In one line: Every MCP tool call is authenticated per-user and enforces the exact same Field-Level Security, sharing rules, and CRUD permissions a human would have — but it also counts against the same daily API limit as every other integration, and agentic workflows burn through that limit far faster than traditional integrations do.
Important: Salesforce Hosted MCP went GA on April 29, 2026, and its authentication is OAuth 2.0 + PKCE via External Client Apps (ECA) only — required scopes are mcp_api and refresh_token. Traditional Connected Apps are not supported for the official Salesforce Hosted MCP server. This is the auth pattern used throughout this course, including the demo project in Modules 4 and 5.
How Permissions Actually Travel With an Agent
Salesforce's per-user permission model enforces Field-Level Security, sharing rules, and CRUD permissions on every single MCP tool call, exactly as it would for that same user clicking through Lightning. There's no separate, looser trust layer for agents — Claude, calling on your behalf through an authenticated session, sees only what you're allowed to see and can only do what you're allowed to do. This is the core promise of Headless 360's "Trust Moat": the surface changes, the platform's enforcement doesn't.
Confirmation as a Governance Layer
Alongside FLS, sharing, and CRUD enforcement, Salesforce's Agent Actions include a "Require user confirmation" checkbox — a pause-and-approve step before a write action executes. In hands-on testing (see Module 5), this worked exactly as intended: Claude paused and confirmed the intended action with us before executing the write, even when called from an external MCP client like Claude Desktop. Combined with FLS/sharing/CRUD, this gives you two independent layers of protection on any write-capable agent action — what the agent is allowed to touch, and whether it pauses before touching it. Both are worth enabling on any action with real-world write consequences.
The API Limit Math You Need Before Scaling
Enterprise Edition defaults to 100,000 API calls per day, plus 1,000 more per user license, measured on a rolling 24-hour window, not a calendar day. Every MCP tool call counts against this exactly like a REST call does. The part that catches teams off guard: a single Claude conversation now averages 8–15 tool calls, up from 2–3 calls when MCP first shipped in 2024. That's a 4-5x jump in API consumption per unit of "useful work" compared to older integration patterns.
🧮 Worked example
40 sales reps, each asking Claude to prep for 3 meetings a day, at roughly 10 tool calls per prep (query pipeline, check renewal status, check open cases, etc.) = 40 × 3 × 10 = 1,200 calls/day just from this one workflow. That's only 1.2% of a 100K daily limit on its own — but stack five or six agentic workflows like this across a growing org, plus your existing integrations, and you can burn through the full limit well before end of day. Model your actual tool-call count per conversation before assuming you have headroom.
MCP vs REST API — Tradeoffs That Matter
| |
Salesforce Hosted MCP |
REST API |
| Auth |
OAuth 2.0 + PKCE via ECA only |
OAuth, JWT Bearer, or Connected App client credentials |
| Headless / background agents |
Requires interactive OAuth per user — no static credential shortcut |
JWT Bearer supports fully headless, no user interaction |
| Surface coverage |
SObject CRUD, Flows, Invocable Apex, Apex REST, Data 360, Tableau |
Everything, including Bulk, Metadata, Tooling, and Streaming APIs |
Common Production Failure Modes
"Claude confidently says there's no data, but there actually is"A known pattern: some APIs (Salesforce included) return a 200 with an empty result instead of an error when throttled on specific endpoints. Claude sees zero rows and states it confidently instead of flagging a possible throttle. Compare row counts against a known sentinel value if this matters for your workflow.
"Agent hits 401 mid-session even though nothing changed"Check the External Client App's session timeout policy. If "Force relogin after" is set aggressively, agent-facing sessions will get logged out mid-conversation. Set this to None for agent-facing ECAs specifically.
"Retry storms make one rate-limit hit worse"If two tool calls in the same agent turn both hit the same rate-limited bucket, both retry independently, doubling recovery time and token cost. Rate-limit at the MCP server level, per (tenant, API) pair — not per individual tool.
Glossary (New Terms This Module)
External Client App (ECA)The OAuth client type required for Salesforce Hosted MCP authentication — distinct from, and not interchangeable with, a traditional Connected App.
PKCEProof Key for Code Exchange — an OAuth security extension that prevents authorization code interception, required for Salesforce Hosted MCP auth.
Rolling 24-Hour WindowHow Salesforce measures API limits — continuously over any trailing 24 hours, not reset at a fixed calendar time.
Token Bucket Rate LimitingA rate-limiting pattern that allocates a capped "bucket" of allowed calls per tenant/API pair, refilling over time — the recommended fix for retry storms in multi-tenant MCP servers.
Key Points for Interviews & Real Projects
- Salesforce Hosted MCP requires an External Client App with OAuth 2.0 + PKCE — not a Connected App
- Every MCP tool call inherits the calling user's FLS, sharing rules, and CRUD permissions automatically
- API limits (100K/day default on Enterprise Edition) apply on a rolling 24-hour basis and count MCP calls the same as REST calls
- Model expected tool-calls-per-conversation (8-15 is typical) before assuming your org has API headroom for a new agentic workflow
- Set "Force relogin after" to None on agent-facing External Client Apps to avoid mid-session 401s
One-Line Answer for Interviews
"Every MCP tool call in Salesforce Headless 360 authenticates through an External Client App with OAuth 2.0 and PKCE, inherits the calling user's exact FLS, sharing, and CRUD permissions, and counts against the same rolling 24-hour API limit as any other integration — agentic workflows just consume that limit faster because a single conversation can involve 8-15 tool calls."
Frequently Asked Questions
Can I use a Connected App for Salesforce Hosted MCP?
No. Salesforce Hosted MCP requires an External Client App (ECA) with OAuth 2.0 and PKCE — Connected Apps are not supported for this specific authentication path.
Do MCP tool calls count against my org's API limit?
Yes. Every MCP tool call counts exactly like a REST API call, against the same daily limit (100,000 default on Enterprise Edition, measured on a rolling 24-hour window).
Does an AI agent get more access than a human user through MCP?
No. The per-user permission model enforces the same Field-Level Security, sharing rules, and CRUD permissions on every MCP call as it would for that user in Lightning.
Can Salesforce Hosted MCP run fully headless, with no user login?
Not currently — it requires an interactive OAuth flow per user. Fully headless server-to-server patterns are only supported through the REST API's JWT Bearer flow.
How many tool calls does a typical Claude conversation use?
Typically 8-15 tool calls per conversation as of 2026, up from 2-3 when MCP first launched — a meaningful factor to model when estimating API consumption at scale.