The Pulse

Reco says Salesforce’s Headless 360 can extend agents’ reach

A Reco security researcher says Salesforce’s Headless 360 MCP server lets agents discover operations while acting with the connected user’s permissions. The server remains in beta, and Salesforce says its existing access controls apply to transactions.

AI.info Team · · fact-checked · against 4 sources ↓ · Published 12 Nov 2026

Salesforce’s Headless 360 MCP server lets AI agents discover operations and act with the permissions of the person who connected them, potentially giving those agents access beyond that person’s routine work. In an analysis published November 12, Reco senior security researcher Nitay Bachrach says the server’s expanding operation library makes that reach difficult to assess in advance.

The server is a beta service. Salesforce says object permissions, field-level security, sharing rules, profiles and permission sets apply to each transaction, and actions appear in the audit trail under the authenticated user.

Four tools, many operations

Headless 360 exposes four tools for finding, inspecting and running operations: discover, describe, dispatch and a read-only version of dispatch. The operations can include querying, creating and updating records, as well as reading, writing and deploying Apex triggers.

They also include managing users, creating named credentials and building event-driven integrations. Administrators must activate the server, and a connection requires an External Client App with the relevant scopes.

The discovery tool searches for operations against a natural-language request and returns ranked candidates. Results can include individual API operations or multi-step Setup Operation Recipes, which contain dependencies and guidance for the agent.

A look at a discovery call

In one call described in the analysis, a search for data in a grid worksheet built by Agentforce returned ten ranked results. The highest-ranked result was an Agentforce Grid workflow with 60 steps.

Its recipe contained 29 read, 18 write, 8 verify, 4 delete and 1 validate steps. The listed preconditions included an active Agentforce Grid entitlement and appropriate user permissions to manage workbooks and worksheets.

According to Bachrach, the operations available to an agent are assembled at call time rather than fixed when the client connects. Salesforce describes the operation library as continuously growing, while the exposed set of tools remains small.

Permissions and choices

Reco argues that this makes the integration harder to review as a fixed scope: discovery returns a ranked shortlist rather than a complete manifest. Bachrach also points to a query-generation operation whose declared access checks do not describe the account data a subsequently generated query might read.

The researcher describes a scenario in which an agent asked to give someone access to a record could create a share or widen the organization-wide default for the whole object. Those broader changes require their own permissions, but the analysis argues that permission alone does not establish which permitted route is appropriate for a particular request.

Salesforce recommends configuring MCP clients to ask for approval before running a tool that changes organization configuration or alters or deletes data. Reco notes that destructive operations are carried inside dispatch, so a client-side gate on that tool applies to dispatch as a whole rather than to each operation separately.

The firm says it offers a runtime policy service that identifies what an agent’s call is about to do and stops actions a customer’s policy would not allow. Its analysis says the server’s tool names, schemas and URLs may change at general availability.