Check the risk score of third-party Model Context Protocol (MCP) servers during registration. Agentforce Registry conducts an automatic security scan that returns a Low, Medium, or High risk score. Use the risk score as a risk indicator of MCP servers.
Where: This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions with Foundations or Agentforce 1 editions.
When: Security risk scoring for third-party MCP servers is available on a rolling basis starting the week of July 13, 2026.
Why: A compromised tool description redirects agent behavior without any visible sign to the admin using it—a type of attack called tool poisoning. A Medium risk score indicates a perceived risk. A High risk score indicates a detected risk.
How: In Setup, go to Agentforce Registry and select Register MCP Server. Complete the connection details. When you reach the MCP Server Allowlist step, the registry shows an overall risk score and a score for each tool.