Precursive MCP lets your users work with Precursive data from an AI assistant. This article covers common questions about information security and data privacy for Precursive MCP. For the Precursive PSA platform as a whole, see Precursive Security, Privacy and Architecture Overview.

What is Precursive MCP

This article covers Precursive MCP, which is part of the Precursive PSA platform and connects an assistant to Projects, Resources, Bookings, Tasks, and Timesheets. It does not cover the Precursive AI MCP Server, which connects an assistant to Zen Agents and Insights. For that server, see Precursive AI MCP Server security and data privacy.

Precursive MCP is a Salesforce Hosted MCP server. MCP (Model Context Protocol) is an open standard that lets an AI assistant call a defined set of tools. The server has these properties:

• It is created in your own Salesforce org, with an endpoint specific to your org on the Salesforce Hosted MCP service.
• It runs entirely on Salesforce infrastructure. Precursive operates no servers, gateways, or databases for it.
• It is off until a user with the Precursive Super User permission set sets it up in Precursive HQ, and an admin activates it in Setup.

Who supplies the AI

Precursive MCP provides the data interface only. Precursive supplies no large language model (LLM) for this feature.

Your organization connects an MCP-compatible assistant that it has already approved, such as Claude, Microsoft 365 Copilot, or Cursor. Your agreement with that vendor governs the following:

• Which model runs, and where it is hosted.
• How long the vendor keeps prompts and responses, and whether it uses them for training.
• Content safety, and the ownership and indemnity terms for generated output.

Precursive is not a party to your agreement with the AI vendor, and does not act as a processor or sub-processor for the model interaction.

What it costs

Precursive does not charge for access to, or usage of, Precursive MCP. Other parties can charge for their part:

• Salesforce can charge for usage of Salesforce Hosted MCP servers. Salesforce has not yet announced the pricing. See the Billing Considerations section of Salesforce Hosted MCP Servers.
• The vendor of your AI assistant can charge for usage under your plan with them.

How upgrades reach users

A package upgrade does not change the tools that users see until an admin updates them. After each upgrade, a user with the Precursive Super User permission set selects Update Tools on the MCP tab in Precursive HQ, then checks that the server is still active in Setup. You can review the changes before your users can call the updated tools.

How access to Precursive MCP is controlled

Access to Precursive MCP is controlled in three places. Salesforce decides who can sign in, Precursive applies the permissions of each user to every request, and the AI assistant has its own workspace settings.

How users sign in

Each user signs in to Precursive MCP individually, with their own Salesforce login. There is no shared login, service account, or integration user.

Sign-in uses an External Client App that your admin creates in your org. The app is set up as follows:

• It uses the OAuth 2.0 web server flow with PKCE (Proof Key for Code Exchange).
• It has no client secret. The Consumer Key is a public identifier, not a credential.
• The client credentials flow is off, so no token can be issued without a user signing in.
• It grants two OAuth scopes only: Access Salesforce hosted MCP servers (mcp_api) and Perform requests at any time (refresh_token, offline_access).

The token excludes the general api scope, so it cannot reach the Salesforce REST, Tooling, or Metadata APIs. Sharing the connector in your AI assistant shares only the server address and the app identifier. It grants no access on its own.

Your admin keeps control of the app with standard Salesforce settings:

• Pre-authorize only the profiles or permission sets that may use it. Users with the Use Any API Client permission bypass this setting.
• Apply your session policies, a refresh token policy, and an IP allowlist for refresh tokens.
• Review and revoke tokens for a user, or for all users, in External Client App OAuth Usage.

What a user can reach

Every tool runs as the signed-in user. Object permissions, field-level security, and sharing apply to every request, so a user reaches only the records and fields that they can open in Precursive. A field that the user cannot read is left out of the response.

There is no separate MCP permission set. The tools that a user can call follow the Precursive permission sets that you already assign, and a user without access to a tool cannot call it.

Precursive MCP calls the same Precursive services as the Precursive screens. When a change needs follow-on processing, such as rebuilding Resource availability, updating the Timesheet structure, or recalculating Project Budget and utilization rollups, Precursive runs that processing exactly as it does after the same change in Precursive. This processing never returns data to the assistant that the user cannot read.

What you control in the AI assistant

Some controls belong to the AI assistant, not to Salesforce. Review the following with the owner of your AI assistant:

• Who can add custom connectors in your workspace.
• Whether each tool needs approval before it runs. Require approval for tools that create or change records.
• Memory, chat retention, and model training settings.
• Which other connectors users can combine with Precursive MCP in the same conversation.

How Precursive MCP handles your data

Each request moves data between your org and the assistant of the user. The following sub-sections cover what is sent, what can change, which rules apply, how changes are recorded, and how the risks of AI output are limited.

What data goes to the assistant

Precursive MCP fetches data live, in response to each request. Precursive does not synchronize, index, or copy your data into any other store.

Any field that the user can read can be returned to the assistant, including names, email addresses, and rates. Once the data reaches the assistant, your agreement with the AI vendor and the data settings of the assistant govern how it is handled.

⚠️ Warning: Compliance-category filtering does not apply to Precursive MCP. Use field-level security to keep personal data from the assistant.

What it can change

An assistant can create and change only the kinds of record that the Precursive MCP tools support, within the permissions of the user. The tool set has the following limits:

• The tools are fixed. The assistant cannot add new operations.
• The standard create and update record tools are limited by the object and field permissions of the user.
• There is no general delete tool. The only delete tool removes Bookings, and only where Precursive allows it.

To give a group read-only use, assign them read-only Precursive permission sets. For the full list of what an assistant can and cannot do, see Precursive MCP Capabilities.

How business rules apply

Precursive applies the same rules to a change from an assistant as to a change in Precursive. The following apply to every write:

• Precursive validation and business rules, such as Booking and Timesheet checks, run for every write, whether it comes from Precursive, the API, a Flow, Data Loader, or MCP.
• Validation rules and triggers in your org run, and a change that fails them is not saved. The assistant receives the error message.
• Required fields set only on a page layout do not apply outside that layout. To enforce them for every write, convert them to validation rules.

The tool instructions also guide the assistant. When a value must come from a picklist, the assistant is asked to offer you the allowed values, not to save free text. After it creates or updates a record, the assistant is asked to read it back and confirm what was saved.

How changes are recorded

Precursive does not store prompts, responses, or tool calls. Each change runs under the login of the user, so Salesforce records it the same way as a change made in Precursive:

• Created By and Last Modified By show the user, not a service account.
• Field History Tracking keeps the old and new values of each tracked field.
• Login History in Setup shows each sign-in through the External Client App.

For more detail, see Precursive MCP Capabilities.

How it handles prompt injection and accuracy

An AI assistant can be misled by instructions hidden in the data it reads, and its answers can be wrong. Precursive MCP limits the impact as follows:

• The tools are fixed, and every call runs with the permissions of the user. An assistant cannot reach or change more than the user can.
• Business rules and validation rules run for every write, as described in How business rules apply.
• The safeguards inside the assistant, such as content filtering, belong to its vendor.

Require approval for write tools, and check the results before you rely on them.