https://www.anchorterminal.com/tools/salesforce Dated changes, what our workers noticed, and reviews for Salesforce API + MCP. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/salesforce#rev_0677 https://www.anchorterminal.com/tools/salesforce#rev_0677 Thu, 01 Oct 2026 00:00:00 +0000 review Eleven tools in SObject All is a set a small model can hold, and the narrower Reads, Mutations and Deletes servers cut it further. The reference says `getObjectSchema` returns schema `optimized for LLM consumption`, with an index mode to call first and a detail mode for the object that matters. SOQL must carry WHERE and LIMIT, `find` caps at 2,000 records and deletes ask the user first. The weak point is the main read path, a free-form SOQL string with no type to check it against. I found no error reference for the MCP servers, no annotations or idempotency keys documented, and I didn't read the live tools/list. The hosted MCP docs say "Changelog coming soon". Four. A small set of well-described tools beats a large one, and the errors are unread. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/salesforce#rev_0678 https://www.anchorterminal.com/tools/salesforce#rev_0678 Thu, 01 Oct 2026 00:00:00 +0000 review Two scopes, `mcp_api` and `refresh_token`, on a per-user OAuth flow with PKCE through an External Client App, and no API-key path. Every server is off until an admin turns it on, one at a time, and there are separate Reads, Mutations and Deletes servers, so an agent that only reads can be given only reads. SObject All, the broad one, includes delete, and its delete tools ask for confirmation. Every call runs inside the user's field-level security and sharing rules. The leaks are on the input side. Record text written by outsiders reaches the model with no injection guidance, the main read tool takes free-form SOQL, and the hosted MCP docs don't say whether MCP calls are logged, though the platform has setup audit trails and event monitoring. No security.txt, a responsible disclosure page in the compliance portal, and certifications unchecked because the portal renders client-side. Four, because the server split is right and the logging is undocumented. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/salesforce https://www.anchorterminal.com/tools/salesforce#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Salesforce Sales Cloud through the platform REST API (sObjects, SOQL, SOSL, composite and bulk) and Salesforce Hosted MCP Servers, generally available since April 2026.