Salesforce MCP Server: 4 Ways to Connect Claude, ChatGPT and Codex to Salesforce (2026)

Last updated: October 19, 2026

Six months ago, connecting an AI assistant to Salesforce meant a custom integration, a middleware project or a lot of copy and paste. Now Salesforce runs MCP servers for you, Anthropic and OpenAI ship Salesforce plugins, and your developers can point Claude Code or Codex at an org with one command. Search interest in “Salesforce MCP server” has followed, and so have the questions we get from US clients: which option is right, is it safe, and what does it cost?

This guide answers those questions in plain terms. We checked Salesforce’s developer documentation, the Summer ’26 release guide and recent coverage on October 19, 2026, and we flag where details are still unclear or come from third parties rather than Salesforce.

What is a Salesforce MCP server?

MCP, the Model Context Protocol, is an open standard that lets an AI application call tools and read data in another system. Think of it as a universal adapter: instead of building a separate integration for every AI tool, a system exposes an MCP server once, and any MCP-compatible client can use it.

A Salesforce MCP server exposes Salesforce records, Flows, Apex actions and other capabilities as MCP “tools”. When you ask Claude or ChatGPT to “show my open opportunities over $50,000 closing this quarter” or “log a follow-up task on Acme”, the assistant calls those tools on your behalf. The important part for admins: on Salesforce’s own servers, every call runs as the signed-in user, so field-level security, sharing rules and permission sets still apply.

4 ways to connect Claude, ChatGPT and Codex to Salesforce in 2026

These options overlap, and many companies will end up using more than one. The table is the quick version. The sections below explain each one.

1. Salesforce Hosted MCP Servers

This is the option most business teams will care about. Salesforce hosts the MCP servers, so there is no local server or middleware to maintain. According to Salesforce’s documentation, any MCP-compatible client can connect, and the page names Claude, ChatGPT, Cursor, Postman and custom agents. Salesforce’s Summer ’26 developer guide states that the hosted standard MCP servers are now generally available.

What you can expose:

• SObject operations. Read, create, update and delete records, respecting field-level security and sharing rules.
• Custom tools. Apex invocable actions, @AuraEnabled methods, Apex REST methods, Flows and Named Queries.
• Product integrations. Data 360 SQL queries, Tableau analytics and other products.
• Prompt templates. Prompt Builder templates that users can call from their AI client.

Standard servers are switched off by default and are found in Setup under MCP Servers. Community walkthroughs describe three standard servers, one with broad read and write access, one read-only and one write-only. You can also build custom servers that combine standard tools with your own Flows and Apex. Salesforce says hosted MCP servers are intended for customers with Flex Credits and that usage may be billed. Third-party reviews report that the feature is available in Enterprise Edition and above. Confirm both points with your account executive for your own contract.

2. Salesforce DX MCP Server (for developers)

The Salesforce DX MCP Server is an open-source server, published on GitHub by the Salesforce CLI team, that runs on a developer’s machine with npx -y @salesforce/mcp. It works with Claude Code, Cursor, Cline, VS Code with Copilot, Windsurf, Zed and other clients. It groups its tools into toolsets such as orgs, data, metadata, testing, code-analysis, devops and lwc-experts, and Salesforce Ben reports that Codex gets access to more than 60 Salesforce developer tools through it.

Two details matter for safety. First, the server only works with orgs you have already authorized locally through the Salesforce CLI. Second, the required --orgs flag limits which of those orgs it can touch. Pass an explicit username or alias for a sandbox rather than ALLOW_ALL_ORGS, which the project itself warns to use with caution. By default only tools marked GA are enabled, and non-GA tools need an extra flag.

3. Packaged plugins: Salesforce in Claude and the Salesforce plugin for ChatGPT

If your sales team wants results rather than raw tools, packaged plugins are the faster route. Salesforce in Claude was announced on August 26, 2026 as part of the expanded Salesforce and Anthropic partnership. It comes with 37 prebuilt sales skills for jobs such as meeting prep, deal health reviews, pipeline reviews and CRM updates. An admin makes the connection centrally and chooses who gets access, sellers sign in with their own Salesforce credentials, and by default Claude asks the seller to approve changes before writing them back. We covered the wider partnership in our guide to what Claudeforce is and how it compares in Claudeforce vs Agentforce.

On the OpenAI side, Salesforce Ben reports a Salesforce plugin for ChatGPT, formerly the Agentforce Sales app, which lets users read and edit accounts and opportunities, plus a Tableau plugin for querying Tableau data. Both respect existing user permissions.

4. Agentforce and MCP: the other direction

MCP is not only about outside assistants reaching into Salesforce. The Summer ’26 guide lists exposing Agentforce agents as MCP tools through hosted MCP servers, and Salesforce’s developer blog describes extending Agentforce with external MCP tools through MuleSoft. AgentExchange now lists MCP servers next to classic apps. Before you enable one, run the checks in our AgentExchange installation guide, because an MCP tool behaves more like a contractor than a package.

How to connect Claude to a Salesforce MCP server, step by step

This is the typical path for connecting Claude to Salesforce Hosted MCP Servers, based on Salesforce’s setup guide and published walkthroughs. Menu names can change between releases, so follow the current Salesforce documentation alongside it.

1. Pick the server. In Setup, open MCP Servers and choose a standard server. Start with the read-only one for a pilot. Activate it and copy its server URL.
2. Create an External Client App. In Setup, open External Client App Manager and create an app for your AI client. Enable OAuth, set the callback URL your AI client documents (for Claude, community guides show https://claude.ai/api/mcp/auth_callback), and add the scopes Salesforce’s guide lists for MCP access along with refresh tokens.
3. Secure the app. Require PKCE. Set permitted users to admin-approved users and assign access through a permission set for your pilot group. Some walkthroughs suggest letting all users self-authorize and relaxing IP restrictions. We do not recommend that in production.
4. Add the connector in Claude. In Claude, add a custom connector, paste the server URL, and enter the consumer key and secret from the External Client App.
5. Sign in and test. Each user signs in with their own Salesforce login. Test with a user who should not see certain records and confirm they cannot.
6. Widen slowly. Move to a read-write server or a custom server with specific Flows only after the pilot shows the answers and updates are right.

Security checklist before you switch on a Salesforce MCP server

Salesforce’s servers respect your security model. That is good news only if your security model is in good shape. Before go-live, we check:

• Profiles and permission sets. Users with “View All Data” or broad admin rights will have the same reach through an AI assistant. Clean these up first.
• Sharing rules and field-level security. Sensitive fields such as salary, health or financial data should be hidden from users who do not need them, in Salesforce itself.
• Read before write. Start with a read-only server. Add write tools through specific Flows with validation rather than open record edits.
• Who can connect. Use admin-approved users and a permission set, not self-authorization for everyone.
• Developer tools on sandboxes. Lock the DX MCP Server to named sandbox orgs and keep deployments in your normal release process.
• Logging and review. Decide who reviews what the assistants did during the first month, and how a connection gets switched off.
• Data policy. Check your AI vendor’s data handling terms and your own customer contracts before connecting regulated data.

If you are not sure where your org stands, our free 30-point CRM health check includes a security and access section that covers most of this list.

What a Salesforce MCP server costs

Hosted MCP Servers are tied to Flex Credits, Salesforce’s consumption currency, and Salesforce says usage may be billed. Salesforce has not published a simple per-call price on the documentation page we checked, so model the cost with your account executive using realistic volumes. A pilot of 20 sellers asking a few questions a day costs very differently from an always-on integration. Our Flex Credits explainer walks through how consumption pricing works. The DX MCP Server is free and open source, and AI plugins need paid plans from Anthropic or OpenAI.

Which Salesforce MCP option should you use?

• Sales leaders who want quick wins: pilot Salesforce in Claude or the ChatGPT plugin with a small team, because the workflows are already built.
• Admins who want control: use Hosted MCP Servers with a custom server that exposes only the Flows and objects you choose.
• Developers: use the DX MCP Server against sandboxes for metadata, tests and code review.
• Companies building agents: design Agentforce first, then decide which external MCP tools it needs and which agents to expose. Our Agentforce consulting team can help scope this.

What we see in our own Salesforce projects

On one US consumer electronics project, Service Cloud, CPQ and Agentforce handle 430,000 orders and 280,000 contacts, with 60% of cases deflected. At that scale, the main design decision was never which AI tool to connect. It was which user each agent and integration runs as, and what that user can see. On a B2B industrial supply project, the AI layer was only as good as the pricing data it could reach, which first meant moving contract rates out of spreadsheets and into Salesforce CPQ connected to Odoo ERP. These are results from specific projects, not promises. Read more in our consumer electronics case study and industrial supply case study.

Our rule for MCP is the same as for any integration: sandbox first, least-privilege users, read before write, and a named owner who reviews activity during the first month.

Frequently asked questions

What is a Salesforce MCP server?

It is a server that exposes Salesforce data and actions to AI tools through the open Model Context Protocol. AI clients such as Claude, ChatGPT, Cursor or Codex can then read and update Salesforce, with each call running under the signed-in user’s permissions on Salesforce’s own servers.

Is the Salesforce MCP server free?

The Salesforce DX MCP Server for developers is free and open source. Salesforce Hosted MCP Servers are intended for customers with Flex Credits, and Salesforce says usage may be billed. AI plugins also need paid plans from the AI vendor.

Can Claude or ChatGPT see all my Salesforce data?

Not on Salesforce’s hosted servers or official plugins. They work only with records the signed-in user can already access, so field-level security, sharing rules and permission sets still apply. That is why cleaning up broad permissions comes first.

Do I need a developer to set it up?

For Hosted MCP Servers, an admin can create the External Client App, activate a server and connect a client without code. Custom tools built on Apex or Flows, and the DX MCP Server, need developer or admin skills.

What is the difference between Hosted MCP Servers and the DX MCP Server?

Hosted MCP Servers run on Salesforce infrastructure and connect business users’ AI tools to live org data over OAuth. The DX MCP Server runs on a developer’s machine and gives coding assistants tools for metadata, testing and org management on locally authorized orgs.

Is it safe to connect AI tools to Salesforce?

It can be, if you start with a read-only server, limit who can connect, keep developer tools on sandboxes and review activity. The biggest risk is usually existing over-broad permissions, which an AI assistant will inherit.

Getting started

If you are planning a Salesforce MCP pilot, start with one team, one read-only server and one question you want answered faster. We help US companies plan permissions, build custom MCP tools on Flows and Apex, and model Flex Credits costs. See our Salesforce development services or talk to us about a short readiness review.

Sources

• Salesforce Developers: Salesforce Hosted MCP Servers overview (accessed October 19, 2026)
• Salesforce Developers Blog: The Salesforce Developer’s Guide to the Summer ’26 Release (June 2026)
• GitHub: salesforcecli/mcp, Salesforce DX MCP Server (accessed October 19, 2026)
• Salesforce Developers Blog: Level Up Your Developer Tools with Salesforce DX MCP (June 2025)
• Salesforce Developers Blog: Extending Agentforce with External MCP Tools via MuleSoft (August 11, 2026)
• Salesforce Ben: Ultimate Guide to ChatGPT and Codex for Salesforce Professionals (October 16, 2026)
• PPC Land: Salesforce puts 37 prebuilt sales skills inside Claude for pilot customers (August 30, 2026)
• Apex Hours: Salesforce in Claude: What Happens When Claude Connects With Salesforce? (October 13, 2026)
• Salesforce Time: How to Connect Claude with Salesforce Hosted MCP Servers (July 15, 2026)
• Truto: Best MCP Server for Salesforce, Hosted MCP vs Unified API (August 2026, vendor blog)