---
schema_version: "1"
id: 04bcb82cde0ed85c0dd92bd74858203032a0bd2ae040cd3fa780a52968c64cd4
title: Set Tool Restrictions for the Salesforce MCP Server
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/set_tool_restrictions.md
canonical_url: https://help.salesforce.com/s/articleView?id=ai.set_tool_restrictions.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0deb79438919096012150ff8a419eb9a754cbad0be7038a076bed301ed36c3a2
description: Tool restrictions control what Claude is allowed to do in your org through the Salesforce MCP connection. Most of these settings let skills discover, describe, and read your org's data, and must be set to Always Allowed for skills to work at all.
products:
  - Salesforce Platform
release: "264"
---
# Set Tool Restrictions for the Salesforce MCP Server

Tool restrictions control what Claude is allowed to do in your org through the Salesforce MCP connection. Most of these settings let skills discover, describe, and read your org's data, and must be set to Always Allowed for skills to work at all.

1. After connecting, in Claude, go to **Organization Settings** > **Connectors** > **Salesforce - Beta**. Open the **...** menu and select **Tool Restrictions**.
2. Set the **Dispatch API** setting to one of these options.
    
    - Needs Approval—Users can create and update records in Claude, but Claude asks for their approval before proceeding. This is the recommended setting for Salesforce in Claude (beta).
    - Always Allowed—Users can create and update records in Claude without confirmation.
    - Deny—Blocks users from creating or updating, or deleting records in Claude. Use this setting to keep Salesforce in Claude (beta) read-only.
    
    Tools are unrestricted by default, so check the Dispatch API setting even if you haven't changed it.
3. Set **Dispatch read-only API** to **Always Allowed**.
4. Set **Discover** to **Always Allowed**.
5. Set **Describe** to **Always Allowed**.
6. Set **Display Widget (if available)** to **Always Allowed**.
7. Leave all other tools as **No Restriction**.

Next, [roll out the plugin](https://help.salesforce.com/s/articleView?id=sales.roll_out_the_plugin.htm&type=5&language=en_US) to your users.