Salesforce’s Winter ’27 release exposes Agentforce agents as authenticated MCP tools

Salesforce is making Agentforce callable from external assistants rather than requiring every interaction to begin inside its own interface. The Winter ’27 developer update describes a two-way MCP connection that makes the identity of the caller central to what an external agent can do.

The official developer guide says eligible Agentforce agents can be exposed as tools on a custom Salesforce-hosted MCP server. Execution uses the authenticated user’s context, including sharing rules and field-level security. The guide identifies October 9 as the final scheduled release rollout, while directing customers to their organization’s maintenance schedule.

The builder requirement matters

Only agents built with the new Agent Script Builder can be exposed through this route, according to the guide. An older agent is therefore not automatically an externally callable tool. Teams also need to define its tool name, description and input schema carefully enough for another model to select it correctly.

This capability connects systems, but it does not prove that an external assistant will always choose the appropriate operation. A permissive user identity can still permit an unwanted change. Authentication and intent validation address different parts of the problem.

Test the smallest useful operation

A sensible integration would begin with a task-specific tool and a narrow user role, then inspect the resulting Salesforce record after execution. Ambiguous descriptions, missing inputs and retries should be part of that evaluation. They reveal whether the interface contract is reliable when the caller has incomplete context.

Salesforce’s release could let enterprises reuse existing agent logic across interfaces. The next evidence is a supported integration that preserves permissions and completes the intended CRM action without duplicate or overbroad changes.