Salesforce exposes its MCP servers from inside your org through the TrueFoundry Salesforce managed package. You install the package, enable the MCP service, and activate the server you want - you do not create an External Client App or Connected App, generate a Client ID or Secret, or configure OAuth scopes and callback URLs yourself.
Using Salesforce through the MCP Gateway
The TrueFoundry MCP Gateway centralizes access to Salesforce - agents connect through one endpoint instead of maintaining separate server configurations per client. As a TrueFoundry Managed MCP, Salesforce’s URL, outbound auth, scopes, and credentials are owned and kept current by the platform. When you use Salesforce MCP server through the Gateway, TrueFoundry provides:- Authentication — Clients authenticate inbound to the Gateway with a Personal Access Token, Virtual Account, or IDE OAuth flow. For outbound access, the Gateway runs the OAuth2 Authorization Code flow so each user authorizes their own Salesforce account. Every action then runs as that authenticated user and respects your org’s CRUD permissions, field-level security, and sharing rules.
- Access control — Collaborators and role-based policies define who can use the server and which tools they can invoke. Enable or disable individual Salesforce tools from the server detail page.
- Observability — Tool calls are traced with caller identity, tool name, inputs, and latency. Monitor server- and tool-level usage in MCP Metrics and export traces to your observability stack via OpenTelemetry.
- Guardrails — Apply pre-tool and post-tool guardrails on MCP tool calls. Guardrail hooks apply at
mcp_pre_tool(before a tool is invoked) andmcp_post_tool(after the tool returns): pre-tool checks run before execution and can block the call; post-tool checks run on the response before it returns to the agent.
Prerequisites
- A TrueFoundry account with permission to add MCP servers.
- Salesforce Administrator access to your org.
- An org edition with API access enabled (Developer, Enterprise, or Professional Edition with API access enabled).
Adding Salesforce MCP server to TrueFoundry
1
Install the TrueFoundry Salesforce MCP package
Log into your Salesforce org as an Administrator, then open the installation link in the same browser session:On the install screen, select Install for All Users, click Install, and wait for the confirmation that installation completed successfully.
2
Enable the MCP Service
Go to Setup. In the Quick Find box, search for User Interface, locate the Enable MCP Service setting, turn it on, and click Save.
3
Activate the MCP Server
In Setup, search the Quick Find box for MCP Servers and open the Salesforce Servers tab. Find the server you want to enable - for example
sobject-all for full read/write access, or sobject-reads for read-only access - and click Activate.It can take up to two minutes for the server to become active.
4
Connect to TrueFoundry
In TrueFoundry, navigate to MCP Servers, find Salesforce MCP, and click Connect. You’ll be redirected to a Salesforce login and consent screen - log in if prompted, review the requested permissions, and click Allow.
5
Verify the connection
Back in TrueFoundry, the Salesforce MCP server should now show as Connected and the Tools tab lists its available tools. Click Try on any tool, or run a simple request such as “list all accounts” or “show open opportunities” to confirm everything is working.
Connecting to an MCP Client
Open the How To Use tab on the Salesforce server detail page for your tenant-specific Gateway URL and ready-to-paste client snippets - don’t build the endpoint manually. The tab includes snippets for Claude Code, VS Code, Claude Web, Claude Desktop, Cursor, Windsurf, Codex, and the Python and TypeScript MCP SDKs. Use Show API Key if your client requires a Gateway token in a header.Using the Tool Playground
Before deploying an agent, you can test any Salesforce MCP server tool directly in TrueFoundry:1
Open a tool
On the Salesforce MCP server detail page, click Try next to any tool - for example a read tool from the
sobject-reads server.2
Fill in the inputs
Provide the tool’s inputs, such as the object type (for example,
Account or Opportunity) and any query filters.3
Execute and inspect
Click Execute Tool and inspect the JSON output in the right panel.
Tool Metrics
The Tool Metrics tab on the Salesforce server detail page tracks how agents use each tool:- Invocation count - which tools are called most often
- Latency - how long each tool takes to respond
- Error rates - which tools are failing in production
Disabling Individual Tools
On the Tools tab, toggle off any Salesforce tools your agents don’t need:- Disabled tools are hidden from MCP clients and cannot be invoked.
- Enabled tools remain available to agents as usual.
sobject-reads server instead of sobject-all, or disable the write and delete tools here.