What the connection is
Claude connects to a Salesforce hosted MCP server as a custom connector. On the Salesforce side you create an External Client App with the MCP API scope and refresh tokens, set it to admin pre-authorised, and decide who may use it with a permission set. Each person signs in as themselves, so Claude sees exactly what they can see. Newer orgs block new connected apps; External Client Apps are the supported path.
What the standard servers can do
Salesforce provides standard servers, such as SObject Reads, Mutations and Deletes, plus servers for Data 360 and Tableau Next. The server the connector address points at decides which tools Claude has, and standard servers cannot be changed. A connector on SObject Reads can query and search records and has no tool that changes anything.
Four errors and what they mean
- Claude says it needs edit access or field-level security. It is connected to a read-only server, so it has no write tool. Changing profiles does nothing. If you want it to act, give it a custom server with the specific actions you approve.
- “Couldn’t register with the sign-in service.” Claude tries dynamic client registration, which Salesforce hosted MCP does not support. Enter the External Client App’s consumer key in the connector’s OAuth client ID field.
- “Authorization failed” for one person. They are not in the permission set that grants the app, or their profile lacks API access. Check the permission set assignment first.
- A custom tool fails with a script-thrown exception. Code that reuses the session ID to call Salesforce’s own APIs fails under MCP tokens. Mint a short-lived token for the running user with the JWT bearer flow instead, signed by an org certificate so the key never leaves Salesforce.
Giving Claude narrow write access
Custom hosted servers combine standard read tools with your own Apex actions. Keep each tool narrow, such as creating a report in one folder or logging a call on an account, make it respect the running user’s access, and log every call. A server that does one approved thing is far easier to sign off than general write access.
Before you roll it out
- Fix duplicate customers and conflicting fields first. An agent repeats bad data with confidence.
- Use one permission set per audience, so access can be granted and removed cleanly.
- Check usage in the event logs, where hosted MCP calls appear with their own client name.
- Name an owner for the connection and the certificate’s renewal date.
- Test against a set of real questions with hand-checked answers.
Tell us what is happening and which systems are involved. We reply within one business day.