Headless MCP on Salesforce: What It Is and How to Adopt It Safely

Headless MCP means an AI agent works with a system through the Model Context Protocol with no user interface in the loop, discovering and calling tools, APIs and data at runtime. On Salesforce the reference implementation is the Headless 360 MCP Server, which lets agents run setup and integration work against your org while your existing permissions still apply. If you are weighing agentic automation for Salesforce, this is the surface to understand first.

What is headless MCP?

The Model Context Protocol is an open standard that lets an AI model discover and call external tools, APIs and data sources at runtime. "Headless" simply means there is no screen or human clicking through a page: the agent runs in the background and acts through the protocol instead. Put together, headless MCP is machine-to-system automation where the model decides what to do and the protocol carries it out.

That matters because most agentic prototypes never reach production. They work in a demo, then fall over the moment they meet real permissions, real data volumes and a security team. Headless MCP is the pattern that closes that gap, because the agent inherits context and policy from the platform rather than reinventing them.

What is the Salesforce Headless 360 MCP Server?

Salesforce introduced Headless 360 in April 2026 as an initiative to expose every Salesforce capability as an API, MCP tool or CLI command. At announcement it spanned 60+ MCP tools, 30+ coding skills, more than 4,000 existing APIs and 220+ CLI commands. The Headless 360 MCP Server went to Beta in early July 2026, building on the hosted MCP servers Salesforce made generally available in April 2026.

Its headline idea is restraint: agents get four tools, not four thousand. Instead of loading every endpoint into the model's context, the server presents a small, stable surface and does the routing itself.

How does headless MCP work on Salesforce?

The Headless 360 MCP Server exposes a compact set of tools that an agent composes into real work:

• Discover - semantic search across a vector index of APIs and skills to find the right capability for a request.
• Describe - return the exact schema and parameters for the chosen capability.
• Dispatch (and a read-only variant) - execute the call against the org.

At Beta the server shipped with roughly 100 skills, with thousands planned. Early skills cover user management (creating and deactivating users, resetting passwords, assigning permissions), Apex trigger management, event-driven integrations such as platform events and Change Data Capture, and named credential configuration. The discover-describe-dispatch loop keeps the model's context small while the catalogue behind it grows.

How does headless MCP handle security and permissions?

This is where headless MCP earns its place in production. On the Headless 360 MCP Server, transactions run as authenticated users holding the mcp_api scope, and the platform's normal controls all apply: CRUD, field-level security, sharing rules, profile permissions and validation rules. The agent cannot see or change anything the running user could not. Governance is inherited, not bolted on.

That is the right default, but it is not the whole job. An agent with broad permissions is still a broad blast radius, so scope the connected user tightly, log every dispatch, and review what the agent is allowed to reach before you turn it loose.

What does a Salesforce security review checklist look like for agentic apps?

If you are packaging an MCP-driven app for AppExchange, the security review still applies, and agentic surfaces do not exempt you from the fundamentals. A working checklist:

1. Enforce CRUD, FLS and sharing in every path an agent can trigger, not just the UI.
2. Avoid SOQL injection by using bind variables instead of concatenated dynamic queries.
3. Encrypt data in transit with TLS 1.2+ and at rest with strong algorithms such as AES-256.
4. Scan before you submit with Salesforce Code Analyzer plus tools like Checkmarx, OWASP ZAP or Burp Suite, and explain any false positives.
5. Set security headers and cookie flags (X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Secure and HttpOnly).
6. Document data storage, authentication and every external integration the agent uses.

Treat the agent as another authenticated client. If each dispatch would pass review on its own, the headless layer above it will too.

Should Salesforce teams adopt headless MCP now?

Headless MCP is early but real, and the direction of travel is clear: agents that act inside Salesforce with the org's own permissions, not around them. The teams that win will be the ones that pair the new surface with old discipline - least-privilege users, real logging and a security review that treats every dispatch as production traffic. That combination of platform depth and delivery rigour is exactly what we build with clients every day. If you want a partner to help you design it safely, talk to Tekunda.

FAQ

Is headless MCP the same as the Model Context Protocol?

No. MCP is the open protocol; headless MCP is using it with no user interface, so an autonomous agent drives the calls. Salesforce Headless 360 is one implementation of that pattern.

When did the Salesforce Headless 360 MCP Server launch?

It entered Beta in early July 2026, building on Salesforce's hosted MCP servers that became generally available in April 2026.

Does headless MCP bypass Salesforce security?

No. Calls run as authenticated users with the mcp_api scope, and CRUD, field-level security, sharing rules and profile permissions all still apply.

What are the four Headless 360 tools?

Discover, Describe, Dispatch and a read-only Dispatch. The agent searches for a capability, reads its schema, then executes it against the org.