The Elements MCP (Model Context Protocol) server lets an AI assistant such as Claude, ChatGPT or Cursor understand your Salesforce configuration and documentation through interacting with Elements metadata graph, using the Elements permissions you already have.

This article explains what the Elements MCP server can access, how sign-in works, how Space access is controlled, and how to review, audit and revoke connections. It's the article to share with your security team.

The Elements MCP server can access the Salesforce metadata and configuration Elements stores: a deterministically processed, deep understanding of how your Salesforce Org is configured, such as object and field definitions, flows, Apex classes, validation rules, permission sets, automation dependencies and schema relationships.

Some Elements MCP tools also use usage telemetry: record counts, and Apex execution telemetry from Salesforce Event Monitoring logs. Elements never stores Salesforce business records (accounts, contacts, opportunities, transactions), so an AI assistant connected through Elements can't reach them either.

Your AI assistant connects to the Elements MCP server over a secure, authenticated HTTPS connection. On every request, the server checks your identity, the Spaces you approved, and your Elements role, plan and licences before it reaches your Space.

Most Elements MCP tools are read-only. A small set can create or change these things, inside Elements only:

You sign in to the Elements MCP server with your existing Elements account using OAuth 2.1, an open sign-in standard used across the industry. The sign-in flow uses PKCE (Proof Key for Code Exchange), an extra safeguard that stops an intercepted request from being reused by anyone else. You sign in through your browser, directly with Elements, so your Elements password is never shared with your AI assistant.

When you approve a connection, Elements shows you the client (for example, Claude Code) and the scope families it requests. Clients are offered the same full scope set by default, though a client may request fewer; you don't pick scopes. The choice you make is which Space or Spaces the connection can use. Scopes are checked on every call except disconnecting; there is no separate scope prompt for each call.

An AI assistant connected to Elements never gets more access than you already have in Elements. Three things decide what a connection can do:

A connection only works inside the Spaces you granted it; it can't be used to reach any other Space, tenant or customer's data. Each access token is cryptographically tied to the Elements MCP server, so even an exposed token couldn't be replayed against another Elements service.

Like you, a connection can also read the diagram templates available to you in Elements (Elements' Public Templates, public Spaces you belong to, and your company's internal template Spaces); it never changes them. The template-reading tools are list_map_templates, get_process_map_outline and get_diagram; create_map_from_template copies a template into a Space you granted, using your rights there. Elements audits every template read and copy.

When no Space is active, Elements uses your eligible default Space if you approved it, or the one eligible Space you approved if there is exactly one. Otherwise, the call returns active_space_required. A Space named explicitly must also be authorized for the connection and enabled for the MCP server.

revoke_access works while at least one Space you approved has an active membership and isn't suspended, even if that Space lacks MCP access. If every approved Space is suspended, or you're no longer an active member of any of them, the server refuses every request; revoke the connection from the 'Connected apps' tab of your Elements profile instead.

Elements MCP access tokens are short-lived and refresh automatically in the background. Refresh tokens rotate on each use and last 30 days from the last refresh, so a connection used at least once a month stays signed in. Elements never stores a token in plain text; it keeps only a keyed hash (HMAC-SHA-256).

You can review and revoke your own AI assistant connections to Elements at any time:

The 'Connected apps' tab shows each connection's client, the Spaces it can use, its scope, and when it last signed in. Space administrators can review the connections into their Space and remove their Space from them. Revoking or removing a connection takes effect immediately.

Removing the Elements server from your AI assistant's settings stops that assistant using it, but the connection stays valid in Elements until its refresh token expires, 30 days after its last refresh. To end a connection immediately, revoke it in 'Connected apps'.

Elements logs every action an AI assistant takes through the MCP server: who made the request, which Space it ran in, which tool it called, and whether it succeeded. Sign-ins, approvals and revocations are logged too. The records are kept in tamper-resistant storage operated by Elements and are used for security monitoring and incident investigation.

Audit logs aren't visible in the Elements app today. To have a connection's activity investigated, contact Elements support. What you can see yourself, at any time, is every active connection, what it's allowed to do and when it last signed in, on the 'Connected apps' tab of your profile.

Each Elements MCP connection is limited to a safe rate of requests, and every request is checked against a strict, predefined set of allowed inputs before it runs, so it can't be used to send unexpected commands. Responses are screened too: hidden characters that could smuggle instructions to an AI assistant are stripped, and AI-generated explanations are marked so your assistant treats them as information to read, not instructions to follow.

The most significant changes are saved as drafts for a person to review in Elements. A proposed metadata node is marked as proposed in your reference model, and an imported diagram only updates the diagram's working draft; publishing an approved version is a separate, deliberate step.

Some Elements MCP tools use a large language model (LLM) to produce answers:

These tools run through the same licensed AI features Elements already offers in the web app, so connecting an AI assistant doesn't add a new AI integration or send your data anywhere new.

Only the metadata needed to answer the question is sent, never Salesforce business records, which Elements doesn't hold. AI-generated text is screened and marked as untrusted data. Generated process maps and stories are saved in Elements, and Decision Engine runs keep their analysis as internal Elements artifacts. See the Elements MCP server tools reference for every tool.

The Elements MCP server runs on the same platform as the rest of Elements. Elements' platform security documentation, including SOC 2, ISO 27001:2022 and the Data Processing Agreement, is available at trust.elements.cloud.

Connecting an AI assistant doesn't store your data anywhere new. The Elements MCP server reads from the same Elements data your account can already access, and the connection itself creates no additional copy.

An AI assistant can't change your Salesforce org through Elements. The Elements MCP server never connects to Salesforce, and it never creates, updates, deletes or deploys Salesforce metadata.

An AI assistant can't see your Salesforce records through Elements, because Elements never stores business records such as accounts, contacts, opportunities or transactions. It works only with metadata, configuration and usage telemetry.

You can revoke your own connections on the 'Connected apps' tab of your Elements profile, and Space administrators can remove their Space from any connection into it. Elements can also disable MCP access for a whole Space. All three take effect immediately.

If a connection isn't behaving as expected, see Elements MCP server troubleshooting.