Ranked roundup · Salesforce
Best MCP Server for Salesforce
The MCP server for Salesforce question now has an official answer, which was not true a year ago. Salesforce ships two first-party options: Hosted MCP Servers, generally available since April 29, 2026 for Enterprise Edition orgs and above, and the open-source Salesforce DX MCP Server (465 GitHub stars) for developer work like deploys, scratch orgs, and SOQL. The community still matters at the edges. Servers like tsmztech/mcp-server-salesforce bundle metadata creation, anonymous Apex, and blunt DML that the hosted product wraps in governance, and they run on editions the hosted server excludes. Managed platforms such as Composio handle the OAuth plumbing if you would rather not build a Connected App. We ranked five options on verifiable criteria only: official status, maintenance recency, GitHub adoption, auth model, and documented capability coverage. No paid placement. Every repo stat below was checked against the GitHub API on September 1, 2026.
Facts checked September 1, 2026 · ranked on verifiable criteria · placement is never for sale
Founder, Automation Squad ·
The ranking
- Official · Salesforce
Production CRM data access by AI agents in orgs that already have Enterprise Edition, where governance and audit trails matter more than raw flexibility.
Read, create, update, and delete records with org permissions enforced; custom tools built from Flows, Apex Invocable Actions, @AuraEnabled and Apex REST methods, and admin-defined Named Queries; Data 360 SQL and Tableau access via prebuilt standard servers.
Salesforce-hosted; nothing to run locally. Generally available since April 29, 2026. · Per-user OAuth 2.0 with PKCE. Every transaction runs as the authenticated user, so CRUD permissions, field-level security, and sharing rules all still apply — no anonymous service accounts.
- Requires Enterprise Edition or above — lower editions are excluded.
- Salesforce's GA announcement does not state pricing; confirm cost for your contract before planning around it.
- Closed, hosted product — there is no source repo to audit.
- Ad-hoc SOQL is not the model here; queries run through admin-defined Named Queries and governed record operations, which is safer but less flexible than the community servers.
- Official · Salesforce
Salesforce developers driving deploys, scratch orgs, tests, and metadata from Claude, Cursor, or other MCP clients. The most-starred and most recently pushed Salesforce MCP repo we verified.
60+ tools across toolsets: SOQL queries, metadata deploy/retrieve, scratch org create/delete, user and permission set management, Apex and agent tests, Code Analyzer static analysis, LWC development, DevOps work items.
Local, via npx -y @salesforce/mcp. Requires the Salesforce CLI auth flow on the same machine. · Reuses Salesforce CLI web login. Orgs must be explicitly allowlisted with the --orgs flag (specific usernames, default org, or ALLOW_ALL_ORGS, which the docs themselves advise using with caution). · Apache-2.0 · 465★
- Built for development workflows, not as a general CRM data connector for business users.
- Some tools are still marked non-GA in the repo's own tool listing.
- Requires the Salesforce CLI installed and authenticated locally — no hosted option.
- Community
Admins and builders who want one unofficial server that does data, metadata, and Apex together — including on editions the hosted product excludes.
The broadest community coverage we verified: SOQL with relationships and aggregates, SOSL search, insert/update/upsert/delete DML, custom object and field creation, field-level security management, Apex class and trigger read/write, anonymous Apex execution, debug log management, object schema discovery.
Local via npm or a Claude Desktop .dxt extension; Docker supported (env-var auth only). Node.js 20+ required; bun explicitly unsupported. · Three modes: username + password + security token, OAuth 2.0 client credentials via a Connected App, or token reuse from a local Salesforce CLI login. · MIT · 167★
- Unofficial — no Salesforce support if it breaks.
- Delete, upsert, and anonymous Apex execution ship with no built-in guardrails; write safety is entirely whatever the integration user's permission set allows. Scope that user tightly.
- The docs carry no explicit warnings about write operations.
- Username/password auth stores credentials plus a security token in your MCP config file.
- Community
Python shops that want a lighter data-and-API connector rather than the full metadata/Apex toolbox. Slightly more stars than tsmztech (178 vs 167) but narrower coverage.
SOQL queries, SOSL search, single and bulk record CRUD, object and field introspection, Tooling API calls, Apex REST endpoints, and direct REST API passthrough.
Local, Python-based, run via uvx. · Four modes in documented order of preference: access token via env vars, OAuth 2.0 client credentials, local Salesforce CLI config, or legacy username + password + security token. · MIT · 178★
- Unofficial and maintained by one developer.
- No metadata-creation tools — you cannot build custom objects or fields through it.
- Last pushed July 29, 2026 — a month behind the top three at verification time.
- The direct REST passthrough tool means writes are limited only by the authenticated user's permissions.
- Community
Teams that want Salesforce plus other SaaS tools behind one managed endpoint with zero OAuth or hosting work.
CRM operations defined by Composio's toolkit: accounts, contacts, leads, opportunities, campaigns, and tasks. Its Tool Router loads only task-relevant tools into context rather than the full catalog.
Fully hosted by Composio — one MCP endpoint, no local process, works with Claude, Cursor, CrewAI, and others. · Composio manages the Salesforce OAuth flow with automatic token refresh and rotation, per-user and per-environment credentials, and an audit trail of agent actions.
- A third-party hosted service sits between your agent and your CRM data — a real consideration for regulated orgs.
- Tool coverage is whatever Composio's toolkit defines, not the full Salesforce API; no raw metadata or Apex tools documented.
- Pricing and free-tier limits were not verifiable from the toolkit pages we checked; confirm current plans before committing.
Salesforce MCP servers compared
| Server | Maintained by | Runs | Auth | License |
|---|---|---|---|---|
| Salesforce Hosted MCP Servers | Salesforce | Salesforce-hosted; nothing to run locally. Generally available since April 29, 2026. | Per-user OAuth 2.0 with PKCE. Every transaction runs as the authenticated user, so CRUD permissions, field-level security, and sharing rules all still apply — no anonymous service accounts. | — |
| Salesforce DX MCP Server | Salesforce | Local, via npx -y @salesforce/mcp. Requires the Salesforce CLI auth flow on the same machine. | Reuses Salesforce CLI web login. Orgs must be explicitly allowlisted with the --orgs flag (specific usernames, default org, or ALLOW_ALL_ORGS, which the docs themselves advise using with caution). | Apache-2.0 |
| tsmztech/mcp-server-salesforce | Community | Local via npm or a Claude Desktop .dxt extension; Docker supported (env-var auth only). Node.js 20+ required; bun explicitly unsupported. | Three modes: username + password + security token, OAuth 2.0 client credentials via a Connected App, or token reuse from a local Salesforce CLI login. | MIT |
| smn2gnt/MCP-Salesforce | Community | Local, Python-based, run via uvx. | Four modes in documented order of preference: access token via env vars, OAuth 2.0 client credentials, local Salesforce CLI config, or legacy username + password + security token. | MIT |
| Composio Salesforce MCP | Community | Fully hosted by Composio — one MCP endpoint, no local process, works with Claude, Cursor, CrewAI, and others. | Composio manages the Salesforce OAuth flow with automatic token refresh and rotation, per-user and per-environment credentials, and an audit trail of agent actions. | — |
How to choose
Pick Salesforce's Hosted MCP Servers if you are on Enterprise Edition or above and agents will touch production data — per-user OAuth means your existing permissions, field-level security, and sharing rules keep applying. Pick the DX MCP Server if the job is development: deploys, scratch orgs, tests, metadata. Pick tsmztech's community server if you are on a lower edition or want raw SOQL, metadata, and Apex tools in one place — accepting that nothing stops a badly prompted delete beyond the integration user's permissions. Pick Composio if you want hosted OAuth with zero infrastructure and can live with a third party in the data path.
How this ranking works
Every server here is real and was checked against its repository or vendor documentation on the date above — stars and licenses come from the GitHub API, not from memory. Order reflects verifiable criteria only: official support, maintenance recency, adoption, auth model, and documented capability coverage. We do not run paid placements, and we list every caveat we find, including the unflattering ones.
Common questions
- Is there an official Salesforce MCP server?
- Yes, two. Salesforce Hosted MCP Servers went generally available on April 29, 2026 for Enterprise Edition orgs and above, and the open-source Salesforce DX MCP Server (github.com/salesforcecli/mcp, Apache-2.0) covers developer workflows like deploys, scratch orgs, and SOQL.
- What does setup and authentication actually look like?
- The hosted product uses per-user OAuth 2.0 with PKCE, so agents inherit each user's existing permissions. The DX server reuses your local Salesforce CLI login and requires explicitly allowlisting orgs. Community servers typically want either a username plus password plus security token in your config, or a Connected App set up for OAuth client credentials — the Connected App route is more work up front and safer after.
- Can these servers modify or delete Salesforce data?
- Most can, and that is the main safety difference between tiers. The hosted server enforces CRUD, field-level security, and sharing rules on every call; community servers like tsmztech's expose delete and anonymous Apex execution with no guardrails beyond the integration user's permission set, so scope that user tightly.
- Do they support SOQL queries?
- The DX server and both community servers expose raw SOQL tools, and tsmztech's adds SOSL and aggregate queries. The hosted product deliberately avoids handing the model arbitrary SOQL, routing queries through admin-defined Named Queries and governed record operations instead.
MCP servers we build
Automation Squad publishes its own open-source MCP servers and agent skills, documented with the same rules this ranking uses.