A plain-English guide for Salesforce admins to connect Claude directly to your org over MCP — no terminal, no code, just clicking through Setup and Claude's Connectors screen. Ask in natural language, Claude reads and writes real data through Salesforce's own hosted MCP server.
Based on Salesforce's Try Headless 360 workshop — I ran this session for Sydney last week.
In Salesforce, click the gear icon → Setup. In Quick Find, search User Interface and open it.
Tick Enable MCP Service (Beta) under the Setup section, then click Save.
In Setup Quick Find, search Permission Sets and open it. Click New.
Label: MCP Client User (the API Name fills in automatically as MCP_Client_User). Description: "Grant API access to the Salesforce hosted MCP servers." Click Save.
On the permission set you just created, click System Permissions. Click Edit, tick API Enabled, then Save.
API Enabled is what lets a user authenticated through this permission set access any Salesforce API — including the MCP endpoint Claude will be calling.
On the permission set, click Manage Assignments → Add Assignment. Check your own user (and any other approved admins who'll use Claude against this org), click Next → Assign → Done.
| Standard server | Server name in URL | What it exposes |
|---|---|---|
| SObject all | platform/sobject-all | Full CRUD — create, read, update, delete, query and search — across all objects |
| SObject reads | platform/sobject-reads | Read and query only, no mutations |
| SObject mutations | platform/sobject-mutations | Create and update only, no delete |
| SObject deletes | platform/sobject-deletes | Delete operations only |
| Salesforce API context | platform/salesforce-api-context | Lets Claude inspect your org's objects, fields and relationships without touching data |
| Metadata experts | platform/metadata-experts | Beta — tools for generating and managing Salesforce metadata (fields, objects, etc.) |
sobject-reads or salesforce-api-context — let Claude look before it can touch anything. Move to sobject-all once you trust the workflow.
In Setup Quick Find, search MCP Servers and open it (it sits under API Catalog). Click Salesforce Servers, then open the server you want (e.g. sobject-reads).
Click Activate. The URL you'll actually connect Claude to isn't something you copy from the page — it's a fixed pattern built from the "Server name in URL" column above. Production orgs (including Developer Edition) and sandbox/scratch orgs use different roots:
Swap platform/sobject-reads for whichever server you activated. You'll paste this into Claude's Connectors screen in Phase 5 — keep it handy in a notes file for now.
Setup Quick Find → External Client App Manager → New External Client App.
Name it something recognisable, e.g. Claude MCP App. Fill in a contact email and distribution state (Local is fine for a dev org).
Tick Enable OAuth. For the Callback URL, use Claude's own fixed redirect address — this isn't something you choose, it's the exact URL Claude's servers listen on:
Under OAuth Scopes you'll see two columns — Available OAuth Scopes on the left, Selected OAuth Scopes on the right. In the left column, select these two (click one, then Ctrl/Cmd-click the other to select both at once):
refresh_token, offline_access) — so Claude doesn't need you to re-authenticate every sessionmcp_api) — the scope that actually grants MCP accessClick the → arrow between the two columns to move both across into Selected OAuth Scopes, then click Create.
Open the app you just created → Edit App Policy. Under Security you'll see four checkboxes — two come off, two go on:
This combination lets Claude authenticate as a secure public client using PKCE, with no client secret sitting anywhere for someone to leak.
Still on the Policies tab, under Plugin Policies:
Set Permitted Users to Admin approved users are pre-authorized. Under Selected Permission Set, move MCP Client User (the one you made in Phase 2) into the Selected column. Set IP Relaxation to Relax IP Restrictions. Click Save.
MCP Client User permission set to can ever authenticate through this app — not every user in the org.
Go to the Settings tab → App Settings → Consumer Key and Secret. Verify with the code sent to your email, then copy the Consumer Key.
You won't need the Consumer Secret — with "Require secret" left unchecked and PKCE required on this app (Step 4), Claude authenticates without one.
In Claude, click Customize in the left sidebar, then click Connectors and the + button. Click Add custom connector.
Name it something recognisable — e.g. Salesforce SObject Read — and give it a description like "Read Salesforce records through Headless 360."
Use the URL you built in Phase 3 for the server you activated — no changes needed, paste it straight in.
Open Advanced settings and paste the Consumer Key you copied in Phase 4 into OAuth Client ID. Click Add.
Click Connect next to the connector you just created. Claude redirects you to Salesforce to log in — if you're already logged in, this step is skipped and Claude gets its access token straight away. Click Allow, and you're back in Claude with the connector showing Connected.
Start a new chat and ask something real about your org:
https://claude.ai/api/mcp/auth_callback — no trailing slash, no typo. Fix it, save, then click Connect again from Claude's Connectors screen.MCP Client User) is actually assigned to the user you authenticated as, and that it's listed in the ECA's Selected Permission Set. A connected-but-toolless connector almost always means the authenticated user doesn't have access to that server's underlying permission set.sandbox/ prefix for non-production orgs) and the standard server is still Activated in Setup → MCP Servers. Also confirm your org's IP restrictions on the ECA are set to Relax IP Restrictions — a strict IP range will silently block requests coming from Claude's servers.