Headless MCP in Salesforce: What Headless 360 Means for Your Team

Headless MCP means running a Model Context Protocol server with no user interface, so an AI agent can discover and call your systems in the background instead of a person clicking through a screen. In Salesforce this now has an official form: the Headless 360 MCP Server, a beta surface Salesforce shipped in early July 2026 that lets MCP-compatible agents run setup and integration work directly against your org. If you build on Salesforce, it changes how work gets done and what your security review has to cover.

What is a headless MCP server?

MCP, the Model Context Protocol, is an open standard that lets an AI model discover and call external tools and data at runtime, so any compatible client can talk to any compatible server without custom glue code. Headless simply means there is no screen in the loop: the agent works against an API surface, not a UI.

Put together, a headless MCP server is a background endpoint that exposes real capabilities, from creating users to running queries to deploying code, to an AI agent through a stable, machine-readable interface. The person sets the intent; the agent discovers the right operation and executes it.

How does Salesforce Headless 360 work?

Salesforce solves an obvious problem: an org has thousands of features, and handing thousands of tools to an agent wrecks its decision-making. Instead, the Headless 360 MCP Server exposes just four tools, with a growing library of skills behind them:

• Discover - semantic search across APIs and skills, returning ranked candidates.
• Describe - the technical spec for a chosen skill: parameters, dependencies, ordered steps.
• Dispatch - invokes a skill, with access control enforced.
• Dispatch Read Only - runs read-only operations.

This keeps the agent interface small and stable while the action surface scales on its own. It builds on Salesforce Hosted MCP Servers, which reached general availability in April 2026 and authenticate each caller with per-user OAuth 2.0 and PKCE.

What can headless MCP do in Salesforce today?

The beta launched with a focused set of operations and roughly a hundred skills, with more planned. At launch it covers:

• User management, including creating and deactivating users, resetting passwords, and assigning permissions.
• Apex trigger development.
• Event-driven integrations across Change Data Capture, platform events, and event relays.
• Named credential configuration.

Zoom out and the wider Headless 360 initiative reaches 60+ MCP tools, 30+ coding skills, 4,000+ existing APIs, and 220+ CLI commands for authenticated callers. The promise is that implementations compress from months to days, because agents draft the work while developers specify intent and review the output.

Is headless MCP secure?

An agent that can create users and deploy Apex is exactly as dangerous as the permissions behind it, so this is the question that matters. The reassuring part is that Headless 360 does not invent a new trust model; it rides on the one Salesforce already enforces. Every action is scoped by four layers:

• Identity - the agent acts as an authenticated user, never above them.
• Access - sharing rules and field-level security still apply.
• Invocation scope - only explicitly exposed skills can be called.
• Governance - validation rules, approval chains, and governor limits still fire.

The model provides intelligence. The platform provides identity, access, capabilities, and governance, the context that makes intelligence useful.

In practice the risk is not the protocol; it is over-broad permissions on the connected user. Treat the agent user like any integration user: least privilege, and audit what it can reach.

What belongs on a Salesforce security review checklist for MCP-connected apps?

If you package software for the AppExchange, exposing capabilities over MCP does not exempt you from the AppExchange Security Review; it raises the stakes. Our short version, drawn from shipping through the review ourselves:

• Enforce CRUD, field-level security, and sharing in every Apex entry point an agent can reach, not just the UI.
• Kill SOQL injection with bind variables, never string-built dynamic SOQL.
• Encrypt data at rest and in transit, with AES-256 and TLS 1.2 or higher.
• Scope named credentials and connected apps to the minimum, and prove it.
• Run Salesforce Code Analyzer plus a scanner such as Checkmarx, and document every false positive.

The theme is consistent: a headless surface removes the human who used to be the last check, so the org's own controls have to carry that weight.

For those controls in the order that matters, work through our Salesforce security review checklist, and when the scanners flag issues you have already handled, our guide to documenting false positives keeps them from stalling your submission.

FAQ

What does headless mean in MCP?

It means there is no user interface. The AI agent calls tools and data through an API in the background, rather than a person operating a screen.

When did Salesforce launch the Headless 360 MCP Server?

It entered beta in early July 2026, building on Hosted MCP Servers that became generally available in April 2026.

Do I need a separate security review for an MCP-connected app?

AppExchange packages still go through the standard Security Review. MCP adds no separate process, but it widens the surface, so CRUD, FLS, sharing, and least-privilege access must hold at every entry point.

Does an MCP agent bypass Salesforce permissions?

No. It acts as an authenticated user and inherits that user's permissions, sharing rules, and field-level security.

Headless MCP is how agent-driven work reaches Salesforce, and it is already in beta. If you want that surface to move fast without widening your attack surface, that is the build and security work Tekunda does every day. Book a security review of your setup.