Headless 360 MCP Server (Beta)

Beta: The Headless 360 MCP Server is a Beta Service, available starting in July 2026. You can choose to try this Beta Service at your sole discretion. Any use of the Beta Service is subject to the applicable Beta Services Terms.

The platform/headless-360 server brings the full breadth of Salesforce to any MCP-aware agent through a single connection. Instead of exposing thousands of features as individual tools, the server provides four tools backed by a continuously growing library of Salesforce operations. Your agent’s tool surface stays small and stable while the set of actions it can take scales independently.

Use this server to let agents do tasks such as:

  • Query, create, and update Salesforce records
  • Manage users, including creating, deactivating, freezing, and assigning permission sets and permission set licenses
  • Read, write, and deploy Apex triggers
  • Build event-driven integrations with platform events, Change Data Capture, and event relays
  • Create named credentials, including authentication mechanisms, endpoints, and certificate handling
  • Manage Commerce Cloud Orders

At beta launch, the server offers dozens of operations, with most focused on Setup tasks for admins. The library grows with each release to cover more of what admins, developers, and business users can do across Salesforce. Your agent discovers what’s currently available at runtime through Discover.

Note: The Headless 360 MCP Server isn’t the same as the Data 360 MCP Server. The Data 360 server works only with Data 360 data. The Headless 360 server works across all of Salesforce.

  • API version: v67.0 and later
  • External Client App configured with the mcp_api scope
  • MCP client installed and configured with OAuth authentication

For setup instructions, see Set Up Your Org.

Use these server URLs to access the production and sandbox versions of the headless-360 server.

  • Production: https://api.salesforce.com/platform/mcp/v1/platform/headless-360
  • Sandbox/Scratch: https://api.salesforce.com/platform/mcp/v1/sandbox/platform/headless-360
  1. From Setup, in the Quick Find box, enter MCP Servers, and then select MCP Servers.
  2. Find headless-360 in the list of servers.
  3. Click Activate.
  • “Create a user for our new sales rep and assign the Sales permission set.”
  • “Tell me about what opportunities I should focus on today.”
  • “Log a call in Salesforce.”
  • “Deactivate the user account for a departing employee.”
  • “Build an integration that sends events to AWS when Account records change.”
  • “Set up a named credential for our external inventory service.”

The platform/headless-360 server provides four tools that map to how an agent moves through a request. Use them in this order for the best result.

  • Discover: finds the actions your agent can take
  • Describe: returns the full specification for an action
  • Dispatch: runs the chosen action
  • Dispatch (Read-Only): runs read-only actions

Takes your agent’s interpretation of a request and runs a semantic search across an index of available Salesforce operations. It returns a ranked set of candidate operations, so agents spend less time finding the right action.

Internal name: discover

Request Schema:

Returns the technical contract for an operation, including the APIs, parameters, dependencies, and ordered steps. Your agent uses this tool to verify that Discover returned the right result and to understand the steps needed to complete the action.

Internal name: describe

Request Schema:

Invokes the chosen operation. Dispatch routes the request to the correct endpoint and enforces the access guard before anything runs.

Internal name: dispatch

Request Schema:

Invokes the chosen operation in read-only mode. This tool never changes data or configuration—it’s for when your agent only needs to retrieve information.

Internal name: dispatch_readonly

Request Schema:

Every Salesforce Hosted MCP transaction runs as the authenticated user, scoped through an External Client App with the mcp_api scope. Object permissions (CRUD), field-level security (FLS), sharing rules, profile permissions, and permission sets all apply. If you can’t perform an action in Salesforce, your agent can’t perform it through the MCP server. The audit trail attributes every action to you.

The Headless 360 server follows the same practices that apply across all Salesforce Hosted MCP servers. For full guidance, see Security Best Practices and General Best Practices.

One practice deserves special attention with this server: be deliberate about the permissions you grant at the client level. Most MCP clients let you set tool-level restrictions, so configure your client to require your approval before it runs a tool that changes org configuration or alters or deletes data on your behalf. This step is especially important for admins and developers, who carry wide-ranging permissions. As a best practice, make configuration changes in a sandbox or Developer org before you apply them in production.