Salesforce MCP Server Patterns: Direction, Tools and Access

Speed

AI-narrated

Before choosing an MCP server pattern for Salesforce, draw the direction of the call. An outside assistant calling Salesforce and an Agentforce agent calling an outside system aren’t the same integration. They have different credentials, tool catalogs and authorization boundaries.

This guide focuses on curating tool sets for those connections. MCP standardizes discovery and invocation; it doesn’t replace the underlying business logic or make every tool safe to expose.

Which direction does the connection run?

Direction	Salesforce role	What you configure
External assistant calls Salesforce	Hosted MCP server	Approved tools backed by Salesforce data and logic
Agentforce calls an external system	MCP client	External server registration, credentials and selected tools

Salesforce Hosted MCP Servers are generally available. Agentforce’s MCP client is also GA; Winter '27 adds direct access to AgentExchange MCP server tools in the builder. Check requirements for the particular server and product rather than treating protocol support as access to every capability.

MCP isn’t RAG. A tool may retrieve information for an answer, but it may also update records or execute a workflow. Those operations need different controls.

When should you use a focused read-only server?

Start with a narrow question such as preparing an account briefing. Select only the record-reading and query capabilities needed to answer it. Don’t include delete or update tools just because the underlying standard server offers them.

Salesforce standard servers have fixed tool sets. A custom hosted server lets an administrator curate tools from multiple standard servers and add custom capabilities. That is useful when one workflow needs a limited combination rather than the full catalog.

The smaller tool set is an intentional boundary, not a replacement for permissions. Test with a user who can’t see a particular record or field and check that it isn’t returned.

How should business operations become tools?

Use a task-specific Flow or Apex-backed tool when the operation has rules beyond editing a field. An example is requesting a case escalation: validate the case, check eligibility, update permitted fields and return a clear result.

Custom hosted servers support autolaunched Flows, invocable Apex, supported AuraEnabled methods and Apex REST endpoints, among other documented backing types. Review each type’s requirements instead of assuming any method can be exposed unchanged.

Keep read tools distinct from mutation tools. Define permitted inputs, error responses, confirmation requirements and retry behavior. A repeated tool call mustn’t accidentally create the same request twice. Enforce these controls in the operation, not solely in the assistant’s instructions.

When should an Agentforce agent become a tool?

Use an agent-backed tool when an external assistant should delegate a task that needs the agent’s instructions, actions and knowledge sources. Use a deterministic Flow or Apex tool when the operation doesn’t need model reasoning.

Salesforce requires agents exposed this way to use the new Agent Script Builder; legacy agents must be upgraded. Agents and Prompt Builder templates must be explicitly configured as tools in a custom server. They aren’t automatically discoverable.

Give each tool a precise name and description. A tool for preparing an account summary should say that, rather than presenting itself as an all-purpose sales assistant. Review the description whenever the backing agent changes.

What authentication does the hosted pattern use?

Salesforce documents per-user OAuth with PKCE. Configure an External Client App with the required mcp_api scope and client-specific settings, following the current setup guide. Refresh access and callback settings must match the client configuration.

Hosted calls run as the authenticated Salesforce user. Standard record tools respect that user’s permissions. Custom Apex still needs an access-mode review; MCP doesn’t repair unsafe backend code.

If a separate custom integration uses a shared service identity, don’t assume Salesforce can infer each human’s access from the conversation. Enforce the intended authorization in trusted server-side logic and confirm license suitability. Never place tokens in tool descriptions or returned content.

What changes when Agentforce calls an external server?

Register the external server and select its tools through Salesforce’s supported configuration. Winter '27 allows registered AgentExchange MCP tools to be added from the actions interface. Don’t confuse this with creating a Salesforce-hosted server for external assistants.

Document whose external credentials the connection uses. Salesforce record sharing doesn’t automatically protect data held in another system. Limit the external account and tools to the intended operations, and verify how the chosen agent context supports authentication.

Treat tool output as untrusted content. Test misleading instructions in returned documents, changes to tool descriptions, denied requests and failures after a partial operation. Assign someone to review server and tool changes before expanding access.