Nutshell vs Salesforce API + MCP

Nutshell

The REST reference is served as Markdown with an OpenAPI fragment per operation, and the hosted MCP server uses OAuth with PKCE and can only read. No rate limit numbers, error format or API changelog were found in the reviewed documentation, and API keys carry no scopes.

Salesforce API + MCP

Per-user OAuth 2.0 with PKCE and only mcp_api and refresh_token scopes. No hosted MCP changelog yet.

Nutshell

1. Authenticate REST calls with HTTP Basic, a Nutshell user's email as username and the API key as password, against https://app.nutshell.com/rest
2. Use IDs in the <number>-<type> form, such as 3-accounts, and send updates as JSON Patch with content-type: application/json-patch+json
3. Page lists with page[limit] and page[page], which is 0-based, and call /accounts/list/fields or the lead and contact equivalents for valid filter keys
4. Use the REST API for writes. The MCP server only reads, and OAuth tokens need the read scope
5. Filter webhook events yourself, because every webhook receives all events and subscriptions are created in Setup, not through the API

Salesforce API + MCP

1. Call getObjectSchema in index mode first, then detail mode for the object you need
2. Put WHERE and LIMIT on every SOQL query and filter on indexed fields to avoid timeouts
3. Ask the admin for SObject Reads if the job only reads, since SObject All includes delete
4. Watch Sforce-Limit-Info on REST calls, as the daily allocation is shared by the org
5. Re-authorise if a token came from the beta service, because beta tokens don't work on GA