Self-Hosted vs Hosted Salesforce MCP: How to Migrate Either Way
Salesforce's DX MCP server reaches end of life on November 2, 2026. Compare self-hosted and hosted Salesforce MCP, and migrate in either direction.
- Author
- Ignacio Malpartida · GTM Engineer
- Published
- Read time
- 6 min read
Should you run a self-hosted or a hosted Salesforce MCP server?
Short answer: For business data, move to Salesforce's hosted MCP servers. They have been generally available for Enterprise Edition orgs and above since April 29, 2026. Salesforce runs them, and every call runs under the signed-in user's permissions. Keep a self-hosted server only where the hosted servers can't go, such as unattended agents, because the hosted servers support no service accounts. Self-hosting doesn't avoid the new meter: Salesforce bills registered agent calls over MCP and direct APIs alike.
Timing matters: Salesforce's own DX MCP server reaches end of life on November 2, 2026. Facts checked October 24, 2026.
What are the options?
| Option | Who runs it | Status |
|---|---|---|
Salesforce hosted MCP servers (sobject-reads, sobject-all, Data 360, and others) | Salesforce | GA since April 29, 2026 for Enterprise Edition and above |
Salesforce DX MCP server (@salesforce/mcp) | You, on a laptop or server | End of life November 2, 2026 |
Community servers, such as smn2gnt/MCP-Salesforce and tsmztech/mcp-server-salesforce | You | Open source (MIT), maintained by individuals |
The DX server was built for developers: deploying metadata, running Apex tests, managing scratch orgs. Its data toolset also includes run_soql_query, which is why some teams pointed it at production data. The endpoint guide covers what the hosted servers expose.
How do self-hosted and hosted servers compare?
| Self-hosted | Salesforce hosted | |
|---|---|---|
| Hosting and updates | You run, patch, and secure it | Salesforce runs it |
| Authentication | Varies: CLI-authorized orgs, username and password, or OAuth client credentials | OAuth authorization code flow with PKCE through an External Client App |
| Identity | Often one shared integration identity | The signed-in user, later a registered agent |
| Permissions | Whatever the connecting identity can do | Field-level security, object permissions, and sharing rules on every call |
| Unattended agents | Possible with stored credentials | Not supported: no service accounts or machine-to-machine flows |
| Tools | Whatever the server's code exposes | Fixed standard tools plus Flows, Apex, and API Catalog entries you publish |
| HPI metering | Registered agent calls over the API are metered | Registered agent calls are metered |
What changes on November 2 for the DX MCP server?
Salesforce posted the end-of-life notice on October 5, 2026. After November 2:
- Salesforce stops maintaining it and ships no new releases.
- The GitHub repositories become read-only archives.
- The npm package is marked deprecated but stays installable, so pinned setups (version 0.30.15) keep working.
- Salesforce delivers its developer tooling as skills instead, in the
forcedotcom/sf-skillsrepository.
If you use it for metadata and testing, move to the skills on your own schedule. If you use it to query production records, move that work to the hosted servers. An unpatched local server holding production credentials is a liability.
How do you migrate from self-hosted to hosted?
- 01Find every self-hosted server. Check developer laptops and reps' AI clients for
@salesforce/mcpand community packages, and check which orgs and users they authenticate as. - 02Map the tools.
run_soql_querybecomessoqlQueryonsobject-reads. Record writes move tosobject-mutations. Custom logic becomes a Flow or Apex tool you publish. - 03Enable the servers. Standard servers ship disabled. An admin turns each one on in Setup.
- 04Create the External Client App with the
mcp_apiandrefresh_tokenscopes and PKCE. Allow up to 30 minutes before it becomes available. - 05Reconnect each client to the server URL and sign in as the user. Test in a sandbox first, at the
/sandbox/endpoint. - 06Remove the old credentials. Delete stored passwords and tokens from config files, and revoke the old app's access.
- 07Confirm the switch. In event logs, hosted MCP traffic shows
API_CLIENT_CATEGORY=SALESFORCE_HOSTED_MCP.
When should you go the other way?
Moving from hosted to self-hosted makes sense in one main case: an agent that runs with no user present, such as a nightly account-scoring job. The hosted servers need a signed-in user, so they can't serve it.
Before you build one, check two things. First, Salesforce's security guidance warns against building a custom proxy around its REST APIs in place of the hosted server. Second, if a model drives the job, it is still an agent: register it under Agentic Identity, and expect its API calls to be metered. See the Agentic Identity checklist.
Often the better fix is to take the agent off Salesforce for reads. A scheduled agent that scans thousands of accounts can query a synced database copy instead, and write back through a single Flow tool. Our guide to moving agent reads to a synced database walks through it.
Does either option cost less?
Neither changes the HPI rate. Salesforce meters every successful call from a registered agent, over MCP or the API. Salesforce's docs also say the hosted servers are intended for customers with Flex Credits and that usage may be billed. What changes the bill is the number of calls per task. Start with how to cut Salesforce agent costs and what stays off the HPI meter.
Sources
- Salesforce Developers Blog, Salesforce Hosted MCP Servers Are Now Generally Available (April 29, 2026)
- Salesforce Developers, Get Started with Hosted MCP Servers
- Salesforce Developers, Create an External Client App
- Salesforce Developers, Security Best Practices for Hosted MCP Servers
- Salesforce Developers, Hosted MCP Servers Best Practices
- Salesforce Developers, Standard MCP Servers Reference
- GitHub, salesforcecli/mcp: Salesforce DX MCP Server (end-of-life notice added October 5, 2026)
- GitHub, forcedotcom/mcp issue #46: DX MCP server end of life (October 5, 2026)
- Salesforce Help, Understand AIforce Impact (Knowledge Article 005360285)
- Salesforce Ben, Salesforce Will Charge Flex Credits for Agentic MCP and API Calls (September 24, 2026)
FAQ
Frequently asked questions
Related articles
