Earlier this year, Salesforce made its hosted MCP servers generally available. If your security team has been saying no to using Claude with Salesforce because there was no governed way to grant it, that reason is gone. Claude, or any AI chat tool that speaks MCP, now connects to your org through an endpoint Salesforce manages. Every call runs as the signed-in user. Field-level security and sharing rules apply. Read, update and delete are separate servers, so you can allow one without the others.
That settles the question security asked first. Can Claude see something the user can’t? No.
It leaves open the question you will be asked next, and it is the harder one. Should Claude see everything the user can?
What a rep can see is not what an agent needs
In the org we measured, a rep could see 212 fields on an opportunity. The renewal-risk question the team wanted answered needed 22 of them.
The other 190 are not a security problem. The rep is allowed to see every one of them. They are a different kind of problem. The field nobody has touched since the 2022 migration. The picklist that still carries retired values. The one someone added next to compensation data. To an agent, each of those arrives with the same standing as the close date.
People don’t have this problem, and that is why it is easy to miss. Oso and Cyera studied 2.4 million workers this year and found that 96 percent of granted permissions are never used in a 90-day window. A person with 212 fields looks at the eight they need. Habit and the page layout do the narrowing for them. An agent reads everything it is given, at equal weight, and will quote any of it in an answer.
How you control this today
The standard Salesforce servers expose every object and every field in your org, gated only by the user’s permissions, and their tool sets can’t be changed. If you want Claude to receive a shorter list, a developer builds one for that use case with a developer tool: Apex, a Flow or a Named Query.
That works, and some teams should do it. It is also a development project per use case. The person who knows which fields matter files a ticket to change it, and three use cases means three pieces of custom code, and each one drifts on its own.
The code only handles the data. A Named Query can return the right 22 fields, but it can’t tell Claude what they mean: that the renewal date lags a day, or that the margin field should never be quoted to a customer. That guidance ends up hard-coded in the prompt, written separately by whoever built the agent. When the query changes, the prompt doesn’t. When a second agent is built, the guidance is typed in again.
Who should curate the context?
Not a developer, and not the page layout. The people who know what the business needs from an opportunity are in RevOps and sales ops, and they should be the ones who choose what the agent receives, with the meaning attached, in a form they can read and change themselves. Salesforce still decides who may see any of it.
This is what ContextWorks is for. Your RevOps team defines what an agent gets for an opportunity: the fields that matter, what each one means and how to use it, in one place that every agent reads. Every request runs live as the signed-in user, so a definition can’t show anyone a field they couldn’t already see on the record. And before any agent is connected, security can preview exactly what it will receive for any record, as any user.
What to ask
Whoever is building your AI access to Salesforce, these are the questions to ask. They apply to a custom server or to ContextWorks.
- What is the list of fields and related records this agent will receive, and can I read it?
- Who changes that list, and do they need a developer to do it?
- Can I see what the agent receives for a given record, as a given user, before it is connected?
- Is the data copied anywhere, or does every request run live as the caller?
Salesforce MCP server security provides the security. Claude can’t see what your reps can’t. What Claude should see is up to you, and the right answer comes from the people who know what your reps actually need. Decide that before anyone connects Claude to your org, and make sure your own team can change it without filing a ticket.
