Salesforce

Salesforce Hosted MCP is Salesforce’s vendor-managed remote MCP service. Select the SObject server that provides the protection level your workflow needs. Each server provides governed access to standard and custom Salesforce records using each connected user’s Salesforce permissions, sharing rules, and field-level security.

See the official Salesforce Hosted MCP documentation for setup, authentication, and server details.

Features

• SObject All (platform/sobject-all): Create, read, update, and delete records
• SObject Reads (platform/sobject-reads): Read records, inspect schemas, and run SOQL or SOSL without changing data
• SObject Mutations (platform/sobject-mutations): Create and update records without delete operations
• SObject Deletes (platform/sobject-deletes): Find and delete records for data-hygiene workflows

What you’ll need to connect

A Salesforce administrator must activate the SObject server selected below in Setup > API Catalog > MCP Servers. Activation can take up to two minutes.

Salesforce does not support Dynamic Client Registration. An administrator must create an External Client App for this Obot deployment and configure static OAuth credentials after adding this catalog entry.

After an administrator completes this one-time setup, users only sign in with Salesforce and select the SObject server for their workflow.

Configure the External Client App

1. In Setup > External Client App Manager, create an External Client App and enable OAuth.
2. Register this callback URL: <your-Obot-server-URL>/oauth/mcp/callback.
3. Add the mcp_api and refresh_token OAuth scopes.
4. Enable PKCE and JWT-based access tokens for named users.
5. Configure the app’s Client ID and Client Secret in Obot’s static OAuth settings for this catalog entry.

Salesforce recommends one External Client App per MCP client. For production, restrict the app to administrator-approved users through a permission set and configure refresh-token rotation.

Important limitations

Static OAuth credentials are configured once per Obot catalog scope. Configure this entry for one Salesforce org and its corresponding External Client App. Additional Salesforce orgs require separately scoped catalog configuration.

Salesforce applies the authenticated user’s CRUD, field-level, sharing, profile, and permission-set access. MCP requests consume the org’s normal API quota. Select platform/sobject-reads unless your workflow requires record changes; select platform/sobject-deletes only for deliberate deletion workflows.

⚠️ Upgrade notice

If you’re upgrading this server, note that this replaces the Obot-hosted Salesforce server with Salesforce’s official hosted MCP servers.

• Reconnect required: A Salesforce administrator must activate the selected SObject server and configure an External Client App for Obot’s static OAuth connection.
• Authentication change: The previous per-connection client ID, client secret, and Salesforce domain settings are no longer used.
• Tool changes: Select a read, mutation, deletion, or full SObject server; tools and parameters differ from the previous server.