AgentDrives
Free check
Salesforcesalesforce.com

Can an AI agent use Salesforce?

As of 6 Oct 2026, an AI agent gets into Salesforce on its own and does 30% of the core work.

Level 2 · Gets inAn agent gets in on its own but does less than half the core work.

To reach L3 · Does the work: do half of the core work (now 30%).

With an account set up by a person: not measured yet.

Got in on 1 of 2 drives: the bot check let it through in some and not in others.

What the levels mean
Visit Salesforce Follow changes

Driven 6 Oct 2026New level in the latest driveRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

  • Agents on a serverGet in on their own.
  • Signed agentsThe sign-up page opens.
  • Agents in a person's browserNot measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Salesforce.

On its own

  • Create and update leads, customer accounts, contacts, deals and support cases, and read every change back
  • Process many records at once in a single batch job
  • Deploy and run custom code and simple automations
1 more
  • Turn on and use the quoting feature even though it's off by default

What it can't, and why

  • Read the official developer documentation on its ownthe docs site blocks our agent outright
  • Sign up through the main developer sign-up forma picture puzzle appears after submitting
  • Start a sales trialit requires a phone number
3 more
  • Use the official AI-agent connector (MCP)it needs a special credential only an administrator can create by hand
  • Close the account it openeda picture puzzle blocks the deletion step
  • Pay for a paid plan by itselfthere is no automated payment option; only a sales contact or a human checkout
On its own, in a browser

Can an AI agent sign up for Salesforce on its own?

Yes, in a browser, without a human. Web form only. Developer Edition form: reCAPTCHA image puzzle on submit. Enterprise and Starter trials need a phone number. What worked: Trailblazer account by email code, then a free Trailhead Playground (Developer Edition org) from trailhead.salesforce.com, no CAPTCHA, no phone.

Official server · no call worked

Does Salesforce have an MCP server, and can an agent connect to it?

Yes. Salesforce has an official MCP server.

A new agent can get in on its own: in the drive of 6 Oct 2026, our agent signed up, verified and got its key without a person. Through the MCP server, 0 of our agent's 1 attempt worked.

What the drive found

API–OpenAPIMCP · officialCLI–SDK–llms.txt–WebhooksSandbox
On its own, in a browser

How does an AI agent get a Salesforce API key?

In the drive of 6 Oct 2026, our agent got its Salesforce API key in a browser, without a person. OAuth web-server flow with PKCE using the Salesforce CLI's public client (PlatformCLI) on the org's My Domain; the consent page needs a browser session. Device flow for PlatformCLI is disabled ('device flow is not enabled for the app'); DCR endpoint needs client credentials.

Needs a person

Can an AI agent delete its Salesforce account?

Not on its own: needs a human. Records deleted via REST and token revoked headless. Deleting the Trailblazer account is web-only and shows a reCAPTCHA image puzzle after 'Continue', so the account remains. No delete option for the playground org seen (Rename/Disconnect only).

Needs a person to buy

Can an AI agent pay for Salesforce?

A person has to buy: a phone number at checkout.

Ways to pay found: Web checkout after trial or sales contact.

No card needed to start.

What would let agents pay on their own
  1. Accept x402 or MPP on your API. Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card.Step-by-step guide
  2. List your plans on Stripe Projects. Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev).Step-by-step guide

No x402/MPP/L402/UCP; no 402 anywhere probed; no registry listings. Starter/Pro Suite trials are 'No credit card required' but need a phone number; paid plans via web checkout or 'Contact us'. is our reading: a human (phone) is needed before any purchase; checkout itself not seen.

From the drive of 6 Oct 2026.

For the team behind Salesforce.

Where agents stop in Salesforce today, and the fixes that get them further, highest impact first.

Wall at docs

The fixes, highest impact first

  1. Let verified agents read the developer docsStep-by-step guide
  2. Offer a headless Developer Edition sign-upStep-by-step guide
  3. Enable device flow for the CLI clientStep-by-step guide
2 more fixes
  1. Drop the CAPTCHA from account deletion Step-by-step guide
  2. Document an agent path to hosted MCP
  • Claim it free and reply next to the result.
  • A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
  • Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Get a DriveClaim it free
See the example report
Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

Driven · L2 · Gets in badge

Behind the level.

The part scores and the measures behind them.

Part scores and the measures · level history

Part scores

Agent-ready setup

  • llms.txt
  • OpenAPI
  • MCP server
  • CLI

Not measured in this drive: Holds up, Docs match (part of an Audit).

The measures

  1. Work done30
  2. Reliability100
  3. Crash test–

Level history

  1. 1 Oct 2026L1Needs a person
  2. 6 Oct 2026new driveL2Gets in

For agents and builders.

The drive as data, every checkpoint and all 34 attempts.

How an agent connects · 5 tips

/api/tools/salesforce.json/tools/salesforce.mdMCP get_tool {"slug":"salesforce"}

  • Skip the Developer Edition form (reCAPTCHA): make a Trailblazer account by email code, then create a Trailhead Playground on trailhead.salesforce.com/users/profiles/orgs
  • Get a token with the CLI's public client PlatformCLI (web-server flow + PKCE) on the org's My Domain; then `sf org login access-token` for the CLI
  • Quotes and other features are off by default: enable them with a Settings metadata deploy
  • Errors are JSON arrays with errorCode and fields; a 404 NOT_FOUND on an sObject usually means the feature is off
  • Bulk API 2.0 and composite/sobjects work for multi-record changes; Developer Edition gives 15000 API calls a day
Every checkpoint, in detail · 9 checkpoints
  1. DocsBlockeddeveloper.salesforce.com (REST guide, hosted MCP guide, llms.txt) answered 403 to our signed agent (Akamai); www.salesforce.com went from 200 to 403 Access Denied after ~10 requests. Docs were only reachable through a web search tool.
  2. Sign upIn a browserWeb form only. Developer Edition form: reCAPTCHA image puzzle on submit. Enterprise and Starter trials need a phone number. What worked: Trailblazer account by email code, then a free Trailhead Playground (Developer Edition org) from trailhead.salesforce.com, no CAPTCHA, no phone.
  3. VerifyIn a browser6-digit single-use code by mail from noreply@verification.salesforce.com, arrived within a minute, typed into the web page.
  4. KeyIn a browserOAuth web-server flow with PKCE using the Salesforce CLI's public client (PlatformCLI) on the org's My Domain; the consent page needs a browser session. Device flow for PlatformCLI is disabled ('device flow is not enabled for the app'); DCR endpoint needs client credentials.
  5. First callHeadlessGET /services/data/ and /limits 200 with the bearer token (API v67.0, 15000 daily API requests).
  6. First actionHeadlessPOST /services/data/v67.0/sobjects/Lead 201.
  7. PayBlockedNo x402/MPP/L402/UCP; no 402 anywhere probed; no registry listings. Starter/Pro Suite trials are 'No credit card required' but need a phone number; paid plans via web checkout or 'Contact us'. is our reading: a human (phone) is needed before any purchase; checkout itself not seen.
  8. CancelNot neededNothing to cancel: our agent started no paid plan.
  9. DeleteNeeds a humanRecords deleted via REST and token revoked headless. Deleting the Trailblazer account is web-only and shows a reCAPTCHA image puzzle after 'Continue', so the account remains. No delete option for the playground org seen (Rename/Disconnect only).
The attempt log · 34 attempts
CapabilityRouteResultEvidence
robots.txt / aipref: Fetch www.salesforce.com/robots.txt and look for Content-Usage / Content-signalapipartial ✓First GET 200 text/plain 14256 bytes ('# Robots.txt file for http://www.salesforce.com # All robots will spider the domain', Sitemap lines). Body not kept; refetch a minute later 403 Akamai 'Access Denied'.
llms.txt: GET /llms.txt on www and developer.salesforce.comapifailed ✓www.salesforce.com/llms.txt 302 then 403 (HEAD); developer.salesforce.com/llms.txt 403 text/html (Salesforce Developers error page, akamai-grn header)
well-known cards: GET /.well-known/ai-catalog.json, agent-card.json, agent.json, ucp, /auth.md, /SKILL.md on www.salesforce.comapifailed ✓ai-catalog.json 302 then 404 on HEAD; agent-card.json 403; agent.json 403; ucp 403; auth.md 403; SKILL.md 403 (all Akamai Access Denied HTML)
OAuth metadata: GET PRM on api.salesforce.com and AS metadata on login.salesforce.comapidone ✓https://api.salesforce.com/.well-known/oauth-protected-resource 200 application/json {resource: https://api.salesforce.com, authorization_servers:[https://login.salesforce.com], scopes_supported:[api,sfap_api,refresh_token,einstein_gpt_api]}; login.salesforce.com/.well-known/oauth-authorization-server 404 HTML 'URL No Longer Exists'; /.well-known/openid-configuration 200 JSON
Docs: Fetch developer docs headless (REST API guide, hosted MCP servers guide, developer home)apiblocked ✓developer.salesforce.com/, /docs/atlas.en-us.api_rest.meta/api_rest/intro_rest.htm, /docs/platform/hosted-mcp-servers/guide/... all 403 text/html 2436 bytes (Salesforce Developers error page served by Akamai, akamai-grn header, server-timing cdn-cache HIT)
Sign up: Sign up for a free Developer Edition org headlessapiblocked ✓GET https://developer.salesforce.com/signup 403 (Akamai, Salesforce Developers error page); GET https://www.salesforce.com/form/developer-signup/?d=pb 403 Akamai 'Access Denied' (server: AkamaiGHost)
Sign up: Sign up for a free Developer Edition org in the browserbrowserfailed ✓Filled with test identity, clicked 'Sign me up' -> reCAPTCHA image puzzle 'Select all squares with buses' (visible_challenge true), button 'Please wait..'. Screenshot browser/shots/012.png
Sign up: Alternative: Sales Cloud Enterprise Edition 30-day free trial form in the browserbrowserfailed ✓form labels: First name, Last name, Job title, Company, Company size, Country/region, Email, Phone, I agree...
Sign up: Create a Trailblazer account via the Starter Suite free-trial route ('No credit card required') in the browserbrowserdone ✓Starter free trial link -> tbid.digital.salesforce.com 'Let's get you into your Starter free trial' (Business email or Continue with Google). Entered the agent's inbox -> iis.digital.salesforce.com/services/trailblazer/verify 'Check your inbox for your single-use code' -> code mail -> 'Where are you located?' (country + agree box) -> https://www.salesforce.com/trailblazer/complete?offerId=free-trial-00005820 'Sign Up - Confirmation'
Verify email: Verify the email with the 6-digit single-use codebrowserdone ✓Mail 'Here's your verification code' from noreply@verification.salesforce.com arrived within ~1 min (09:16:03 and 09:17:46 UTC, 09:20 for the third run); code entered on iis.digital.salesforce.com/services/trailblazer/verify; flow continued to the country step.
Sign up: Finish the Starter Suite 30-day trial org sign-up (org provisioning step)browserfailed ✓Form 'Let's get you signed up for your 30-day trial!' needs First name, Last name, Job title, Company, Company size, Phone. Submitted without phone -> field error 'Enter valid phone number.' (screenshot browser/shots/nophone.png)
Sign up: Get a free Developer Edition org (Trailhead Playground) with the verified Trailblazer accountbrowserdone ✓Trailblazer profile step 'One last thing.' (names, company, role Developer, relationship Non-Customer / Prospect) -> trailhead.salesforce.com/users/profiles/orgs -> Create Playground -> 'Cunning Otter Playground', Organization ID [redacted], Type Trailhead Playground, My Domain mindful-raccoon-ahz7nx-dev-ed.trailblaze.my.salesforce.com, user [redacted]
API credentials: Get an OAuth token for the org with the Salesforce CLI's public client (PlatformCLI, web-server flow + PKCE)browserdone ✓`sf org login web` printed authorize URL (client_id=PlatformCLI, redirect localhost:1717). Our sandbox blocks loopback connections, so we ran the same documented flow ourselves: authorize in the browser on the org's My Domain ('Salesforce CLI ... Allow Access?') -> code -> POST /services/oauth2/token with code_verifier -> 200 {token_type: Bearer, scope: 'refresh_token web api', instance_url: [redacted]}
First API call: GET /services/data/ and /limits with the bearer tokenapidone ✓GET /services/data/ 200, versions up to 67.0 'Summer '26'; GET /services/data/v66.0/limits 200 DailyApiRequests Max 15000 Remaining 14999
First real action: Create a Lead via RESTapidone ✓POST /services/data/v67.0/sobjects/Lead 201 id 00QWU00000gcYoU2AU
Capture and manage leads, accounts and contacts: Create a Lead, an Account and a Contact under it, read them backapidone ✓POST sobjects/Lead 201 00QWU00000gcYoU2AU; Account 201 001WU00002FbuuSYAR; Contact 201 003WU00001pZNiDYAW; SOQL Account with Contacts subquery 200 totalSize 1; GET Lead 200 Status 'Open - Not Contacted'
Manage opportunities and sales pipeline: Create an Opportunity, move it to Negotiation/Review and raise the amount, read backapidone ✓POST sobjects/Opportunity 201 006WU00000TFDPHYA5; PATCH 204; GET StageName 'Negotiation/Review' Amount 2500.0. Missing fields -> 400 REQUIRED_FIELD_MISSING fields [StageName, CloseDate]
Create, track and resolve support cases: Open a Case for the contact, close it, read backapidone ✓POST sobjects/Case 201 500WU00002uRq35YAC; PATCH Status Closed 204; GET Status Closed IsClosed true CaseNumber 00001026
Query and export records (SOQL): SOQL query with a child subqueryapidone ✓GET /query?q=SELECT Id,Name,(SELECT Id,LastName FROM Contacts) FROM Account WHERE Id=... 200 totalSize 1 done true
Bulk insert/update/delete large record sets: Bulk API 2.0 ingest job inserting 2 Leads from CSVapidone ✓POST /jobs/ingest 200 id 750WU00000x6KoUYAU state Open; PUT batches 201; PATCH UploadComplete 200; GET job state JobComplete numberRecordsProcessed 2 numberRecordsFailed 0; SOQL Lead LIKE 'AgentDrives Bulk%' totalSize 2
Manage service contracts and entitlements: Create an Entitlement on the account, read backapidone ✓POST sobjects/Entitlement 201 550WU00000x6RtBYAU; GET Name 'AgentDrives entitlement' Status Inactive
Generate and send sales quotes: Create a Quote on the opportunityapifailed ✓POST sobjects/Quote 404 [{errorCode: NOT_FOUND, message: 'The requested resource does not exist'}] (Quotes off by default)
Generate and send sales quotes: Enable Quotes via Metadata API (QuoteSettings enableQuote) and create a Quoteclipartial ✓sf project deploy start: Settings Quote state Changed, Succeeded; POST sobjects/Quote 201 0Q0WU000003FxHN0A0; GET Name 'AgentDrives quote' Status Draft OpportunityId 006WU00000TFDPHYA5
Deploy custom code (Apex classes/triggers, LWC): Deploy an Apex class with the sf CLI and run itclidone ✓sf project deploy start --source-dir force-app: ApexClass AgentDrivesHello Created; tooling query ApexClass 200 totalSize 1; tooling/executeAnonymous assertEquals('Hello X', greet('X')) compiled true success true
Automate business processes with Flow (declarative, no-code): Deploy an autolaunched Flow that closes a Case and invoke itclidone ✓Flow AgentDrives_Close_Case Created (deploy Succeeded); POST /actions/custom/flow/AgentDrives_Close_Case isSuccess true; GET Case 500WU00002uSmd9YAC Status Closed
Forecast revenue and pipeline: Read forecasting itemsapifailed ✓SOQL SELECT Id FROM ForecastingItem -> 400 "sObject type 'ForecastingItem' is not supported"
Route cases across channels with omni-channel: Describe PendingServiceRoutingapifailed ✓GET sobjects/PendingServiceRouting/describe 404 NOT_FOUND
Publish and browse self-service knowledge articles: Describe Knowledge__kavapifailed ✓GET sobjects/Knowledge__kav/describe 404 NOT_FOUND
Hosted MCP server: server/discover on https://api.salesforce.com/platform/mcp/v1/platform/sobject-all, without and with our OAuth tokenmcpfailed ✓No auth: 401 text/plain {errors:[{message:'JWT Token is required'}]}, no WWW-Authenticate header. Path-suffixed PRM https://api.salesforce.com/.well-known/oauth-protected-resource/platform/mcp/v1/platform/sobject-all 200 {authorization_servers:[https://login.salesforce.com], scopes_supported:[mcp_api, refresh_token]}. With the CLI's opaque token: 401 {errors:[{message:'Invalid token'}]}. /server-card 401.
Build and configure an autonomous AI agent (topics, actions): Check for Agentforce agent metadata in the orgapifailed ✓GET sobjects/BotDefinition/describe 404 NOT_FOUND; SOQL FROM BotDefinition 400 "sObject type 'BotDefinition' is not supported"
Delete data and account: Delete every record we created via REST, revoke the OAuth tokenapidone ✓DELETE /composite/sobjects (lead, contact, 2 cases, quote, entitlement, opportunity, 2 bulk leads) 200; DELETE Account 204; follow-up SOQL for Account/Contact/Quote totalSize 0; POST /services/oauth2/revoke 200, token then 401 INVALID_SESSION_ID
Delete data and account: Delete the Trailblazer account (Settings > Account Deletion) in the browserbrowserfailed ✓https://www.salesforce.com/trailblazer/settings/account-deletion: ticked 'I understand that deleting my account is permanent and can't be undone.', Continue -> reCAPTCHA image puzzle 'Select all images with a fire hydrant' (browser/shots/del3.png).
Pay step: Probe agent payment rails and the self-serve purchase pathapidone ✓x402.salesforce.com, mpp.salesforce.com, agents.salesforce.com: no connection (curl 000); unauthenticated REST /services/data on login.salesforce.com 400 URL_NOT_RESET, MCP 401 'JWT Token is required' (no 402, no PAYMENT-REQUIRED, no WWW-Authenticate: Payment/L402); /.well-known/ucp 403 Akamai; CDP x402 Bazaar and mpp.dev/api/services contain no 'salesforce'. Pricing page (browser): Starter Suite $25 and Pro Suite $100 USD/user/month with 'Try for free'; Core/Advanced 'Try for free'; Max 'Contact us'. Starter trial says 'No credit card required' but needs a phone number.
Cancel: Cancel a plannoneskippedNo paid plan or trial was started (trial org creation needs a phone number; the Developer Edition playground is free)

Also in CRM.

All of CRM, by level