Set Tool Restrictions for the Salesforce MCP Server

Tool restrictions control what Claude is allowed to do in your org through the Salesforce MCP connection. Most of these settings let skills discover, describe, and read your org's data, and must be set to Always Allowed for skills to work at all.

1. After connecting, in Claude, go to Organization Settings > Connectors > Salesforce - Beta. Open the ... menu and select Tool Restrictions.
2. Set the Dispatch API setting to one of these options.
   • Needs Approval—Users can create and update records in Claude, but Claude asks for their approval before proceeding. This is the recommended setting for Salesforce in Claude (beta).
   • Always Allowed—Users can create and update records in Claude without confirmation.
   • Deny—Blocks users from creating or updating, or deleting records in Claude. Use this setting to keep Salesforce in Claude (beta) read-only.

   Tools are unrestricted by default, so check the Dispatch API setting even if you haven't changed it.

3. Set Dispatch read-only API to Always Allowed.
4. Set Discover to Always Allowed.
5. Set Describe to Always Allowed.
6. Set Display Widget (if available) to Always Allowed.
7. Leave all other tools as No Restriction.