Salesforce turns 200-plus Data 360 APIs into MCP endpoints, and governance into a grant decision

Salesforce has extended Headless Data 360 to the Model Context Protocol, exposing more than 200 existing Data 360 APIs as programmable endpoints that AI agents can invoke directly rather than through a user interface ^{[1] [2]}. The consequence for operators is not the natural language demo; it is that reaching governed customer data stops being an integration project and becomes a configuration decision, which moves the governance burden to whoever holds the grant ^{[2] [3]}.

The scope matters. According to SiliconANGLE, teams can query through Data 360 and also build, transform, map, segment and activate fields without leaving their existing tools ^[3]. That is not a read-only surface. An agent with activation endpoints can push customer data outward, so a bad call is not contained inside a dashboard ^{[3] [11]}.

This builds on Headless 360, released in April, which connected systems on Salesforce APIs via MCP and which the company described as the "front door" to its ecosystem ^{[5] [6]}. The Data 360 layer goes further into intelligence, insights, transformation and ingestion ^[7]. The worked example in Salesforce's pitch is a business user asking for the lifetime value of all customers for electronics purchases excluding software, with the agent writing the query and constructing the semantic models, relationships, transforms and formulas without hand-holding ^{[8] [9]}.

The client side is deliberately open. Salesforce says any agent from Claude, Cursor, ChatGPT or its own Agentforce can dynamically discover and invoke the relevant data and capabilities without being given exact field names or function calls ^[10]. That is four named external and internal runtimes, three of which Salesforce does not operate ^[15]. The server is Salesforce-hosted and managed and consistent with its other MCP servers ^[11], but hosting the server is not the same as controlling what a third-party client asks it to do.

The old failure mode was slowness: data workers had to know fields, schema, segments and tables before activating anything, moving between tools and teams in a process that took days or weeks ^[4]. SiliconANGLE frames the new path as turning months of work into hours or minutes ^[12]. Treat that as vendor framing. The friction being removed was also, incidentally, the place where a second human looked at the query.

Notably, the customer example points at metadata rather than protocol as the trust mechanism. Dr. Paramjit "Romi" Chopra, founder and chief executive of Midwest Institute for Minimally Invasive Therapies, said Data 360 Headless lets his agents "reach unified patient context from any surface" without waiting for a purpose-built interface for each one ^[13]. He attributed the trustworthiness of answers to a physician-curated ontology, meaning humans structure the metadata and experts monitor generative responses ^[14]. Curation is doing the work there, not the endpoint list.

Two things to watch. First, delivery: prepackaged Skills for modeling, mapping, transforms and activation, plus custom Skills for repeated workflows, were slated for later in August ^{[16] [17] [18]}. Second, and more consequential, the permissioning story. SiliconANGLE's account does not describe how access to the 200-plus endpoints is scoped, credentialed per client, or audited ^[19]. Until that is documented, the operator question is unglamorous and specific: which role in your organisation can point ChatGPT at your activation endpoints, and who reviews it.