Cursor plugin that connects agents to Salesforce's Headless 360 MCP server (Beta), part of Salesforce Hosted MCP.

Headless 360 gives agents access across Salesforce through four tools backed by a growing library of Salesforce operations. Agents can query, create, and update records; manage users, permission sets, and permission set licenses; work with Apex triggers, platform events, and Change Data Capture; set up named credentials; and manage Commerce Cloud orders. Every call runs as the signed-in user, with that user's object permissions, field-level security, and sharing rules.

This plugin is separate from the salesforce plugin, which connects to the SObject and custom Hosted MCP servers. Both can be installed at the same time.

1. Open Cursor Settings → Plugins.
2. Search for Salesforce (Headless 360, Beta).
3. Click Install. If your admin has configured the plugin for your team, complete the Salesforce sign-in prompt. If you're asked for a server URL, Consumer Key, and Consumer Secret, ask your Salesforce admin to configure the plugin for the team first.

{
  "mcpServers": {
    "salesforce-headless-360": {
      "type": "http",
      "url": "${SALESFORCE_MCP_URL}",
      "auth": {
        "CLIENT_ID": "${CLIENT_ID}",
        "CLIENT_SECRET": "${CLIENT_SECRET}",
        "scopes": ["mcp_api", "refresh_token"]
      }
    }
  }
}

Headless 360 needs API version 67.0 or later. From Setup, enter MCP Servers in Quick Find, select MCP Servers, find headless-360, and click Activate.

From Setup, go to External Client App Manager → New External Client App, fill in the basics, then expand API (Enable OAuth Settings) and check Enable OAuth. Connected Apps are not supported.

Add every callback URL Cursor and Grok Bot use:

Under OAuth Scopes, select exactly these two and nothing broader:

• Access Salesforce hosted MCP servers (mcp_api)
• Perform requests at any time (refresh_token, offline_access)

The second one is easy to miss because the picker labels scopes by description rather than by value. Without it, members have to sign in again every time their access token expires. Do not add Full access (full).

Under Security:

• Select Issue JSON Web Token (JWT)-based access tokens for named users. Without it, Salesforce issues opaque tokens and every tool call fails with JWT Token is required.
• Keep Require Proof Key for Code Exchange (PKCE) and Require Secret for Web Server Flow on.
• Do not enable the JWT Bearer Flow, which is a different feature and needs a certificate.

Copy the Consumer Key and Consumer Secret from Settings → Consumer Key and Secret.

A new External Client App can take up to 30 minutes to propagate. Until it does, sign-in fails with invalid_client_id; wait rather than recreating the app.

In Dashboard → Plugins → Configure, set these on your team marketplace:

Members then skip setup and go straight to the Salesforce sign-in. The secret is masked in the settings UI. Cursor still delivers it to each member's client, because desktop clients run the sign-in themselves.

dispatch can change org configuration or data, for example creating or deactivating users, assigning permission sets, or deploying Apex. Configure your client to ask for approval before it runs dispatch, and let dispatch_readonly run without approval. Try configuration changes in a sandbox or Developer org before production.

• Headless 360 MCP server: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/references/reference/headless-360-mcp.html
• Create an External Client App: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/create-external-client-app.html
• Configure Cursor: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/cursor.html

MIT