The Precursive AI MCP Server lets your users work with Zen Agents and Insights from an AI assistant. This article covers common questions about information security and data privacy for the Precursive AI MCP Server. For Precursive AI as a whole, see Precursive AI data privacy and security.

What is the Precursive AI MCP Server

This article covers the Precursive AI MCP Server, which is part of Precursive AI and connects an assistant to Zen Agents, Insights, and the data behind them. It does not cover Precursive MCP, which connects an assistant to Projects, Resources, Bookings, Tasks, and Timesheets. For that server, see Precursive MCP security and data privacy.

The Precursive AI MCP Server is a Salesforce Hosted MCP server. MCP (Model Context Protocol) is an open standard that lets an AI assistant call a defined set of tools. The server has these properties:

• It is created in your own Salesforce org, on the Salesforce Hosted MCP service.
• It runs entirely on Salesforce infrastructure. Precursive operates no servers, gateways, or databases for it.
• It is off until a user with the Precursive AI Admin permission set deploys it from Precursive AI Settings.

Who supplies the AI

The Precursive AI MCP Server connects an assistant that you choose to Precursive AI. Precursive AI uses its own models only to generate Insights, as described in Precursive AI data privacy and security. The assistant itself is supplied by your vendor.

Your organization connects an MCP-compatible assistant that it has already approved, such as Claude. Your agreement with that vendor governs the following:

• Which model runs, and where it is hosted.
• How long the vendor keeps prompts and responses, and whether it uses them for training.
• Content safety, and the ownership and indemnity terms for generated output.

Precursive is not a party to your agreement with the AI vendor, and does not act as a processor or sub-processor for the interaction between the user and the assistant.

What it costs

Precursive does not charge for access to, or usage of, the Precursive AI MCP Server. Other parties can charge for their part:

• A Zen Agent run started from the assistant counts against your Precursive AI entitlements, the same as any other run.
• Salesforce can charge for usage of Salesforce Hosted MCP servers. Salesforce has not yet announced the pricing. See the Billing Considerations section of Salesforce Hosted MCP Servers.
• The vendor of your AI assistant can charge for usage under your plan with them.

How upgrades reach users

A package upgrade does not change the tools that users see until an admin updates them. After each upgrade, a user with the Precursive AI Admin permission set selects Update Tools in Precursive AI Settings > External Services > Precursive AI MCP Server. You can review the changes before your users can call the updated tools.

How access to the Precursive AI MCP Server is controlled

Access to the Precursive AI MCP Server is controlled in three places. Salesforce decides who can sign in, Precursive AI applies the permissions of each user to every request, and the AI assistant has its own workspace settings.

How users sign in

Each user signs in to the Precursive AI MCP Server individually, with their own Salesforce login. There is no shared login, service account, or integration user.

Sign-in uses an External Client App that your admin creates in your org. The app is set up as follows:

• It uses the OAuth 2.0 web server flow with PKCE (Proof Key for Code Exchange).
• It has no client secret. The Consumer Key is a public identifier, not a credential.
• The client credentials flow is off, so no token can be issued without a user signing in.
• It grants two OAuth scopes only: Access MCP servers (mcp_api) and Perform requests at any time (refresh_token).

The token excludes the general api scope, so it cannot reach the Salesforce REST, Tooling, or Metadata APIs. Sharing the connector in your AI assistant shares only the server address and the app identifier. It grants no access on its own.

Your admin keeps control of the app with standard Salesforce settings:

• Pre-authorize only the profiles or permission sets that may use it. Users with the Use Any API Client permission bypass this setting.
• Apply your session policies, a refresh token policy, and an IP allowlist for refresh tokens.
• Review and revoke tokens for a user, or for all users, in External Client App OAuth Usage.

What a user can reach

Every tool runs as the signed-in user. Object permissions, field-level security, and sharing apply to every request, so a user reaches only the records and fields that they can open in Salesforce. A field that the user cannot read is left out of the response.

There is no separate MCP permission set. The Precursive AI Standard, Precursive AI Insights Builder, and Precursive AI Admin permission sets give access to the tools.

Insights follow the same access rules as on the record page. When a user asks about an Insight that they have not opened before, the tools run the same access check as the record page and return the Insight only if the user passes. A user who can open an Insight, including through System Mode, receives all the context data stored with it.

What you control in the AI assistant

Some controls belong to the AI assistant, not to Salesforce. Review the following with the owner of your AI assistant:

• Who can add custom connectors in your workspace.
• Whether each tool needs approval before it runs. Require approval for the Action tools that run Zen Agents.
• Memory, chat retention, and model training settings.
• Which other connectors users can combine with the Precursive AI MCP Server in the same conversation.

How the Precursive AI MCP Server handles your data

Each request moves data between your org and the assistant of the user. The following sub-sections cover what is sent, what can change, which rules apply, how activity is recorded, and how the risks of AI output are limited.

What data goes to the assistant

The Precursive AI MCP Server fetches data live, in response to each request. Precursive does not synchronize, index, or copy your data into any other store.

Any field that the user can read can be returned to the assistant, including names, email addresses, and rates. Once the data reaches the assistant, your agreement with the AI vendor and the data settings of the assistant govern how it is handled.

Two further points apply to Precursive AI:

• When the assistant runs a Zen Agent, Precursive AI generates the Insight as described in Precursive AI data privacy and security. The context goes through the LLM gateway, with compliance-category filtering, and the resulting Insight is then returned to the assistant.
• The Continue in menu on an Insight opens the assistant with a link that carries record identifiers only. The assistant then fetches the data itself, with the Salesforce login of the user.

⚠️ Warning: Compliance-category filtering does not apply to what the server returns to the assistant. Use field-level security to keep personal data from the assistant.

What it can change

An assistant can read Precursive AI data and generate new Insights, within the permissions of the user. The tool set has the following limits:

• The tools are fixed. The assistant cannot add new operations.
• The standard tools only read data.
• Two Action tools run a Zen Agent to generate a new Insight, or refresh the context data of a Zen Agent for one record. They write only Precursive AI data.
• No tool creates, edits, or deletes your Salesforce business records.

For the full list of tools, see Set up the Precursive AI MCP Server. For what your users can do with them, see Connecting Claude to Precursive AI.

How business rules apply

The Precursive AI MCP Server does not create or change your Salesforce business records, so your validation rules and business rules are never bypassed through it. Recommended actions are applied from the Precursive AI component, where the controls described in Precursive AI data privacy and security apply.

How changes are recorded

Precursive does not store prompts, responses, or tool calls. Agent runs, Insights, and context data that the assistant creates are stored in your org, as described in the Logging and audit section of Precursive AI data privacy and security. Login History in Setup shows each sign-in through the External Client App.

How it handles prompt injection and accuracy

An AI assistant can be misled by instructions hidden in the data it reads, and its answers can be wrong. The Precursive AI MCP Server limits the impact as follows:

• The tools are fixed, and every call runs with the permissions of the user. An assistant cannot reach more than the user can.
• No tool changes business records, and Insights are generated with the AI risk controls described in Precursive AI data privacy and security.
• The safeguards inside the assistant, such as content filtering, belong to its vendor.

Check the answers of the assistant against the cited records before you rely on them.