Salesforce MCP: read accounts and opportunities without widening access

Salesforce MCP lets a compatible AI agent work with CRM data through Salesforce-hosted tools. For account and opportunity analysis, choose the read-only platform/sobject-reads server: Salesforce applies the authenticated user’s object permissions, field-level security and sharing rules to each call, so connecting an agent does not itself grant wider org access. Salesforce standard server reference.

What it can do

As of 30 Oct 2026, the SObject Reads documentation describes schema discovery, SOQL queries, cross-object text search and relationship traversal for standard and custom objects. The server cannot create, update or delete records. That makes it a useful starting point for preparing a brief before a human decides what to do.

For example, ask for a summary of accessible open opportunities associated with an account, with record identifiers and missing information called out. Define the account explicitly and request only the fields needed for the decision. A second useful task is comparing a small, agreed set of opportunities against a qualification checklist. Ask the agent to separate retrieved values from its interpretation. Discover the available schema before choosing fields; Salesforce recommends a WHERE clause and a LIMIT clause for SOQL queries, plus indexed filters for large objects.

Make the output reviewable: include the retrieval time, filters, source record identifiers and unanswered questions. Treat suggestions about next steps as a draft. Missing information should remain missing rather than becoming an invented contact, deal stage or explanation for a delay.

This is a practical example of MCP business integrations. Browse related targets in the MCP servers for apps category.

Choose the hosted server deliberately

The hosted service and the local developer server are different integration paths. As of 30 Oct 2026, the official Salesforce DX MCP repository announces end of life for the local @salesforce/mcp server on 2 November 2026. The official maintenance notice says maintenance, support and further releases end after that date. Its developer configuration examples should not be treated as instructions for connecting the hosted read-only endpoint.

Salesforce’s hosted server overview describes per-user OAuth with PKCE. It also says hosted servers are intended for customers with Flex Credits and usage may be billed. Check the current documentation and your org’s commercial terms before a pilot; an MCP connection is not a promise of free CRM access.

Decide whether you need live retrieval at all. If an approved, redacted extract answers the question, that may be enough task context. The MCP versus API guide helps distinguish interactive agent access from a deterministic integration.

How to connect it safely

1. Write a narrow task brief. Specify the account or opportunity set, necessary fields, expected output and who will review it. Require read-only analysis. Keep credentials out of prompts and distinguish CRM facts from instructions: a note inside a record must not authorize another tool call or an external message.

2. Start in a sandbox with a restricted user. Agree the user’s access with the org administrator. Avoid using an administrator session for routine analysis. Activate only the required standard server; Salesforce says standard servers are disabled by default and their tool sets are fixed. Use the server reference to verify the selected capability.

3. Register the authentication application. Follow Create an External Client App, including the actual client callback, documented mcp_api and refresh_token scopes, and named-user JWT access tokens. Salesforce specifies an External Client App rather than a Connected App. Consider permission-set pre-authorization for the intended users. Salesforce’s security guidance, as of 30 Oct 2026, recommends a dedicated External Client App for each MCP client, helping separate access control and auditing. Do not broaden record access merely to resolve an authentication failure.

4. Select the environment explicitly. Salesforce documents these read-only URLs as of 30 Oct 2026. Its server URL guide also explains My Domain alternatives when standard login hosts are blocked. Preserve the platform/ prefix and confirm the signed-in org before retrieving data.

5. Configure a compatible client. Add the endpoint and External Client App consumer key through the client’s documented connection flow, then complete browser authorization as the intended user. Salesforce’s client connection guide specifies OAuth authorization code with PKCE for other compatible clients. For a VS Code setup, first verify that the particular agent extension supports that remote authentication flow; check the current documentation for its configuration format. See MCP in VS Code for editor context.

6. Test the boundary before using real briefs. Request a known permitted record, then attempt to retrieve a record or field intentionally withheld from that test user. Confirm that it remains unavailable. Inspect the tools exposed by the selected connection and avoid enabling write-capable servers alongside it. Compare the resulting summary with the permitted source records before moving the workflow into production.

When this does not work

The agent has the wrong identity or environment. An accurate summary from the wrong org is still an incorrect result. Keep the org, authenticated user and requested record set visible in the review notes. Recheck them after changing a connection.

The task needs data the user cannot access. Org permissions remain the boundary. Return a partial answer with an explanation of the missing evidence. Do not turn a denied read into a request for unrestricted access; have the administrator assess the actual business requirement.

A connection succeeds but the workflow is unsuitable. Check the callback, token configuration, server activation and environment URL against the linked setup documentation. Authentication alone does not establish useful or appropriately scoped results. Salesforce recommends testing raw tool responses with Postman before adding AI interpretation in its client guide.

A broad query times out or misses the intended records. Inspect the filters and returned records before trusting the summary. Narrow the account set and requested fields; do not treat an incomplete result as evidence that an opportunity does not exist. Follow the query guidance in SObject Reads.

Read-only data still leaves a confidentiality question. Decide what the receiving client and analysis service may retain, display or forward. An org access decision does not replace that review. Keep exports small, redact unnecessary personal information and apply the MCP security checklist.

Where Tvijo fits

As of 30 Oct 2026, the DSHREM VS Code extension provides an editor entry point for scoped tasks and selected context, as described in the extension guide. An approved, minimized CRM extract could be task context for analysis; that is a workflow to evaluate, not a claim of an included Salesforce connector. Review permissions and data flow before submitting customer records.

TvijoCode is described as a test build with the extension embedded. Tvijo MCP makes Tvijo callable by a compatible MCP client; it does not automatically give the Tvijo editor access to Salesforce or other servers. The Tvijo MCP release explanation distinguishes consultation from planned editor integration and delegation. Any Salesforce connection still needs its own configuration, authentication and acceptance tests, with org permissions governing retrieval.

At dsh.tvijo.com, as of 30 Oct 2026, Try costs $0 and ends when any allowance is reached: 5 tasks, 50,000 tokens or $0.05 of sponsored usage. It draws from a shared $1 daily pool funded by TVIJO. Service credit is shown as $10 for a prepaid-credit request, with metered provider usage plus an 8% service markup. Payment collection is not activated; an order is not a charge. These offers do not establish Salesforce usage costs.

FAQ

Does Salesforce MCP bypass existing org permissions?

No. The authenticated user’s permissions still apply. Test permitted and withheld records with that user; a successful administrator demo does not establish the intended boundary. Salesforce security guidance.

Can I use a sandbox before production?

Yes. Use the documented sandbox endpoint and verify the connected environment. Keep test identities, records and acceptance notes separate from the production pilot. Environment URL guide.

Is Tvijo MCP already a Salesforce connector?

The documented Tvijo MCP role is to expose Tvijo to an MCP client. Plan Salesforce access as a separately scoped integration; Tvijo’s technology map explains the component boundaries.

Salesforce is a trademark of its owner. Tvijo is not affiliated with or endorsed by it.