Overview
- Explains what a Salesforce MCP server does and why securing it matters for AI agents.
- Breaks down authentication — verifying who’s connecting via OAuth 2.0 and External Client Apps.
- Covers authorisation and permission controls — scoping access, IP rules, tokens, and field/record-level restrictions.
- Ends with a practical checklist and logging best practices for ongoing monitoring and compliance.
AI agents are only as trustworthy as the systems they connect to. If your team is standing up a Salesforce MCP server to power AI agents inside your org, security can’t be an afterthought — it’s the difference between an agent that safely automates work and one that quietly exposes customer data to the wrong person.
Model Context Protocol (MCP) is quickly becoming the standard way to connect large language models (LLMs) to real business systems. A Salesforce hosted MCP server lets tools like Claude, ChatGPT, or Agentforce read and act on your Salesforce data through a defined set of tools, prompts, and resources. That power is exactly why locking it down properly matters — and why more Salesforce admins and developers are asking the same question: how do we secure this without slowing our agents down?
In this guide, we’ll break down what a Salesforce MCP server actually does, walk through the layers that keep it secure, and leave you with a practical checklist you can hand straight to your admin or dev team.
What is a Salesforce MCP server, really?
Think of model context protocol as a translator between an AI agent and your Salesforce org. Instead of an LLM guessing at your data model or making unsafe, unstructured API calls, the MCP server exposes a defined menu of “tools” (things an agent can do), “prompts” (reusable instructions), and “resources” (data an agent can read).
This is what makes Salesforce MCP genuinely useful for business teams, not just developers: an AI agent can look up a case, summarise an account, or draft a follow-up email — all without a developer writing custom integration code for every single use case. But every one of those tools is also a door into your org. The real question quickly becomes: who gets to open which doors, under what conditions, and how would you know if the wrong person walked through one?
That’s where MCP security comes in, and it’s worth treating as its own discipline rather than an extension of your existing API security policy.
The layers of Salesforce MCP server security
A well-secured Salesforce MCP server stacks several distinct controls on top of each other. Skip one layer, and the others can’t fully protect you — each depends on the one before it.
1. Authentication — proving who's asking
Authentication answers one question: who is actually connecting to the server? For a Salesforce hosted MCP server, this occurs via an External Client App using the OAuth 2.0 authorisation code flow. In plain terms, a person must log in to their own Salesforce account before an AI agent can act on their behalf. There’s no shortcut here — Salesforce intentionally keeps a human in the loop rather than allowing a shared service account to authenticate for everyone.
Good practice for MCP server authentication: set up one dedicated connected app per AI client — one for Claude, one for ChatGPT, one for Cursor — instead of sharing a single login across every tool. It makes both day-to-day troubleshooting and after-the-fact audits far easier, since you can immediately tell which client made which request.
2. Authorisation — deciding what they can touch
Once someone is authenticated, authorisation decides what they’re actually allowed to do. This is where most of the practical MCP security best practices live:
- Grant only the specific OAuth scope needed for MCP access, not broad, general-purpose API access
- Restrict the connected app to pre-approved users or permission sets, rather than leaving it open to your whole org by default
- Add IP restrictions so connections only succeed from trusted networks
- Shorten refresh token lifetimes in production, so a stolen or leaked token doesn’t stay valid for months
- Only activate the specific MCP servers your agents actually need, and leave the rest switched off
Each of these is a small configuration setting on its own, but together they turn “anyone in the company can use this” into “only the right people, from the right places, with exactly the right scope.”
3. Permission controls — protecting the data itself
Here’s a detail that surprises a lot of teams new to MCP server security: MCP tools run with the same permissions as the person who logged in. That’s good news — it means your existing Salesforce permission model (object-level access, field-level security, sharing rules) automatically applies to whatever the AI agent does on that person’s behalf. An agent can’t see a field the user isn’t allowed to see, and it can’t touch a record the user has no access to.
If your team is building custom tools on top of Apex or Salesforce Flow, apply the same principle of least privilege you’d use for any other integration: grant only what’s needed, test with different permission levels before shipping to production, and review access on a regular schedule as your agents and use cases evolve.
4. Logging — knowing what actually happened
The last layer isn’t about prevention — it’s about visibility. Every action an MCP tool takes gets logged and tied back to the user who authenticated the session. Reviewing these logs on a regular schedule — watching for unusual access patterns, repeated failures, or activity from unexpected locations — is what turns a security model from theoretical into something your team can actually monitor and act on.
Together, these layers form a defense-in-depth approach to AI agent security: even if one control has a gap, the others still stand between an AI agent and your sensitive data.
A quick MCP security checklist
If you only act on five things after reading this, make it these:
- Require individual user logins — never a shared service account — for every Salesforce MCP server connection
- Scope OAuth access down to only what the agent needs, not full API access
- Restrict connections to approved users, permission sets, and trusted IP ranges
- Shorten token lifetimes in production environments
- Review activity logs on a regular schedule, not just after something has already gone wrong
Why this matters beyond Salesforce
The rise of MCP LLM integrations — connecting large language models to real operational systems, not just chat windows — means security teams everywhere are re-learning old lessons in a new context. The same principles that protect a traditional API integration (authenticate properly, authorise narrowly, log everything) still apply here.
What’s different is the pace: agents move fast, act autonomously, and a misconfigured MCP server can be exploited just as fast. Treating MCP security with the same rigor as any other integration touching production data isn’t optional anymore — it’s table stakes for any team deploying AI agents at scale.
Common mistakes worth avoiding
A few patterns show up again and again in early MCP rollouts:
- Sharing one connected app across every AI client. It’s faster to set up, but it makes it nearly impossible to tell which tool or which user triggered a given action.
- Leaving default access open to the whole org. Most teams don’t need every user connecting to every MCP server — narrowing this down early is far easier than walking it back later.
- Treating logging as optional. Logs are cheap to keep and expensive to wish you had after an incident.
- Skipping permission testing before go-live. Test your MCP tools with different user permission levels before rolling them out, not after.
Conclusion
Standing up a secure Salesforce hosted MCP server touches OAuth configuration, permission sets, IP restrictions, and ongoing monitoring — a lot of moving parts to get right on a first attempt, especially alongside a broader Salesforce integration or AI solutions rollout. If your team has already invested in a Salesforce security review, extending that same discipline to your MCP servers is a natural next step rather than a separate project.
TechForce Services helps teams design and implement Salesforce MCP server security from day one, so your AI agents can move fast without putting your data at risk. Get in touch with our team to talk through your MCP and AI agent security setup.
