- MCP (Model Context Protocol) is an open standard from Anthropic that lets AI tools like Claude and ChatGPT connect to external systems and take action within them.
- Three Salesforce MCP server options are currently available: Salesforce’s own hosted server, Salesforce’s DX MCP Server for developers, and Cirra AI’s Salesforce Admin MCP Server. They are built for different jobs.
- Salesforce Hosted MCP handles record operations, report-style analytics, and invoking existing Flows. It cannot create or modify org metadata.
- Salesforce DX MCP Server is built for developers working in an IDE with a Salesforce DX project, deploying and retrieving metadata as local source files.
- Cirra AI writes to the metadata layer directly in conversation, creating objects, building Flows, and modifying permission sets, with no local project or CLI required. Access runs on granular, category-level controls with an exportable audit trail, and one connection can manage multiple client orgs.
This article covers what MCP is, what it means for Salesforce specifically, what admins actually use it for, which option fits which job, and where MCP still falls short.
What Is MCP (Model Context Protocol)?
MCP, short for Model Context Protocol, is an open standard developed by Anthropic. It defines a common interface between AI tools and the external systems they work with.
MCP uses a client-server model. The AI tool, such as Claude, ChatGPT, or Cursor, is the MCP client. An MCP server sits between the AI tool and a target system, exposing a catalog of callable tools: discrete operations the AI client can invoke, each corresponding to a specific capability in that system.
An AI tool that supports MCP can connect to any MCP server and immediately gain the ability to work within that system, whether that is Salesforce, another business application, or a developer’s local environment. The protocol itself is not specific to Salesforce or any single vendor.
MCP support is expanding across major AI platforms. Claude (Anthropic) is a native MCP client through Claude Desktop and Claude Code. ChatGPT (OpenAI) supports MCP through its app catalog, and ChatGPT Codex supports it for CLI use. Cursor has strong native MCP integration. Gemini Enterprise supports remote MCP servers through a custom connector setup, and Grok supports remote MCP servers on paid accounts, in the web app (grok.com/connectors) and via the xAI API.
What Is a Salesforce MCP Server?
A Salesforce MCP server is a server that implements the Model Context Protocol and exposes Salesforce capabilities to any MCP-compatible AI tool. A Salesforce Model Context Protocol integration, in other words, is what makes that connection possible. When you connect an AI assistant to one, you can interact with your Salesforce org through natural language conversation.
The practical effect for a Salesforce admin: instead of navigating Setup menus, clicking through the Object Manager, or writing SOQL manually, you describe what you need in your AI chat. The MCP server carries that instruction into Salesforce and executes it.
Two types of capability matter when evaluating Salesforce MCP servers. The first is operational capability: reading and querying records, pulling report-style analytics, invoking existing automations. The second is configuration capability: creating and modifying the org structure itself, including objects, fields, flows, permission sets, and page layouts. Not every Salesforce MCP server offers both, and that distinction drives which server is right for a given use case.
The MCP server authenticates to Salesforce using OAuth and operates as the authenticated user, which means it can only do what that user is permitted to do in Salesforce Setup. This permission constraint is the security boundary that makes MCP servers safe to use with production orgs.
What Are the Use Cases of Salesforce MCP?
Two categories of everyday Salesforce work show what a Salesforce MCP server is actually good for.
Operational use cases (the data and activity layer)
A sales manager asks their AI tool to summarize all open opportunities closing this month, no SOQL required.
A RevOps analyst asks to find every Lead with no activity in the last 90 days and get a count before deciding what to do with them.
An admin runs an existing approval Flow against a batch of records instead of opening them one by one.
A support lead pulls case-aging numbers straight into a conversation instead of opening Salesforce reports.
Configuration use cases (the org-building layer)
An admin describes a new custom object and its fields instead of clicking through Object Manager one field at a time.
A RevOps manager asks for a new record-triggered Flow that reassigns a Lead when a specific field changes.
An admin needs to know who has delete access to a particular object across every profile and permission set, and asks instead of tracing it manually.
A consulting partner managing multiple client orgs asks for a quick audit of validation rules before a release.
The dividing line matters when choosing a server. If your day-to-day work is mostly the first list, an operational-only server may be enough. If it is regularly the second list, you need a server that writes to the metadata layer.
What Are the Available Salesforce MCP Server Options?
Three Salesforce MCP servers are currently available. They share the same underlying protocol but are scoped very differently, and built for different people.
Salesforce Hosted MCP Server: Salesforce’s own, fully managed option, scoped to operational work.
Salesforce DX MCP Server: part of the Salesforce CLI, built for developers working inside a Salesforce DX project.
Cirra AI Salesforce Admin MCP Server: built for Salesforce admins and consulting partners, writing to the metadata layer directly in conversation.
How Do the Options Compare?
| Capability | Salesforce Hosted MCP | Salesforce DX MCP Server | Cirra AI Salesforce Admin MCP |
|---|---|---|---|
| Primary audience | Any Salesforce user | Developers, in an IDE / DX project | Admins and consulting partners |
| Record CRUD (read, create, update, delete) | Yes | Read-only via SOQL query, no CRUD tools | Yes |
| SOQL queries and search | Yes | Yes | Yes |
| Invoke existing autolaunched Flows | Yes | No | Yes |
| Query data and analytics | SOQL plus Tableau Next / Data 360 | SOQL only, read-only | SOQL and DML |
| Read metadata (describe, list) | Yes | ✓ (retrieve to local source) | Yes |
| Create/modify objects, fields, Flows, layouts | No | Via local source + deploy step | ✓, directly in conversation |
| Modify permission sets | No | Via local source + deploy step | Yes |
| Change model | Live, in the org | Live for data queries and tests; source-driven (deploy) for metadata | Live, in the org |
| Runs as connected user (FLS, sharing, CRUD, audit trail) | Yes | ✓, via CLI-authorized user | Yes |
| Requires local dev environment / CLI | No | Yes | No |
| Team governance (org access controls, audit log) | Admin-enabled per org; per-user permissions | No, single developer | Yes, category-level access controls plus org-level governance |
| Manage multiple client orgs from one place | No, one org per connection | Yes, multiple orgs via --orgs flag, no team hierarchy | Yes, multi-team hierarchy |
| Pricing | Included with Enterprise Edition | Free, open source | Free tier and paid plans |
The Options, One by One
Salesforce Hosted MCP Server
Salesforce’s native MCP server is the right choice when your work centers on operational tasks rather than org configuration. It handles full CRUD on records, SOQL queries, report-style analytics via Tableau Next and Data 360, and invoking your existing autolaunched Flows. If your team needs AI to answer questions about data, update pipeline records, trigger automations you have already built, or pull report-style analytics into a conversation, the hosted option handles all of this cleanly.
Two genuine advantages stand out for Enterprise teams. First, it is fully managed by Salesforce: no third-party credentials, no external server to maintain, and no new security model to learn. Second, every request runs as the authenticated user over OAuth 2.0 with PKCE, so field-level security, sharing rules, and object permissions apply to each tool call, and actions land in the org’s audit trail under that user’s name. The Einstein Trust Layer applies specifically when a tool invokes a Salesforce prompt template or Agentforce agent server-side, not to ordinary record and query calls or to the AI client’s own prompts.
The limitation is the metadata layer. The Salesforce Hosted MCP Server cannot create or modify org structure. It cannot build new Flows, create custom objects or fields, change page layouts, or modify permission sets. For admins whose primary job is configuring and building in Salesforce, this is a fundamental gap.
Salesforce DX MCP Server
Salesforce DX MCP Server is the right choice for developers already working in a Salesforce DX project: version-controlled metadata, an IDE, and a deploy pipeline. It brings AI into that existing workflow, retrieving metadata, running Apex tests, and querying data alongside deploys, rather than replacing the workflow with a conversational interface.
It is not built for an admin who wants to describe a change and see it applied directly to a live org. Changes still go through local source files and a deploy step, which is exactly right for teams that already work that way, and a poor fit for anyone who does not.
Cirra AI Salesforce Admin MCP Server
Cirra AI is the right choice when the task involves changing how the org is built, directly in conversation, with no local project or deploy pipeline involved. Create a custom object, build a Flow, modify a permission set, configure a page layout: neither the Salesforce Hosted MCP nor the DX MCP Server does this as a live, conversational change. Cirra AI connects to Salesforce at the metadata layer and makes these changes directly, which is why it works well for Salesforce admins configuring their own org, and for consulting partners managing multiple client orgs.
Governance is built into every connection: granular, category-level access controls (Metadata, User Data, Personal Setup Data, Business Data, each set to None, Read Only, or Read and Write) plus team-level org governance, with actions logged in an exportable audit trail. A multi-team hierarchy lets consulting partners and BizOps teams manage more than one connected Salesforce org from a single place, rather than one connection per project.
Salesforce MCP Server vs. Agentforce and Einstein Copilot
Admins researching AI options for Salesforce often run into Agentforce and MCP servers, and the older term “Einstein Copilot” still muddies the search results. These solve different problems, and the distinction is easy to miss.
Salesforce renamed “Einstein Copilot” to Agentforce in January 2025, with no change to functionality. What used to be Einstein Copilot is the conversational tier, now labeled “Agentforce (Default)” in Setup: it guides users through tasks and answers questions inside the Salesforce interface itself. Agentforce also covers a second, newer tier: autonomous agents that live inside the org and act on customers or employees directly, for example a service agent that resolves cases on its own. Both tiers are Salesforce’s own AI, built into the platform.
A Salesforce MCP server solves a different problem: connecting an external AI tool you already use, such as Claude or ChatGPT, to your org. It is not an agent that lives inside Salesforce. It is a bridge that lets an AI tool reach into Salesforce and take action there, on your instruction.
The practical distinction: Agentforce, in either tier, brings Salesforce’s own AI into your org’s workflows. An MCP server brings the AI tool of your choice to Salesforce. Some teams use both: an Agentforce agent for customer-facing work, and a Salesforce MCP server so admins can configure and manage the org through the AI tools they already use daily.
Salesforce MCP Server vs. Other Integration Methods
Before MCP, connecting an external system or workflow to Salesforce meant one of three routes: custom code, an iPaaS/middleware platform, or calling Salesforce’s APIs directly.
Custom Apex or REST/SOQL integrations give the most control but require a developer to build and maintain. Every new use case usually means new code.
iPaaS platforms, such as Zapier or MuleSoft, connect Salesforce to other systems through prebuilt connectors and visual workflows. They are strong for moving data between systems on a schedule or trigger, but they are built around fixed workflows, not open-ended requests.
A Salesforce MCP server is different in one key way: it is designed for an AI client to reason over on the fly. Instead of a fixed workflow, you describe a novel request in plain language and the AI client works out which tool calls to make. No new integration has to be built for each new type of request, within the bounds of what the server exposes.
This does not replace iPaaS or custom integration for high-volume, scheduled, system-to-system data movement. A Salesforce MCP server is best suited for on-demand, human-directed work: an admin or operator describing a change or a question and getting a direct answer or action back.
What Salesforce MCP Servers Can’t Do Yet
MCP is still an early standard, and Salesforce MCP servers have real limits worth knowing before connecting one to a production org.
AI-generated changes are not deterministic. The same request phrased two different ways can produce two different Flows or field configurations. Reviewing every proposed change before it deploys is not optional. It is the actual safety mechanism.
Complex, multi-step Apex development is outside what current Salesforce MCP servers are built for. They operate at the declarative and metadata layer: objects, fields, Flows, permission sets, page layouts. Deep custom code work still needs a developer.
Bulk operations at very large scale can be slow or need to be batched, since MCP tool calls typically operate within normal Salesforce governor limits.
Not every AI client supports MCP equally well. Some require specific subscription tiers or app catalog access, and support across clients changes as the standard matures.
An MCP server is only as safe as the Salesforce user it authenticates as. If that user has broad permissions, the server does too. Scoping a dedicated integration user with the minimum permissions needed is worth doing before connecting any Salesforce MCP server, not as an afterthought.
None of this is a reason to avoid MCP. It is the reason a sandbox test and a review step before production use matter, for any Salesforce MCP server you choose.
Getting Started with a Salesforce MCP Server
Once you know which layer your work needs, connecting an AI client takes only a few minutes.
The Cirra AI Salesforce Admin MCP Server covers the full configuration layer alongside the core operational tasks: creating objects and fields, building and reviewing Flows, managing permission sets and page layouts, running bulk record operations, and generating org documentation.
Claude, ChatGPT, Cursor, and Gemini can all connect to a Salesforce MCP server. Salesforce Setup takes under 10 minutes: create a free account, authorize your org, and connect Claude, ChatGPT, or Cursor to Salesforce Admin MCP Server.