Skip to main content
Salesforce Hosted MCP exposes Salesforce records, Data Cloud, invocable actions, and product-specific tools through OAuth. Add each Salesforce MCP endpoint you need as a separate remote MCP server in TrueFoundry.

​
Prerequisites

  • A TrueFoundry account with permission to add MCP servers.
  • A Salesforce org where you have Administrator access.
  • The Customize Application permission.
  • Your TrueFoundry control plane base URL.

​
Enable Salesforce MCP

In Salesforce Setup, search for User Interface, enable MCP Service (Beta) if required for your org, and save. MCP calls count against Salesforce API quota.

​
Create an External Client App

In Setup, search for External Client App Manager and create a new External Client App. Enable OAuth and set the callback URL to: 
https://<tfy-control-plane-base-url>/api/svc/v1/llm-gateway/mcp-servers/oauth2/callback
Add the OAuth scopes your MCP endpoints need:
ScopePurpose
apiSalesforce API access
sfap_apiSalesforce API Platform access
refresh_token, offline_accessRefresh tokens
einstein_gpt_apiEinstein GPT services, when using hosted MCP beta capabilities
Enable JWT-based access tokens for named users and require PKCE. Copy the Consumer Key and, if your endpoint requires a confidential client, the Consumer Secret.

​
Salesforce MCP URLs

ServerProduction URL
All objectshttps://api.salesforce.com/platform/mcp/v1-beta.2/platform/sobject-all
Read-only objectshttps://api.salesforce.com/platform/mcp/v1-beta.2/sobject-reads
Mutationshttps://api.salesforce.com/platform/mcp/v1-beta.2/sobject-mutations
Deleteshttps://api.salesforce.com/platform/mcp/v1-beta.2/sobject-deletes
Data Cloudhttps://api.salesforce.com/platform/mcp/v1-beta.2/data-cloud-queries
Invocable actionshttps://api.salesforce.com/platform/mcp/v1-beta.2/invocable_actions
For sandbox or scratch orgs, insert /sandbox/ after v1-beta.2 in the URL path.

​
Register in TrueFoundry

Add a remote MCP server with OAuth2 Authorization Code for each Salesforce endpoint you need. Paste the Consumer Key as the Client ID and add the Client Secret if your Salesforce app generated one. Add collaborators and save the server. Users should open the server’s Tools section and click Connect Now; after OAuth succeeds, Salesforce tools appear and can be tried from the Agent Playground.

​
Security Notes

Each user acts with their Salesforce identity and permissions. Start with the read-only objects endpoint for broad access and expose mutation or delete endpoints only through curated Virtual MCP Servers.