Answer first

Yes. Salesforce runs official hosted MCP servers, generally available since April 29, 2026 for Enterprise Edition orgs and above.

They let an MCP client such as Claude, ChatGPT or Cursor read and, if you enable the right server, write Salesforce records as the signed-in user, with that user’s permissions applied to every call.

Official MCP server
Yes, hosted by Salesforce

Editions
Enterprise and above, plus Developer Edition

Authentication
OAuth with PKCE through an External Client App

01 / Exposes

What it exposes

Salesforce ships a family of standard servers with fixed tool sets, all disabled until an admin turns them on:

  • SObject Reads: read and query only. Schema discovery, SOQL queries, SOSL search across objects, recent records and related records. Salesforce suggests starting here.
  • SObject Mutations: create and update, no delete.
  • SObject Deletes: delete only.
  • SObject All: create, read, update, delete, query and search across every standard and custom object.
  • Product servers: Data 360, Tableau Next, CMS content (read-only and write), and Backup and Recover. Headless 360 and CRM Analytics are listed as Beta.

Admins can also build custom servers that expose specific flows, Apex actions and Named Query APIs, and the GA release adds prompt templates for common tasks such as account reviews.

Developers should not confuse this with the separate Salesforce DX MCP Server, an open-source local server for building on the platform, installed from npm as @salesforce/mcp.

02 / Connect

How to connect it

  1. Enable a server. In Setup, open API Catalog, then MCP Servers, and activate the server you want, for example platform/sobject-reads.
  2. Create an External Client App with the mcp_api and refresh_token scopes. Connected Apps cannot be used for MCP authentication.
  3. Add the server URL to your client. The production pattern is https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads; sandboxes add /sandbox/ before platform.
  4. Test. Salesforce recommends Postman first, then Claude, ChatGPT (developer mode), Cursor or another client that supports OAuth 2.0 Authorization Code with PKCE.

Salesforce puts the setup at under 30 minutes.

03 / Limits

Limits

  • Edition gate. Hosted MCP servers require Enterprise Edition or above. Developer Edition orgs can also use them; lower paid editions cannot.
  • API quota. Every tool call counts against the org’s daily API request allocation. High-volume agents in an org with a small allocation can run into it.
  • Permissions are the user’s, not narrower. An agent on SObject All can do whatever the signed-in user can do in the UI. To give an agent less, choose a scoped server or build a custom one.
  • Beta servers. Headless 360 and CRM Analytics were still marked Beta when we read the reference on October 6, 2026.
  • Client constraints. Salesforce’s own wiki lists the mcp-remote library and Experience Cloud URLs as not yet supported.

04 / Conduyt

How it compares to Conduyt’s MCP

Both are vendor-run MCP servers for CRM data, so the question is fit, not whether one exists. Salesforce scopes each call to an OAuth user and lets an admin choose read-only, write or delete servers; it is gated to Enterprise Edition and above and draws on the org’s API quota. Conduyt’s MCP server, as described on the Conduyt AI page, exposes 290+ tools across 34 modules and authenticates with scoped API keys, with dry-run mode, confirmation tokens for destructive actions and an audit log. If your company already runs Salesforce Enterprise, its hosted servers are the shorter path to an agent. The developer page covers how Conduyt’s server is set up.

Primary sources

Reviewed October 6, 2026: Salesforce hosted MCP servers GA announcement, beta announcement, standard servers reference, SObject Reads reference, client connection guide, the Salesforce hosted MCP wiki on availability, and the MCP architecture specification.

Frequently asked questions

Does Salesforce have an MCP server?

Yes. Salesforce hosted MCP servers became generally available on April 29, 2026 for Enterprise Edition orgs and above, after a beta that began in October 2025. They are hosted by Salesforce, disabled by default, and enabled per server by an admin in Setup.

Can the Salesforce MCP server write records?

Yes, if an admin enables a server that allows it. SObject Reads is read-only, SObject Mutations adds create and update, SObject Deletes handles deletes, and SObject All covers all of them. Every call still runs with the signed-in user’s field-level security, object permissions and sharing rules.

Which Salesforce editions can use hosted MCP servers?

Salesforce states Enterprise Edition and above, and its hosted MCP wiki adds that Developer Edition orgs can use them too. Tool calls count against the org’s daily API request allocation.

Comparing the platforms rather than the protocol? Read the Salesforce alternatives comparison. New to the category? Start with what an AI-native CRM is. The rest of this series covers HubSpot, GoHighLevel, Pipedrive, Zoho CRM, Follow Up Boss and eLead.