> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Salesforce MCP Server

> Connect Salesforce as a managed MCP server on the TrueFoundry MCP Gateway so agents can read and act on CRM data under your Salesforce permissions.

[Salesforce](https://www.salesforce.com) is a CRM platform for accounts, contacts, opportunities, cases, and custom objects. TrueFoundry provisions it as a [TrueFoundry Managed MCP](/docs/ai-gateway/mcp/tfy-managed-mcp-server) - the platform manages the server URL, auth, scopes and credentials, so your agents can use Salesforce without any configuration or infrastructure setup on your end.

<Note>
  Salesforce exposes its MCP servers from inside your org through the TrueFoundry Salesforce managed package. You install the package, enable the MCP service, and activate the server you want - you do **not** create an External Client App or Connected App, generate a Client ID or Secret, or configure OAuth scopes and callback URLs yourself.
</Note>

## Using Salesforce through the MCP Gateway

The [TrueFoundry MCP Gateway](/docs/ai-gateway/mcp/mcp-overview) centralizes access to Salesforce - agents connect through one endpoint instead of maintaining separate server configurations per client. As a [TrueFoundry Managed MCP](/docs/ai-gateway/mcp/tfy-managed-mcp-server), Salesforce's URL, outbound auth, scopes, and credentials are owned and kept current by the platform.

When you use Salesforce MCP server through the Gateway, TrueFoundry provides:

* **Authentication** — Clients [authenticate inbound](/docs/ai-gateway/mcp/mcp-gateway-auth-security#inbound-authentication) to the Gateway with a Personal Access Token, Virtual Account, or IDE OAuth flow. For outbound access, the Gateway runs the [OAuth2 Authorization Code flow](/docs/ai-gateway/mcp/mcp-gateway-auth-security#outbound-authentication) so each user authorizes their own Salesforce account. Every action then runs as that authenticated user and respects your org's CRUD permissions, field-level security, and sharing rules.
* **Access control** — [Collaborators and role-based policies](/docs/ai-gateway/mcp/mcp-gateway-auth-security#access-control) define who can use the server and which tools they can invoke. Enable or disable individual Salesforce tools from the server detail page.
* **Observability** — Tool calls are traced with caller identity, tool name, inputs, and latency. Monitor server- and tool-level usage in [MCP Metrics](/docs/ai-gateway/analytics-mcp-metrics) and export traces to your observability stack via OpenTelemetry.
* **Guardrails** — Apply [pre-tool and post-tool guardrails](/docs/ai-gateway/guardrails-overview) on MCP tool calls. Guardrail hooks apply at `mcp_pre_tool` (before a tool is invoked) and `mcp_post_tool` (after the tool returns): pre-tool checks run before execution and can block the call; post-tool checks run on the response before it returns to the agent.

## Prerequisites

* A TrueFoundry account with permission to add MCP servers.
* **Salesforce Administrator** access to your org.
* An org edition with **API access** enabled (Developer, Enterprise, or Professional Edition with API access enabled).

The whole setup takes about 10 minutes.

## Adding Salesforce MCP server to TrueFoundry

<Steps>
  <Step title="Install the TrueFoundry Salesforce MCP package">
    Log into your Salesforce org as an Administrator, then open the installation link in the same browser session:

    ```txt theme={"dark"}
    https://login.salesforce.com/packaging/installPackage.apexp?p0=04ta7000001FUejAAG
    ```

    On the install screen, select **Install for All Users**, click **Install**, and wait for the confirmation that installation completed successfully.
  </Step>

  <Step title="Enable the MCP Service">
    Go to **Setup**. In the Quick Find box, search for **User Interface**, locate the **Enable MCP Service** setting, turn it on, and click **Save**.
  </Step>

  <Step title="Activate the MCP Server">
    In **Setup**, search the Quick Find box for **MCP Servers** and open the **Salesforce Servers** tab. Find the server you want to enable - for example `sobject-all` for full read/write access, or `sobject-reads` for read-only access - and click **Activate**.

    <Note>
      It can take up to two minutes for the server to become active.
    </Note>
  </Step>

  <Step title="Connect to TrueFoundry">
    In TrueFoundry, navigate to **MCP Servers**, find **Salesforce MCP**, and click **Connect**. You'll be redirected to a Salesforce login and consent screen - log in if prompted, review the requested permissions, and click **Allow**.
  </Step>

  <Step title="Verify the connection">
    Back in TrueFoundry, the Salesforce MCP server should now show as **Connected** and the **Tools** tab lists its available tools. Click **Try** on any tool, or run a simple request such as *"list all accounts"* or *"show open opportunities"* to confirm everything is working.
  </Step>
</Steps>

## Connecting to an MCP Client

Open the **How To Use** tab on the Salesforce server detail page for your tenant-specific Gateway URL and ready-to-paste client snippets - don't build the endpoint manually.

The tab includes snippets for Claude Code, VS Code, Claude Web, Claude Desktop, Cursor, Windsurf, Codex, and the Python and TypeScript MCP SDKs. Use **Show API Key** if your client requires a Gateway token in a header.

## Using the Tool Playground

Before deploying an agent, you can test any Salesforce MCP server tool directly in TrueFoundry:

<Steps>
  <Step title="Open a tool">
    On the Salesforce MCP server detail page, click **Try** next to any tool - for example a read tool from the `sobject-reads` server.
  </Step>

  <Step title="Fill in the inputs">
    Provide the tool's inputs, such as the object type (for example, `Account` or `Opportunity`) and any query filters.
  </Step>

  <Step title="Execute and inspect">
    Click **Execute Tool** and inspect the JSON output in the right panel.
  </Step>
</Steps>

## Tool Metrics

The **Tool Metrics** tab on the Salesforce server detail page tracks how agents use each tool:

* **Invocation count** - which tools are called most often
* **Latency** - how long each tool takes to respond
* **Error rates** - which tools are failing in production

See [MCP Metrics](/docs/ai-gateway/analytics-mcp-metrics) for server- and tool-level dashboards across your Gateway.

## Disabling Individual Tools

On the **Tools** tab, toggle off any Salesforce tools your agents don't need:

* **Disabled tools** are hidden from MCP clients and cannot be invoked.
* **Enabled tools** remain available to agents as usual.

For a read-only agent, activate the `sobject-reads` server instead of `sobject-all`, or disable the write and delete tools here.