Salesforce is Poor to agents.
Discry independently scored how well an AI agent can discover and understand the Salesforce API from what’s public — not whether it’s usable. Below: every signal we checked, what’s costing the score, and what to change.
SCORED UNDER RUBRIC 1.2 · A full re-launch under Discry Score 2.5 — a new behavioral instrument, not comparable to these scores — is in progress.
Discovery
45% of score · 17/100Comprehension
55% of score · 69/100What we found
- developer.salesforce.com returns HTTP 403 for all programmatic access (robots.txt, llms.txt, sitemap, .well-known/) — the developer portal actively blocks automated discovery.
- Salesforce has an llms.txt at www.salesforce.com/llms.txt but it is entirely product/marketing focused (Agentforce, AI courses, pricing pages) with no API documentation links.
- The OpenAPI spec for Salesforce REST API is only available as a beta feature that requires authentication and org-level opt-in — not publicly accessible.
- Strong MCP ecosystem presence with official Salesforce CLI MCP Server and Platform MCP Server on PulseMCP, plus multiple community servers.
- Despite blocking automated access, Salesforce has extensive human-readable API documentation with SOQL, REST API, and Bulk API guides — but agents must navigate JavaScript-rendered pages.
What to change
Prioritized by impact on discoverability. You (or your docs platform) deploy these — Discry never touches your API.
- 01Remove the HTTP 403 block on developer.salesforce.com for automated access — this is the single biggest barrier to agent discovery.
- 02Create a developer-focused llms.txt at developer.salesforce.com covering REST API, SOQL, Bulk API, and Metadata API patterns.
- 03Make the OpenAPI spec publicly accessible without requiring org authentication.
- 04Add AGENTS.md to the salesforce/agent-sdk or forcedotcom/agents repositories.
- 05Create llms-full.txt covering core REST API operations, SOQL syntax, and common integration patterns.
Execution coverage · INFORMATIONAL, UNSCORED
Whether an agent can actually complete a call and recover from errors is the deeper Audit layer — documented here, but not part of the Discry Score.
Comprehensive OAuth2 documentation with multiple grant types. REST API returns structured JSON errors. API limits documented per edition (API calls per 24 hours). Pagination via nextRecordsUrl in query results. No idempotency key mechanism documented.