Salesforce Headless 360
BetaHeadless Salesforce org admin & integration via a discover/describe/dispatch meta-tool surface — users, Apex deploy, platform events, CDC, named credentials — governed by the org security model.
How it works
Every agent request passes through Ferentin policy before it reaches Salesforce Headless 360.- AI agentAsks for something
- Ferentin policies
- OAuth 2.0 PKCE
- Field level security
- Object permissions
- Sharing rules
- Salesforce Headless 360 MCP serverAuthorized connection
- Governed resultMasked, logged, returned
What you can do with Salesforce Headless 360
- Operation discovery
- Operation describe
- Operation dispatch
- Read only dispatch
- User management
- Apex deployment
- Platform events
- Change data capture
- Named credentials
- Org security enforcement
Overview
Headless 360 is Salesforce's hosted MCP server for headless setup and integration. Instead of thousands of per-capability tools, it presents an agent with four meta-tools — discover, describe, dispatch, and dispatch_readonly — that fan out to ~100 skills covering user management, Apex trigger deployment, platform events, Change Data Capture, and named-credential configuration.
Ferentin integration
Runs on Salesforce infrastructure as a Hosted MCP Server over Streamable HTTP. Every transaction executes as the authenticated user via an External Client App with the mcp_api scope, and respects the full org security model: field-level security, object permissions, sharing rules, profiles, and permission sets. The dispatch / dispatch_readonly split lets policy restrict an agent to read-only operations. This is the admin/DevOps companion to the sobject-* CRM-data hosted servers on the salesforce card.
Frequently asked about Salesforce Headless 360
- What can AI agents do with Salesforce Headless 360 through Ferentin?
- Through Ferentin, agents can use Salesforce Headless 360 for operation discovery, operation describe, operation dispatch, read only dispatch, user management, apex deployment, platform events, change data capture, named credentials and org security enforcement. Every call is checked against your Ferentin policies first.
- How does Ferentin secure Salesforce Headless 360 access?
- Requests through the Salesforce Headless 360 integration are covered by OAuth 2.0 PKCE, field level security, object permissions, sharing rules, permission sets, jwt access tokens, per user authorization and read only dispatch scoping. These controls are applied by Ferentin, not by Salesforce Headless 360, so they hold across every connected agent.
- What permissions does the Salesforce Headless 360 integration require?
- The Salesforce Headless 360 integration requests 2 OAuth 2.0 scopes: mcp_api; refresh_token
- How do I connect Salesforce Headless 360 to Ferentin?
- Open the Ferentin admin console, add Salesforce Headless 360 as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
- Is the Salesforce Headless 360 integration generally available?
- The Salesforce Headless 360 integration is currently beta on Ferentin.