, pointed to a profile that only data stewards use; a reporting server with SOQL query, Tableau Next tools and Data 360 SQL, without any writing.

What do you need to call

None of this works alone, and this is the most important governance point. The official sequence is:

1. Create an External Client App in Configuration, with sysadmin permission, with the scope mcp_api, PKCE and JWT tokens. Each MCP server configuration links to an External Client App. Connected Apps are not suitable for MCP authentication. This requirement falls on top of migration that Winter ‘27 already asks: Salesforce blocked the creation of new Connected Apps in Spring '26 and will end support for them in Summer '27.
2. Activate the servers in Configuration, in Quick Find, in MCP Servers, within the API Catalog. They are turned off by default, and Salesforce is explicit about why: capabilities that expose org data to external systems require intentional action from the administrator. Activation takes up to two minutes.
3. Configure the client with the server URL and consumer key of the External Client App. Salesforce tested Claude, ChatGPT, Cursor, Postman and Agentforce Vibes; Other clients that support OAuth 2.0 Authorization Code with PKCE should work. The recommendation is to start with Postman, which calls the tools directly and returns JSON without model interpretation, to validate authentication and responses before calling an assistant.
4. Test with a natural language request via the client interface.

In Agentforce Vibes, the Salesforce development environment, platform servers are enabled without External Client App. It is a convenience for the developer and a point to know for those who govern: the development path does not pass through the same gate as the production path.

2. Salesforce as a client: MCP for Agentforce

The opposite movement is Agentforce consuming MCP servers from outside. Salesforce introduces the Agentforce native MCP client with three components: a centralized server registry, which serves as a system of record for all MCP servers in the company, including across orgs; security and governance over the platform's permissions framework; and rate limiting to prevent overload. The admin registers the server, the platform discovers the tools, the admin chooses which ones are allowed, and these tools become agent actions in Agentforce Builder, without code. Ready-made partner servers are located on AgentExchange.

For those who operate the Agentforce today, the official Winter '27 considerations define what can and cannot be done:

Appearance	What Salesforce Documents
Editions	Enterprise, Performance, Unlimited and Developer, with additional licenses depending on the type of agent
Transport	Streamable HTTP only; HTTP+SSE and other protocols are not supported
Server authentication	No authentication or OAuth 2.0 client credentials; authorization code, PKCE, JWT bearer and dynamic client registration are not supported
User Identity	There is no user-level authentication: the agent cannot, for example, give a refund to a specific user, but can search for all invoices
Capabilities	Tools only; apps, prompts and server features are not supported
Collections	Agent actions that call MCP tools are charged at the same rate as other agent actions, reported in Digital Wallet
Timeout	60 seconds per server call; 120 seconds for Atlas reasoning when multiple servers are called
Implementation	Server log is not packaged; When deploying an agent in another org, you need to register the server, release the tools and exchange the actions for those generated on the target

The absence of user identity is the restriction that most changes agent designs. An MCP server consumed by Agentforce operates with credentials of the application, not the person served. Any use case that depends on “who is asking” needs to resolve this in the agent logic or target system.

MCP Risk Scores and observability

Third-party server is an attack surface. Salesforce cites three vectors that natural language controls do not catch: prompt injection, tool poisoning (a tool description that instructs the model to do something other than what it advertises) and the so-called rug pull, when a trusted server changes its behavior after registration. The answer, announced at Dreamforce 2026 and delivered at Winter '27 within Security Center, is MCP Risk Scores: each third-party server is scanned upon registration in Agentforce, given a Low, Medium or High score with remediation steps, and continues to be monitored afterwards so that malicious post-registration changes are flagged. The admin now has one place to view risk, set policies, and block high-risk servers.

In the same release, Observability Center enters beta to track, in near real-time, sessions, errors and performance of external agents connected via MCP or direct API, without scaling to engineering. Security Center is a paid add-on to the platform; Those who don't have it keep the API logs, which we'll cover later.

3. MCP for developers

Salesforce DX MCP Server is an open source project, under the Apache 2.0 license, published as a package @salesforce/mcp on npm. It brings together more than 60 tools organized into toolsets: orgs, metadata, data, users, tests, code analysis with Code Analyzer, DevOps Center, Lightning Web Components and Aura components, mobile and Apex performance with ApexGuru. The developer writes “deploy my metadata” in the IDE chat and the model calls the right tool, with the result of the deployment going back to the model to decide the next step.

Three server design decisions matter to those who govern. It uses TypeScript libraries directly without calling the CLI, which reduces the risk of remote code execution. It does not keep configuration secrets: it reads the authentication files already encrypted on the machine and passes usernames, never tokens, between tools. And it only accesses the orgs explicitly released in the parameter --orgs when starting; the value ALLOW_ALL_ORGS exists, and the documentation itself calls for caution. By default, only tools marked as generally available are active; the others require the flag --allow-non-ga-tools.

The server comes pre-configured in Agentforce Vibes and has configuration instructions for Claude Code, Cline, Cursor, VS Code with Copilot, Trae, Windsurf and Zed. Alongside it, Salesforce maintains Metadata Experts and Metadata API Context, servers aimed at generating valid metadata. And, since Winter '27, the Salesforce Development plugin has been on the Claude Code marketplace, packaging skills, MCP connectors and configuration for those who develop on the platform with Claude.

For a development team operating an org in production, the practical question is where do these servers point. One DEFAULT_TARGET_ORG resolved dynamically on each call, as the documentation explains, meaning that changing the project's default org changes the target of the code agent. Allowlisting orgs on the server and separating production credentials are the two lines of defense.

Security: What Salesforce Guarantees and What’s Yours

The documentation of good security practices for Hosted MCP Servers summarizes the model in one sentence: every tool call runs with the same permissions as the user who authorized the connection. The agent has the same access to objects, respects field-level security and sharing rules, and each action is attributed to the user named in the audit trails. If someone can't do something in the Lightning interface or through the REST API, they can't do it through MCP. There are no service accounts, machine-to-machine flows, or autonomous operation outside of a user's context.

This is a reassurance and a warning. Guarantee because the permissions model that your org already has is what counts. Alert because it is exactly this model that will appear, in natural language, in front of each user with an AI assistant. A profile with “View all data” that no one has reviewed since implementation becomes, through MCP, an assistant that sees all data. What the platform does by default:

• Authorization code flow only, with browser authentication, so every transaction tracks to a named user. Headless flows that would bypass the user's context are blocked.
• PKCE mandatory in all OAuth flows.
• Servers turned off by default, with explicit activation by the admin.
• No dynamic customer registration. The admin creates and configures each External Client App; No application registers itself.
• API logs with full attribution. MCP traffic appears in standard API logs, identifiable by filter API_CLIENT_CATEGORY equal to SALESFORCE_HOSTED_MCP, with operation, object accessed and time, available in daily CSV or via API. Monitoring tools that already read these logs now see the MCP without extra configuration.

What is up to the org, and what Salesforce recommends in ascending order of opening:

• Start with read-only server (platform/sobject-reads), sufficient to answer questions, generate reports and extract insights without risk of change.
• Named Queries, admin-defined SOQL queries as reusable APIs, to give access to a slice of the data model rather than the entire query surface.
• Custom tools with built-in logic, in Apex, REST or Flow, for conditional rules that default permissions do not express.
• Restrictions on External Client App, linking it to specific profiles and permission sets to control which users can use which MCP clients.
• Behavior annotations in custom tools. The protocol provides four Boolean hints: readOnlyHint, destructiveHint, idempotentHint and openWorldHint. Well-behaved clients automatically run read-only tools and ask for confirmation on destructive ones. A tool without annotation is treated as potentially destructive, which generates unnecessary commits; a destructive tool without destructiveHint passes without warning. Annotations are tips, not impositions, and do not replace access control.
• Right granularity. The documentation describes two common mistakes when building servers: subatomic tools, which map internal APIs made to be called in sequence and confuse the agent, and tools that wrap entire flows with their own decision logic, which should be a Flow. The test is whether a call returns a self-contained, useful result.

A practical rule that Salesforce itself gives and which is valid as internal policy: do not build your own proxy around the REST APIs to talk MCP. This bypasses the platform's security controls, deletes per-request telemetry, and creates a maintenance burden that grows with the API.

How much does it cost: Flex Credits, Agentic Identity and interaction charges

Here's the change most teams haven't priced in yet. On September 17, 2026, Salesforce published the “Understand AIforce Impact” knowledge paper, which defines, targeting November, a new set of security controls, an agent registry, and a new billing model as part of the Headless Toolkit. The central phrase is that the same registration step that gives an external agent their own identity on the platform is what makes their activity visible, governable and chargeable.

Item	What Salesforce Defined
Agentic Identity	The admin registers each agent on the platform; the agent receives its own identity, instead of operating with the identity of the person it assists, and can receive a narrower permission set than that of a human user. The official image is to give the agent their own badge, rather than loaning an employee's badge
Headless Platform Interaction (HPI)	Each successful call from a registered agent to the platform, via MCP or direct API, is measured as an HPI and tracked in the Digital Wallet, consuming Flex Credits
Multiplier	Not yet announced, listed as “TBA” in the Flex Credits table; agent usage is not being measured, and Salesforce will give 30 days notice before starting
Where it is measured	Only in active production orgs; sandboxes, scratch orgs and Developer Edition do not consume credits
Who needs to register	Customers purchasing on or after September 17, 2026 register all agents using Salesforce APIs within three months of notice that Agentic Identity is available; existing customers register and migrate connections upon renewal; use of any Salesforce MCP server requires registration within three months of notice for all customers
What doesn't change	Traditional integrations maintain current pricing and security; the model covers agentic traffic
Prerequisite	The org must be enabled for Flex Credits, which Salesforce says is possible with Salesforce Foundations, available for $0, or another SKU that enables this consumption

The official roadmap for when Agentic Identity arrives has four steps: enable the org for Flex Credits, register each agent with the desired identity and permission set, reconfigure MCP clients and agents via API to present the registered agent's OAuth credentials, and reconnect. After that, each successful interaction counts against Flex Credits.

There is a detail that matters for the budget. A Salesforce spokesperson told Salesforce Ben in September that the cost per interaction does not vary, but the number of interactions charged depends entirely on third-party agent behavior and implementation. As the agent decides how to execute the task, consumption varies depending on the harness and prompt. In other words, the same order may cost five calls to one client and twenty to another. It is a concrete reason to measure in sandbox, where there is no charge, before opening production.

Until then, what Salesforce documents today for Hosted MCP Servers applies: they are intended for customers with Flex Credits and can generate charges per use. Salesforce Ben found that basic access is included in Enterprise editions and higher, that Salesforce has created usage types for create, read, update and delete operations via MCP and for processes invoked by MCP, such as Flows and Apex, both currently unmetered and with the same 30 days notice, and that Agentforce actions via MCP and Data 360 queries already consume Flex Credits.

MCP Timeline in Salesforce

When	What happened
December 2025	Anthropic donates MCP to the Agentic AI Foundation, a Linux Foundation fund co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg
April 2026	TDX 2026: Headless 360 and Hosted MCP Servers in General Availability
August 26, 2026	Claudeforce: Salesforce in Claude, with pre-built MCP server and 37 sales skills
September 15-17, 2026	Dreamforce: Headless 360 becomes AIforce; announcement of MCP Risk Scores, Security Mesh and Builder Central
September 17, 2026	“Understand AIforce Impact” Paper: Agentic Identity, Headless Platform Interactions and Mandatory Registration, Targeting November
October 9, 2026	Marc Benioff announces the new name SIforce
October 12, 2026	Winter '27 generally available: MCP Risk Scores in Security Center, Observability Center in beta, Content and Metadata Grounding servers
November 2026 (target)	Security controls, agent registration and new Headless Toolkit billing model

What the IT manager decides before turning it on.

MCP does not ask for a project. It asks for eight decisions, and most of them are governance, not technology.

1. Inventory of what is already connected. Before any policy, find out who on the team has already connected Salesforce to an AI assistant. The filter SALESFORCE_HOSTED_MCP in API logs responds to hosted servers; For unofficial connectors, the list of External Client Apps and Connected Apps with active tokens is the starting point.
2. Which servers to call, and to whom. The default decision is SObject Reads for most and nothing else. Writing and deletion takes place via a customized server, per persona, with its own External Client App linked to specific profiles.
3. Review of the permissions model. Profiles with broad access that no one uses on the screen become broad access in the assistant. It's worth the same work as data governance already asks: owners, classification and least privilege.
4. Migration of Connected Apps. MCP requires External Client Apps, Winter '27 already restricts legacy streams, and Summer '27 ends support. A single work front solves all three things.
5. Policy for third-party servers in Agentforce. Who can register, what risk score is acceptable, who approves tools, and how registration is redone with each deployment, as it does not travel in the package.
6. Separation between development and production. Allowlist of orgs on DX MCP Server, production credentials outside of development machines and testing agents in sandbox, where charging does not happen.
7. Budget for Flex Credits. Enable the org, understand Digital Wallet and measure, in sandbox, how many interactions a real use case generates per customer before the multiplier is published.
8. Who responds for Agentic Identity. Registering agents, defining each one's permission set and reconfiguring clients is an admin job within three months from the notice. Someone needs to own it.

30-day itinerary

Week 1, find out. Pull API logs with hosted MCP filter and active OAuth apps list. Interview teams that use Claude, ChatGPT or Cursor on a daily basis. Register what is already connected, with which user and with which scope.

Week 2, decide. Choose the standard servers to activate, design a customized server per persona when writing is required, and create the corresponding External Client Apps, linked to profiles. Define the policy for third-party servers in Agentforce and who approves.

Week 3, validate. Connect Postman to each server and confirm authentication and responses. Connect your chosen assistant with a sandboxed test user. Run real use cases and count the calls each one generates. Review custom tool annotations.

Week 4, operate. Call in production for the pilot group, with the read-only server as a base. Create the alert in the API logs for MCP traffic outside the group. Enable the org for Flex Credits and appoint the person responsible for agent registration when Agentic Identity arrives.

How WeeNow delivers

WeeNow is an official Salesforce partner supporting orgs already in production. For MCP, we start by identifying tools the team has connected without IT involvement, then review permissions and migrate Connected Apps to External Client Apps. We connect the right servers for the right people, monitor logs and measure interactions in a sandbox before billing begins. When Agentic Identity becomes available, agent registration and client reconfiguration become part of the same support service. If you also use Claude or Slack, this is the same service that already covers Claudeforce and Claude Tag.

Salesforce MCP FAQ

What is MCP in Salesforce?

It is Salesforce's implementation of the Model Context Protocol. MCP is an open standard, created by Anthropic and today maintained by the Linux Foundation's Agentic AI Foundation, that allows an AI agent to read data and perform actions on an external system. In Salesforce it appears as hosted servers that expose the org to AI assistants, as a native client in Agentforce that consumes third-party servers, and as development tools.

What is the difference between Hosted MCP Servers and MCP for Agentforce?

In Hosted MCP Servers, Salesforce is the server: Claude, ChatGPT or Cursor connect to the org and act with the user's permissions. In MCP for Agentforce, Salesforce is the client: an Agentforce agent calls tools from a registered external server, with application credentials, without user identity.

Does MCP respect Salesforce permissions?

Yes, on hosted servers. Each call runs with the object, field and share permissions of the user who authorized the connection, and every action is attributed to him in the audit. The side effect is that broad permissions that no one has reviewed now appear in front of the user, in natural language.

Do I need a Connected App to use MCP?

No, and it doesn't fit. Hosted MCP Servers require an External Client App with the scope mcp_api, PKCE and JWT tokens. Connected Apps are not supported for MCP authentication, and Salesforce has already announced the end of support for them in Summer '27.

Are the MCP servers connected?

No. All default servers are turned off and need to be activated by an administrator in Configuration, in MCP Servers, within the API Catalog. Activation takes up to two minutes. Without this, the client will not connect even with correct authentication.

Which AI clients work with Salesforce MCP?

Salesforce tested Claude, ChatGPT, Cursor, Postman, and Agentforce Vibes. Other clients that support OAuth 2.0 Authorization Code with PKCE should work. The recommendation is to validate first with Postman, which shows the raw responses without model interpretation.

How much does it cost to use MCP in Salesforce?

Today, Hosted MCP Servers are intended for customers with Flex Credits, and registration and process operations via MCP are not yet measured, with 30 days notice before any charge. Agentforce actions via MCP and Data 360 queries already consume Flex Credits. With Agentic Identity, scheduled for November 2026, each successful call from a registered agent, via MCP or API, will be measured as a Headless Platform Interaction, with a multiplier not yet announced. Sandboxes are free of charge.

What is Agentic Identity?

This is the registration of agents on the Salesforce platform, targeting November 2026. Each registered agent receives its own identity and a permission set that may be narrower than that of a human user, and MCP clients begin to present that agent's OAuth credentials. Use of any Salesforce MCP server requires registration within three months of availability notice.

What are MCP Risk Scores?

These are risk scores, Low, Medium, or High, that Security Center assigns to each third-party MCP server registered with Agentforce. The server is scanned in the registry for prompt injection, tool poisoning, and post-registration behavior changes, and continues to be monitored afterwards. The admin can set policies and block high-risk servers. The feature arrived with Winter ‘27.

How do I know if someone has already connected Salesforce to an AI?

From API logs. Traffic from hosted servers appears with the client category SALESFORCE_HOSTED_MCP, with user, operation, object and time, in daily CSV or via API. For unofficial connectors, the list of External Client Apps and Connected Apps with active tokens complements the inventory.

Does Salesforce DX MCP Server expose org in production?

Only if the org is in the parameter's allowlist --orgs when starting the server. It reads authentications already encrypted on the developer's machine, doesn't keep secrets in configuration, and doesn't expose tokens to tools. The separation between development and production credentials is the main defense.

What is SIforce?

It is the name that Marc Benioff announced on October 9, 2026 for the layer previously called AIforce, presented at Dreamforce 2026 and originally called Headless 360 at TDX 2026. The architecture is the same: the Headless Toolkit exposes the platform via API, MCP and command line to agents and external interfaces.

Sources

• Model Context Protocol. What is the Model Context Protocol (MCP)? Official documentation, version 2026-07-28.
• Anthropic. Donating the Model Context Protocol and establishing the Agentic AI Foundation, December 9, 2025.
• Salesforce Developers. Salesforce Hosted MCP Servers: Get Started, Products Supporting MCP, Set Up Your Org, Activate MCP Servers, Connecting an MCP Client, Custom MCP Servers, General Best Practices, Security Best Practices, Standard MCP Servers Reference, and Headless 360 MCP Server (Beta).
• Salesforce Help. Winter ‘27 Release Notes: Salesforce MCP Servers (Content Read-Only, Content Write, and Metadata Grounding).
• Salesforce Help. Considerations for MCP for Agentforce, Winter ‘27.
• Salesforce Help. New Connected Apps Can No Longer Be Created in Spring ‘26, knowledge article 005228017.
• Salesforce. Agentforce MCP Support, updated September 1, 2026.
• Salesforce Help. Understand AIforce Impact, knowledge article 005360285, September 17, 2026.
• Salesforce (The 360 Blog). The Top 5 Dreamforce Announcements for IT: AIforce, MCP Security, and More, September 22, 2026.
• Salesforce (The 360 Blog). Winter ‘27 Release: Top Development & Security Features, October 13, 2026.
• Salesforce Developers. Salesforce DX MCP Server and Tools, Salesforce DX Developer Guide; salesforcecli/mcp repository on GitHub.
• Salesforce+. Master Agentic Integration with Salesforce MCP Servers, Developers at TDX 2026.
• Salesforce Ben. Salesforce Admin’s Guide to Model Context Protocol (MCP), September 7, 2026; Salesforce Will Charge Flex Credits for Agentic MCP and API Calls, September 24, 2026; Salesforce Renames AIforce to ‘SIforce’ After Trump Order, October 12, 2026.