Set Tool Restrictions for the Salesforce MCP Server

Tool restrictions control what Claude is allowed to do in your org through the Salesforce MCP connection. Most of these settings must be Always Allowed for skills to work at all. Setting Dispatch API to Deny is what keeps the Salesforce in Claude beta read-only: it blocks any tool that creates, updates, or deletes records, while the other settings still let skills discover, describe, and read your org's data.

1. After connecting, in Claude, go to Organization Settings > Connectors > Salesforce - Beta. Open the ... menu and select Tool Restrictions.
2. Set Dispatch API to Deny.
3. Set Dispatch read-only API to Always Allowed.
4. Set Discover to Always Allowed.
5. Set Describe to Always Allowed.
6. Set Display Widget (if available) to Always Allowed.
7. Leave all other tools as No Restriction.