Headless MCP on Salesforce: The Practical Guide for 2026

Headless MCP on Salesforce means exposing Salesforce data and actions as Model Context Protocol tools so an AI agent can run CRM work without ever opening a browser. Salesforce ships this through the Headless 360 MCP Server, in beta since July 2026, which gives agents just four tools that run as the authenticated user, so every permission you already set still applies.

What is headless MCP on Salesforce?

MCP, the Model Context Protocol, is an open standard that lets an AI model discover and call external tools at runtime without bespoke integration code. "Headless" means the work happens through APIs and protocol calls, not the Salesforce UI. Put the two together and you get a CRM an agent can operate directly. Salesforce frames this as Headless 360, which exposes its platform as an API, an MCP tool, and a CLI command so the browser becomes optional rather than required.

What are the four Headless 360 MCP tools?

Instead of publishing thousands of endpoints, the Headless 360 MCP Server exposes four:

• Discover - find the right capability for a task.
• Describe - read the schema and inputs for that capability.
• Dispatch - execute an operation that writes.
• Dispatch Read Only - execute a safe, read-only query.

On top of these sit roughly 100 preconfigured skills at launch, covering user management, Apex triggers, event-driven integrations, and named credentials. Four tools keep the agent's decision space small, which is exactly what makes it reliable in production.

How is a headless MCP request secured?

This is where teams get nervous, and where the design is reassuring. Every Salesforce Hosted MCP transaction runs as the authenticated user, scoped through an external client app with the mcp_api scope. CRUD, field-level security, sharing rules, profiles, and permission sets all apply. If a person cannot do it in Salesforce, their agent cannot do it through MCP either.

If you are packaging an MCP-exposed app for AppExchange, the usual security bar does not move. Your Salesforce security review checklist still covers encryption at rest and in transit (AES-256, TLS 1.2+), SOQL injection, cross-site scripting, sharing enforcement, and input validation. Agentic surfaces add one line to that list: confirm no tool can escalate beyond the running user's permissions. We walk through the full adoption path in Headless MCP on Salesforce: what it is and how to adopt it safely.

Can you calculate the ROI of a headless agent?

Yes, and you should before you build. Salesforce's Agentforce ROI calculator lets you pick use cases, enter your operational numbers, and get a three-year projection of productivity benefit against estimated Flex Credits, the consumption unit Salesforce bills agent usage in. It is the fastest honest answer to "is this worth it" for service, sales, and scheduling automation.

The same math holds for AI-powered phone agents. If you run Aircall integrated with Salesforce and want an Agentforce voice agent to triage or log calls, model the deflected minutes and freed rep hours the same way: volume, handle time, and the Flex Credits each automated interaction consumes. There is no separate phone-agent calculator, so the Agentforce ROI calculator is your tool. We size a build end to end in how to adopt Headless 360 and size the ROI.

Where does a Salesforce PDO or Agentforce partner fit?

A Salesforce PDO (Product Development Outsourcer) builds commercial apps on the platform, packages them correctly, and shepherds them through AppExchange security review. That skill set maps directly onto headless MCP: an ISV exposing its product as MCP tools needs someone who can design the tool surface, enforce the running-user model, and pass review the first time. An experienced Agentforce partner does the same for an internal agent decision-support platform, wiring the four tools to real business logic rather than a demo.

That is the work we do at Tekunda. If you are evaluating a headless agent, a packaged MCP app, or an Agentforce rollout, our engineering services cover the design, the security posture, and the security review, so you ship something that survives contact with production.

FAQ

Is the Headless 360 MCP Server generally available?

No. It entered beta in July 2026, with roughly 100 skills at launch. Treat it as production-adjacent and pilot before you commit critical flows.

Does headless MCP bypass Salesforce permissions?

No. Every call runs as the authenticated user through the mcp_api scope, so CRUD, field-level security, and sharing rules are all enforced.

What is the difference between headless MCP and Agentforce?

Agentforce is the agent runtime. Headless MCP is the standardized tool layer that lets that agent, or any MCP client, discover and call Salesforce actions.

Do I need a PDO to expose my app as MCP tools?

Not strictly, but if you are packaging for AppExchange, a PDO's security-review experience shortens the path and lowers the risk of a failed review.