Evidence-first authority page
MCP for Salesforce: CRM Data Access
How a Salesforce MCP server exposes CRM records to an agent, and the field-level permission model worth applying.
Direct answer
A Salesforce MCP server exposes CRM object operations — reading and updating leads, contacts, opportunities — as tools an agent can call, typically authenticated via OAuth with a connected app; scope the integration user's Salesforce permission set to the specific objects and fields the task needs, rather than granting broad CRM-wide access by default.
Last reviewed 2026-08-29
This page remains noindex while its page-level source receipts are completed and verified. It is available for review, not presented as publication-ready authority.
Use Salesforce's own permission model as the boundary
Salesforce's field-level security and permission sets let you restrict exactly which objects and fields a connected integration user can read or write — apply this the same way you would for a human user with limited responsibilities, rather than connecting through an administrator account with full access.
Common safe starting use cases
- Drafting activity log entries or call summaries for a rep to review and save.
- Looking up account or opportunity status to answer a query, without write access.
- Flagging stale or incomplete records for a rep's attention, rather than auto-updating them.