Salesforce MCP Server

Salesforce object management and record querying via natural language commands.

Data last scanned today · Reviewed yesterday

45 3 dangerous tools15 tools★ 163TypeScriptMIT

Overview

This MCP server enables AI assistants like Claude to interface directly with Salesforce environments. It provides tools for searching objects, retrieving schema details, and executing complex data queries across your organization's records. Beyond data retrieval, the server supports record manipulation, including creating, updating, and deleting entries. It also includes capabilities for managing Apex classes and triggers, allowing for direct interaction with Salesforce's internal logic and metadata.

Our verdict

With a security score of 24/100, this tool is categorized as high risk. The primary security concern is the lack of any authentication method, meaning anyone with access to the server configuration can exercise full control over your Salesforce instance. Additionally, the server lacks a read-only mode, granting write access to all installed instances by default. Given these significant security gaps and its community-maintained status, this server should not be used in sensitive production environments.

Supports SOSL for cross-object searching
Enables direct management of Apex classes and triggers
Uses a small codebase with only three direct dependencies
Features comprehensive documentation for all provided tools

Lacks any built-in authentication method
Requires full write access with no read-only configuration
Maintained by community contributors rather than the official vendor
Last code commit occurred over 145 days ago

Setup

Claude Desktop

{
  "mcpServers": {
    "mcp-server-salesforce": {
      "args": [
        "-y",
        "@tsmztech/mcp-server-salesforce"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
salesforce_search_objects	Search for standard and custom objects.	low
salesforce_describe_object	Get detailed object schema information.	low
salesforce_query_records	Query records with relationship support.	low
salesforce_aggregate_query	Execute aggregate queries with GROUP BY.	low
salesforce_dml_records	Perform data operations.	medium
salesforce_manage_object	Create and modify custom objects.	medium
salesforce_manage_field	Manage object fields.	medium
salesforce_manage_field_permissions	Manage Field Level Security (Field Permissions).	medium
salesforce_search_all	Search across multiple objects.	low
salesforce_read_apex	Read Apex classes.	low
salesforce_write_apex	Create and update Apex classes.	high
salesforce_read_apex_trigger	Read Apex triggers.	low
salesforce_write_apex_trigger	Create and update Apex triggers.	high
salesforce_execute_anonymous	Execute anonymous Apex code.	high
salesforce_manage_debug_logs	Manage debug logs for Salesforce users.	medium

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›How can I switch between different Salesforce organizations?

The server supports multiple orgs and allows you to switch your active Salesforce org based on the default org configured in your VS Code workspace by using Salesforce_CLI authentication.

›What permissions are applied when I create a new field?

When creating a new field, the server automatically grants Field Level Security to the System Administrator by default. You can specify different profiles using the grantAccessTo parameter.

›Which tool should I use for queries that require aggregate functions?

You should use the salesforce_aggregate_query tool for queries involving GROUP BY, aggregate functions like COUNT or SUM, and HAVING clauses.

›Does the server support SOSL search?

Yes, the salesforce_search_all tool uses SOSL to search across multiple objects and provides field snippets.