Headless MCP on Salesforce: How to Adopt Headless 360 and Size the ROI

Headless MCP means running Salesforce as a set of Model Context Protocol tools an AI agent calls directly, with no user interface in the loop. Salesforce ships this as Headless 360, a hosted MCP surface where the agent authenticates as a real user and runs CRM actions under your org's existing security. Adopted with the right guardrails, it turns a natural-language prompt into a governed Salesforce operation.

What is headless MCP on Salesforce?

Headless MCP is Salesforce without the screen. The Model Context Protocol is an open standard that lets an AI client discover and call external tools at runtime. 'Headless' means those tools run through the API and agent layer instead of clicks in the Lightning UI. Together, a headless MCP setup lets Claude, Cursor, or any MCP-compatible client read records, run queries, and execute setup operations by calling Salesforce tools directly.

Salesforce's own framing for this is Headless 360, announced at TDX 2026 and made generally available in April 2026. Per the Salesforce Developers blog, it exposes every major capability as an API, MCP tool, or CLI command - more than 60 MCP tools, 4,000+ APIs, and 220+ CLI commands.

How does Salesforce Headless 360 expose MCP tools?

Separate two layers. The standard hosted MCP servers handle data work: SObject All, Reads, Mutations, and Deletes, plus Data 360 and Tableau Next. Then, in July 2026, Salesforce announced the Headless 360 MCP Server Beta, which collapses setup and integration work into four tools: Discover, Describe, Dispatch, and Dispatch Read Only. Rather than exposing thousands of endpoints, the agent discovers the right skill at runtime, roughly 100 skills at launch with more to come.

Both layers run as the authenticated user. Access is scoped through an external client app with the mcp_api scope, and CRUD, field-level security, sharing rules, and permission sets are all enforced. Auth uses OAuth with PKCE, and the token is scoped to the logged-in user. Nothing in the security model is bypassed - the agent inherits the permissions the person already has. For the deeper mechanics, see our guides on what headless MCP is and how to adopt it safely and what Headless 360 means for your team.

How do you adopt headless MCP safely in production?

The demos are easy. Production is where teams get burned. A few rules we apply at Tekunda on every rollout:

• Start read-only. Give agents Dispatch Read Only or the SObject Reads server before any write path is live.
• Scope a dedicated permission set. The agent inherits its user's access, so give it its own least-privilege user, not an admin login.
• Require approval for writes. Keep the client's permission mode on 'needs approval' for create, update, and delete until you trust the flow.
• Log every dispatch. Capture which skill ran, as whom, and against what records, so an agent action is as auditable as a human one.
• Rehearse in a sandbox. Never let a new skill touch production data on its first run.

The security Salesforce enforces is a floor, not a strategy. An agent acting as a user with broad access can still do broad damage fast. If you are wiring several agents together, the handoff design matters as much as the permissions - see running CRM actions from one agentic hub and what makes agent-to-agent handoffs work in production. When you want that rollout designed and governed properly, our Salesforce services team does exactly this work.

How do you calculate the ROI of an Agentforce or headless MCP rollout?

Salesforce publishes an Agentforce ROI calculator that projects cost savings and efficiency over a three-year horizon and estimates the Flex Credits a use case will consume, then hands back a downloadable report. It is a fair starting point, but it runs on generic assumptions.

Ground it in your own numbers with a simple frame, all normalized to a monthly figure: (hours saved per process x monthly volume x loaded rate) - (monthly Flex Credit spend + build cost divided over the payback horizon + monthly governance). Convert Flex Credits to their dollar cost so every term is currency per month. Headless MCP shifts the 'hours saved' side hardest on repetitive, multi-step setup and data tasks - the work that used to mean a dozen clicks across several screens. Count those honestly and the payback is usually clear within a quarter or two.

FAQ

Is headless MCP the same as Agentforce?

No. Agentforce is Salesforce's agent product; headless MCP (Headless 360) is the tool surface an agent calls. You can drive it from Agentforce or from an external client like Claude.

Does an agent using headless MCP bypass Salesforce security?

No. It runs as an authenticated user, and CRUD, field-level security, sharing rules, and permission sets are all enforced. Give the agent a least-privilege user.

What are the four Headless 360 MCP Server tools?

Discover, Describe, Dispatch, and Dispatch Read Only. The agent discovers a skill at runtime instead of loading thousands of endpoints up front.

Do we need code to adopt it?

Not for basic use. You activate the hosted MCP server in Setup and connect an MCP-compatible client. Production governance is where planning pays off, and where a short scoping call saves the most time.