Claudeforce: Salesforce in Claude (Sept 2026 open beta)
On Aug 26, 2026 Salesforce and Anthropic co-announced Claudeforce, a four-strand partnership. The first shipping piece is Salesforce in Claude — a plugin that lets a Claude conversation reason over live CRM data and take governed action, with 37 prebuilt sales skills (only ~8 named publicly at launch), an open beta scheduled for September 2026, and — this is the part press coverage skips — a surprisingly small MCP surface underneath.
Most of the write-ups are re-cut press releases. This page is the practical field guide: the architecture that makes 37 skills possible from just 4 MCP tools, the two very different auth models the plugin ships with, and the governance traps that will bite RevOps if you treat it like another Chrome extension.
- Understand what actually ships in the September 2026 open beta — the four Claudeforce strands, and which one is 'Salesforce in Claude'
- See why the plugin needs only 4 MCP tools (Discover / Describe / Dispatch / Dispatch Read-Only) to expose the whole Salesforce API surface
- Tell the two auth routes apart — per-user OAuth (Claude) vs client-credentials integration user (Slack) — and pick correctly for your org
- Classify the 37 skills by authority level (read-only / recommend / write) before you turn any of them on
- Avoid the four traps: over-provisioned profiles, forgotten automation side effects, the Winter '27 upgrade collision, and shadow-IT MCP servers
What Claudeforce actually is (and isn't)
Claudeforce is a four-strand partnership, not a product. Only one strand — Salesforce in Claude — is opening in September 2026. Conflating the strands is how RevOps teams end up scoping the wrong pilot.
Guided walkthrough1 of 4
- A Salesforce plugin that runs INSIDE the Claude app. Sellers stay in Claude; Claude reaches into their org via Salesforce's Hosted MCP. This is the strand this page is about.
- The reverse direction: Anthropic's models available as first-class citizens across Agentforce (Atlas Reasoning Engine, Agentforce Vibes, Agentforce Coworker, Agent Builder). Different UX, different admin surface, different rollout schedule.
- Slack AI features (huddles summaries, channel recaps, message drafting) start using Claude as the default backing model. Governed differently — see the Slack auth route below.
- Salesforce becomes a large Anthropic customer; Anthropic becomes a large Salesforce customer. Interesting for procurement, irrelevant for the technical setup.
The rest of this page is strand 1: Salesforce in Claude.
The 4-tool architecture that scales to 37 skills
The single non-obvious thing about Claudeforce is that the plugin does not register a tool per capability. Salesforce's Headless 360 Hosted MCP Server (Beta, July 2026) exposes exactly four MCP tools, and Claude reaches every skill by composing them.
Guided walkthrough1 of 4
- Semantic search across a vector index of every API and skill in the connected org. Claude passes its interpretation of your request; Discover returns a ranked list of candidate operations. This is the reason 'find me the deal-health thing for this account' doesn't require 200 pre-registered tools cluttering context.
- For a chosen candidate, Describe returns the technical contract: parameters, dependencies, ordered steps, side effects. Claude uses it to verify Discover surfaced the right thing before it commits to running anything.
- Runs the chosen operation. Routes to the right endpoint. Enforces user access guards before the call reaches Salesforce. This is the write path — validation rules, Flows, Apex triggers, and CPU governor limits all fire as normal downstream of Dispatch.
- GET-only variant. Same discovery flow, same access checks, but the tool physically cannot mutate. This is the pilot-safe default and the tool the read-only skills bind to.
Two implications most launch posts miss:
- The tool surface stays small and stable, but the catalog of skills grows independently on Salesforce's side — Claude doesn't need a new tool registration to reach a new skill.
- Field-level security, object permissions, and sharing rules apply to every tool call — enforcement happens in the org, not in Claude. If a user can't see a field in the Salesforce UI, Discover won't surface it and Dispatch would deny it anyway.
The two auth routes — and why the difference matters
Claudeforce ships with two OAuth models stapled to the same-looking plugin, and they have very different security postures. Getting this wrong is how you accidentally give every rep in the org the effective permissions of one integration user.
Guided walkthrough1 of 2
- Uses Salesforce External Client Apps with the mcp_api scope. A single admin does the one-time org-level connect; each seller then authorizes as themselves. Every Claude tool call runs as the requesting individual, with THEIR profile, permission sets, sharing rules and field-level security. This is the correct posture for anything user-visible.
- Uses OAuth 2.0 client credentials flow with a dedicated integration user. Access bundles share ONE agent credential across users. Every request runs as the same integration user — meaning that user's permissions become the effective ceiling for everyone touching it. Convenient, but the wrong shape for anything with per-user data isolation requirements.
- If you provision the Slack integration user with a wide sales-ops profile so 'it just works,' every Slack user routed through it inherits that effective access. Restrict the integration user's profile to the narrowest scope Slack actually needs, then add capability with permission sets — same principle as any shared service account.
The 37 skills, classified by authority level
Salesforce named only a handful of skills at launch; more will drop through late 2026. What you can plan for right now is that every skill lands in one of three authority levels, and the interface makes them look identical. It's on you to classify.
| Named skill (Aug 2026) | Authority level | Rough Dispatch route |
|---|---|---|
| Daily briefing | Read-only | Dispatch RO |
| Pipeline review | Read-only | Dispatch RO |
| Forecast narrative | Read-only | Dispatch RO |
| Meeting preparation | Read-only | Dispatch RO |
| Deal-health review | Read-only | Dispatch RO |
| Win/loss analysis | Read-only | Dispatch RO |
| Salesforce hygiene | Recommend | Dispatch RO → drafts |
| Activity logging | Write | Dispatch (POST/PATCH) |
The remaining ~29 skills are unpublished at launch; the same triage applies as they land:
Guided walkthrough1 of 3
- Analyzes, summarizes, retrieves. Cannot mutate. Enable freely for the pilot cohort. Failure mode is 'wrong answer,' not 'wrong write.'
- Analyzes AND proposes changes, but leaves the actual mutation as a draft for a human. Enable after the read-only tier is behaving. Failure mode is a bad draft that a seller might approve without reading — measure correction rate, not just speed.
- Directly mutates CRM data. Every write goes through the org's validation rules, Flows, Apex triggers, and CPU governor limits, EXACTLY as if a human clicked Save. Enable last, per-skill, with per-user profile scoping, and only after you've measured recommend-tier accuracy for at least 4 weeks.
Setting up a pilot — the RevOps checklist
Guided walkthrough1 of 6
- Any over-provisioned profile that was harmless behind a slow UI becomes genuinely risky behind a fast agent. Before piloting, run a permissions audit on the users you'll invite: which objects, which fields, which record-type sharing. The plugin will faithfully enforce whatever those profiles say — including whatever historical over-provisioning nobody noticed.
- Create a Claudeforce Pilot permission set: specific objects, specific fields, read-only to start. Assign it in addition to their normal profile so you can remove it cleanly at the end of the pilot without touching baseline access.
- Enable only read-only skills for the first two sprints. This lets you measure accuracy without a rollback surface. Watch for hallucinated field names or wrong record lookups — those are the failure modes that survive into the write tier.
- One read-only, one recommend, one write. Different risk profiles surface different governance gaps, and one pilot per tier is cheaper than one pilot per skill.
- Salesforce in Claude requires API v67.0+; Winter '27 introduces v68.0. If your org auto-upgrades to Winter '27 during the beta window (Sept–Oct 2026), lock the plugin's API version explicitly so a platform upgrade doesn't shift semantics on you mid-pilot.
- If individual teams stand up their own Hosted MCP Servers to 'move faster,' you've reinvented shadow IT with cleaner packaging. Centralize MCP governance under the same admins who own connected apps and profiles.
Seller prompt template: safe Monday pipeline briefing (read-only tier)
You are preparing my Monday pipeline briefing from Salesforce. Every Monday at 07:00 local: 1. Use the "Pipeline review" skill on my named accounts (owner = me, stage != Closed Lost, close date in current quarter). 2. Use the "Deal-health review" skill on the top 10 by amount. 3. Use the "Meeting preparation" skill for accounts I have a meeting with in the next 5 business days. Constraints (do NOT violate): - Read-only pass only. If any skill proposes a write (update stage, log activity, change amount) STOP and surface it as a draft in the output — do NOT dispatch it. - Do not log activities on my behalf. Do not update fields. - If a skill returns a field you cannot see under my profile, do not guess the value — flag it as "hidden by permissions". Produce a single briefing: - 3-bullet TL;DR - "Pipeline movement since last Monday" (opportunity-level, cite the Salesforce record IDs) - "Deals I should touch this week" (with why, from deal-health) - "Meetings this week" (with prep pack from meeting-preparation) - "Proposed writes (NOT DISPATCHED)" — every draft change the agent wanted to make, so I can review in one place.
Two things this prompt does that most 'copy this template' posts don't:
- It pins the pilot to read-only with an explicit "if the skill proposes a write, STOP" invariant. In a scheduled or long-running Claude session you can't answer a follow-up 'are you sure?' — invariants have to live in the prompt.
- It asks the model to surface every write it wanted to make in one place, so you can measure the recommend-tier accuracy of a skill before you promote it to write-tier. This is the cheapest way to earn the promotion.
The four traps that will bite you
Guided walkthrough1 of 4
- The same permission set that was mostly-fine behind a UI is genuinely dangerous behind an agent that can Dispatch 30 writes/minute. Fix: profile audit BEFORE pilot, not after.
- Dispatch PATCH is a normal Salesforce write. Every validation rule, Flow, Process Builder, Apex trigger, and CPU-time governor limit fires just like a human click. A well-meaning skill running in a loop can trip CPU limits or fan out unwanted Flow-driven emails. Fix: instrument your automation on the pilot org before turning on write-tier skills.
- Winter '27 production upgrades (Sept–Oct 2026) collide with the Claudeforce open beta. If a skill breaks in the middle of the window, you'll be debugging TWO simultaneous platform changes. Fix: pin API version on the plugin, and schedule the pilot cohort's Winter '27 upgrade OUTSIDE the beta window if you can.
- Because Slack uses client-credentials with an integration user, giving 'Slack access to Claudeforce' is not the same governance shape as giving individual users the plugin in Claude. Treat them as two separate rollouts with two separate audit trails.
Where Claudeforce sits relative to Agentforce
Salesforce has been shipping Agentforce since 2024 and Claude has been ONE of its foundation models since late 2025. Claudeforce doesn't replace Agentforce — it adds a new surface (the Claude app) and formalizes Claude across four Agentforce layers (Atlas Reasoning Engine, Agentforce Vibes, Agentforce Coworker, Agent Builder). Model optionality stays: Agent Builder still offers Amazon Nova alongside Claude.
Rough decision table for teams staring at both:
| You want to... | Reach for |
|---|---|
| Give sellers a chat interface that reasons over live CRM | Salesforce in Claude (the plugin) |
| Embed AI features INTO your Salesforce UI (records, list views, buttons) | Agentforce |
| Build a custom agent with tools, memory, escalation policies | Agent Builder (inside Salesforce) |
| Automate repeatable back-office CRM work end-to-end | Agentforce Coworker |
| Use Claude to write Salesforce code (Apex, LWC) | Agentforce Vibes |
If more than one row applies, the wrong choice is to pick one and force it — Claudeforce is designed so the plugin, Agentforce, and Agent Builder are complementary, and users can move between them within the same org.
When NOT to use Salesforce in Claude
- You need a machine-to-machine integration. The plugin is a human-in-the-loop chat surface. For unattended CRM writes at scale, wire the Headless 360 MCP Server into Managed Agents directly, without the Claude app in the middle.
- You already ship an Agentforce experience your sellers know. Adding a second surface fragments your training and doubles governance work. Pick the one your team lives in.
- You have zero Salesforce admins to govern this. The plugin makes the org more powerful and more reachable — that's a bad combo without someone owning profiles, permission sets, and MCP connections.
- Your compliance posture forbids inference over customer data. Even though the plugin routes inference through Amazon Bedrock inside the Salesforce Trust Boundary, prompt content and returned data still leave the storage layer. Read your DPA before piloting.
Quiz
Check yourself
0/4Sources & further reading
- Salesforce — Salesforce and Anthropic Announce Claudeforce (launch press release, Aug 26 2026)
- Salesforce Developers — Headless 360 (Beta) — Hosted MCP Servers reference (canonical 4-tool architecture)
- Salesforce Developers — Standard Servers reference (per-user auth, field-level security enforcement)
- Salesforce Developers Blog — Announcing the Headless 360 MCP Server Beta (July 2026 architecture launch)
- Anthropic — Claude Sonnet 5 permanent pricing (Aug 10 2026, $2/$10 confirmed permanent — the Sept 1 increase was cancelled)
- Related on AILmanac: Connectors (MCP) in the Apps · Cowork Scheduled Tasks · Skill.md Open Standard · Managed Agents · Managed Agents Domain Restrictions · Securing MCP Servers · MCP Tool Poisoning & Rug Pulls
Next
- Connectors (MCP) in the Apps — the general concept this plugin specializes
- Securing MCP Servers — the security patterns you should apply before opening the pilot
- Managed Agents — the API-side alternative when you need this without the Claude app in the loop