MCP Server vs. Instance URL: How to Give Copilot or Claude Safe Access to Salesforce

When a firm decides to connect its AI assistant to Salesforce, someone in IT usually reaches for the most familiar option: the org's instance URL and the REST API. It works, in the sense that data comes back. The people using it tend to be disappointed, and compliance has fewer controls to work with. Salesforce hosted MCP servers solve both problems, and the difference is worth understanding before you pick a path.

What is an MCP server, in plain terms?

Model Context Protocol is an open standard, introduced by Anthropic, for connecting AI assistants to business systems. An MCP server is a collection of tools. Each tool does one job, such as "query records," "get a record's related records" or "update a record," and carries a description the AI reads to decide when to use it.

The tools sit on top of the same APIs you already have. What changes is the packaging. Instead of an AI model guessing how to call a generic endpoint, it picks from a menu of business-ready actions. Salesforce now hosts these servers for you, so there is no middleware to build or maintain.

What goes wrong when you connect AI to Salesforce with the instance URL?

The instance URL (your yourdomain.my.salesforce.com address) gives an AI tool access to the full Salesforce API with nothing in between. In practice, that means:

• Users have to be prescriptive. A request like "pull every lead we created last week, grouped by source" works far better when a tool exists for querying records. Without one, users end up dictating object names, fields and filters.
• Access is all or nothing. There is no clean way to say "this team can read, that team can also update, nobody can delete."
• The connection is tied to one AI product. Custom wiring built for one assistant usually has to be rebuilt for the next.

How does MCP give you more control over AI access to Salesforce?

Salesforce lets admins configure which servers and tools are available. A read-only server exposes query and lookup tools. A broader server adds create, update and delete. You decide which server each group connects to, and every request runs with the signed-in user's own permissions, so field-level security and sharing rules still apply.

That gives compliance teams a sensible rollout path:

1. Phase 1, read-only. Reporting and retrieval. Users ask questions and get answers from Salesforce without leaving their AI assistant.
2. Phase 2, create and update for named roles. Operations or sales users add contacts, log activity or move opportunities forward in plain language.
3. Phase 3, destructive tools, if ever. Delete and merge stay off until the business has a clear reason and an audit approach.

In our experience, most regulated firms start at phase 1. That is a reasonable first step, as long as the plan to move forward is written down and someone owns it.

Why does MCP make your AI strategy more portable?

MCP is a shared standard. Microsoft Copilot, Claude, ChatGPT and a growing list of business tools all act as MCP clients. The Salesforce side of the work (the server, the External Client App, the permissions) stays the same no matter which assistant connects to it. If your firm changes AI vendors, or runs more than one, the Salesforce connection carries over and only the client-side sign-in changes.

The same pattern applies to your other systems. Once one MCP connection is working, adding a second data source is one more tool on the same agent.

What should you decide before connecting AI to Salesforce?

• Which users get read-only access, and which, if any, get create and update.
• Which Salesforce objects and fields are in scope, and whether any need tighter permissions first.
• Who completes the OAuth sign-in. With single sign-on, that person needs a Salesforce user that maps to their identity provider account.
• How you'll measure the pilot, such as hours saved on reporting or fewer "can you pull this for me" requests to the Salesforce admin.

For the step-by-step Microsoft setup, see our guide on connecting Salesforce to Microsoft Copilot with the hosted MCP server.

Frequently asked questions

Is MCP a workaround or a supported approach?

It is supported. Salesforce hosts and documents its MCP servers, and Microsoft Copilot Studio has a built-in MCP wizard. It is the standard way AI assistants connect to business systems today.

Can AI really update records in Salesforce?

Yes, when the connected MCP server includes create and update tools and the user has those permissions in Salesforce. Many firms choose to start with read-only tools and add write access later.

Does MCP bypass Salesforce security?

No. Each user signs in through OAuth, and Salesforce documents that its SObject tools respect field-level security and sharing rules.

Why can my AI assistant read data but not edit documents or records?

That is almost always a configuration choice, often made for security or compliance reasons. The assistant can only use the tools it has been given access to.

Do we need a developer to set up a Salesforce MCP server?

Not for the standard servers. A Salesforce admin configures them in Setup. Custom tools that call your own Apex logic do need development work.

Which AI assistants work with Salesforce MCP servers?

Any MCP client that supports OAuth and the Streamable HTTP transport, including Microsoft Copilot Studio, Claude and ChatGPT.

Planning AI access to Salesforce?

Vantage Point helps financial services firms connect Salesforce to their AI tools with the permissions, phasing and documentation their compliance teams expect. Book time with our team.