How to Set Up the Salesforce MCP Server (and Query Your CRM from Claude)

I spent years building Salesforce Flow, so I’ll say this with some affection: Salesforce documentation has a way of making a 30-minute task feel like a certification exam. Here’s the whole thing, condensed, with the sharp edges labeled.

What Salesforce actually shipped

After a pilot in spring 2025 and a beta in October 2025, Salesforce Hosted MCP Servers went generally available on April 29, 2026. There isn’t one server — there’s a family:

• Prebuilt servers for Agentforce 360, Tableau Next, Data 360 SQL, and the DX/Heroku/MuleSoft developer surfaces.
  
• A read-only records server (platform/sobject-reads) — the one to start with if your security team is nervous, because it physically cannot write.
  
• Custom servers that expose your own flows, Apex, and Named Queries as MCP tools — this is where it gets genuinely powerful, because your existing automation becomes callable from any AI client.
  

Requirements that will bite you if you skip this paragraph: you need Enterprise Edition or above, and auth is OAuth 2.0 with PKCE through an External Client App configured with the mcp_api and refresh_token scopes.

Setup, step by step

1️⃣ Enable the server. In Setup, go to API Catalog → MCP Servers and turn on the server you want — start with the read-only records server.

2️⃣ Create the External Client App. Give it the mcp_api and refresh_token OAuth scopes. This is the credential your AI client will use; treat it like any connected app — scoped, named, and owned by someone who’ll still work there next year.

3️⃣ Decide who can use it. This is the part I like most about Salesforce’s design: the server runs as the authenticated user. CRUD, field-level security, and sharing rules are enforced exactly as they are in the UI. If a rep can’t see an opportunity in Salesforce, their AI assistant can’t see it through MCP either. No shadow permission model to audit.

4️⃣ Connect your client. In Claude: Settings → Connectors → Add custom connector, paste the server URL, and complete the OAuth flow in the browser window that opens. In Claude Code it’s one command: claude mcp add --transport http salesforce <server-url>. In ChatGPT, remote MCP servers connect through developer mode on paid plans.

5️⃣ Test with a read. “Show me the five accounts with the largest open opportunity value” is a good first prompt — it proves auth, object access, and field visibility in one shot.

What your security team will ask (answer these before the meeting)

• Who does the server act as? The authenticated user — existing permissions apply.
  
• Can it write? Only if you enable a write-capable server. The sobject-reads server is read-only by construction.
  
• How is it authorized? OAuth 2.0 with PKCE via an External Client App you control and can revoke.
  
• What’s the blast radius of a leaked token? One user’s existing Salesforce access, until you revoke the app.
  

The catch nobody mentions: tokens and context

Connecting the server is the easy part. What surprises teams is the economics of using it. Every tool definition the server exposes loads into the model’s context each session, and every query result — a fat account record, a page of opportunity history — is billed as input tokens, then billed again on every subsequent turn of the conversation. Anthropic’s own engineering team documented a workflow where raw tool results pushed a task to 150,000 tokens that curated context handled in 2,000.

Salesforce MCP hands the model raw records. That’s exactly right for admin tasks and one-off queries. But if the question is “what’s going on with this account?”, the answer isn’t in Salesforce alone — it’s spread across Salesforce, Gong, Zendesk, Slack, and email. Connecting five servers means five OAuth grants, five tool-definition payloads, and the model doing the joining in-context at your expense, every single time.

That joining work is what Noded does before the model gets involved: the Customer Context Graph weaves every account into one living story from the tools your data is scattered across, and exposes it to Claude, ChatGPT, or Gemini through a single MCP server — no infrastructure for you to run, and up to 90% lower token costs because the aggregation happened once, ahead of time (here’s how we measure that). The honest boundary: Noded’s server won’t configure your org, run Apex, or edit page layouts. For Salesforce administration from an AI client, use Salesforce’s own servers — ideally alongside.

FAQ

What Salesforce edition do I need?

Enterprise Edition or above for Hosted MCP Servers.

Is it safe to connect to an AI assistant?

Requests are executed as the authenticated user with your org’s CRUD, FLS, and sharing rules enforced. Start with the read-only server and expand from there.

Can I use it with ChatGPT or Gemini instead of Claude?

ChatGPT: yes, via connectors/developer mode on paid plans. Gemini: supported in Gemini Enterprise and the Gemini CLI; the consumer Gemini app didn’t support custom MCP connectors as of July 2026. See our full verified MCP tracker for the client landscape.