Salesforce MCP in 2026: setup, cost, OAuth vs Standards

Salesforce MCP lets an AI client read, create, update and delete records in your Salesforce org, run SOQL queries, search across objects and call your own Apex or Flows. Every call runs as the signed-in person, within their field-level security and sharing rules. Salesforce calls the product Salesforce Hosted MCP Servers, generally available since 29 April 2026 for "every Enterprise Edition org and above", according to its GA announcement. Salesforce runs the servers at api.salesforce.com, so you host nothing. Its servers reference, read on 26 October 2026, lists four record servers that split the rights an admin hands out. It also lists product servers for CMS content, Data 360 and Tableau Next and, in beta, Headless 360, Metadata Grounding and CRM Analytics. The SObject All server carries 11 tools, from getObjectSchema and soqlQuery to deleteSobjectRecord. A query returns at most 50,000 records per transaction, and a text search at most 2,000. An admin can also build a custom server that mixes these tools with Apex actions, Flows and Named Queries.

Salesforce gives a sales example on its SObject All page, read on 26 October 2026: "Create a follow-up task for every Account where the last activity date is more than 90 days ago."

Salesforce MCP requires an Enterprise Edition org or above, a System Administrator or equivalent, and an External Client App registered for each AI client before anyone asks a question. Each server ships disabled, so the admin first enables it in Setup, under API Catalog, then MCP Servers. The admin then creates an External Client App with the mcp_api and refresh_token scopes, pastes the callback URL of the client (Claude, ChatGPT, Cursor or Postman), and copies the consumer key into that client. Salesforce's setup guide warns that the app "can take up to 30 minutes to become available". Salesforce supports neither Connected Apps nor dynamic client registration, so a client cannot register itself. Salesforce's GA post says the whole setup "takes less than 30 minutes". The hosted MCP pages, read on 26 October 2026, name no MCP price of their own: the cost is the Salesforce plan behind the org, which must be Enterprise Edition or above. The Sales Cloud pricing page does not name editions; its plans with the Web Services API run from $125 per user per month (Pro Suite plus the $25 API add-on) to $550 for Max.

Read on 26 October 2026, the Sales Cloud pricing page lists these plans in US dollars per user per month:

The Web Services API is included from Core. Agentforce for Sales is a separate add-on, "from $125 USD/user/month". Ask your Salesforce account executive which plan maps to Enterprise Edition for your org before you budget.

Salesforce and Standards both sign an AI client in with OAuth and PKCE, so the client acts as you and never holds your password. On Salesforce, an administrator registers every client as an External Client App; by default "any user in your org can authenticate" through it, and refresh tokens "remain valid indefinitely" until the admin shortens them. On Standards, nobody registers the client: it identifies itself with a public metadata document whose URL is its client ID, so no administrator acts before you connect. You choose an access level on the consent screen: Read, Write (the default) or Full. You can lower that level later from Connected apps without reconnecting, or raise it as far as the client asked for and your role allows. In October 2026, Standards rotates refresh tokens on every use and ends a grant after 90 days unused. A script or Cursor can also connect with an API key, which carries its own role. The Standards OAuth documentation sets out each of these rules.

Standards' MCP server gives an AI client up to eight tools at https://api.standards.new/v1/mcp, and hides any tool the person or key cannot use. A person on Read access, for instance, never sees the delete tool. Standards then checks each call again against the object it touches, with the same roles that govern the Standards app and REST API. On connection, Standards lists every object the client may read and asks it to read an object's schema before it writes. Documents come with their extracted text, so an agent can read a client's contract without a download. A delete takes one reference per call and is a soft delete you can restore, and Standards' instructions ask the client to confirm each delete with you first. The tools carry the standard MCP hints: Standards marks search, query and read read-only, and flags write, edit_content, organize and delete as destructive, the MCP term for a tool that overwrites or removes data. The tool reference gives each tool's inputs and limits:

In the other direction, Standards' own agents act as MCP clients and call about fifty third-party MCP servers, such as Notion, Stripe and Linear, signed in with OAuth.

Standards suits a firm of 5 to 50 people that wants its AI tools to work on client files without buying an enterprise CRM plan first or asking an admin to register each client. You describe your own objects, such as households, contracts and the documents behind them, and the MCP server serves them as they are. Standards is the better choice when:

• you want Claude Code or Codex connected from a terminal, with an access level each person picks at sign-in and can change later, and Cursor connected with an API key bound to a role;

• your AI tools must read the text of the documents filed on each record, not only its fields;

• you need a script or a scheduled job to call the same tools with an API key and its own role;

• you want your records on Standards' shared cloud, on a dedicated instance under your own hostname or on your own infrastructure, the three options Security and hosting describes;

• you want the same rights across the app, the Standards API, SDK, CLI and MCP server.

In October 2026, Standards does not publish its prices. It charges per person per month, with setup included, and an engineer gives you the figure on the first call. The other Standards comparisons apply the same criteria to other CRMs.

You move from Salesforce to Standards with Standards engineers, starting with a 30-minute call on what you run in Salesforce today. You leave the call with a plan: which objects Standards replaces, which agents take over routine work, and how long the move takes for your volume of records. The engineers set up the workspace with you, because self-serve sign-up is on a waitlist in October 2026.