Docs

Configure the Salesforce MCP Server

Updated 3 min read

Overview

Salesforce provides a family of pre-built, hosted MCP servers you can connect to directly: SObject All, SObject Reads, SObject Mutations, SObject Deletes, Data 360, Tableau Next, Archive Connect, and a beta Headless 360 server. Access to any of these is authorized through a Salesforce External Client App (ECA).

1. Configure Salesforce

  1. Enable the hosted MCP servers you need. From any page in Salesforce, click the gear icon in the top right and select Setup. In the Quick Find box, search for MCP Servers (under API Catalog), and toggle on each pre-built server your agents should reach — for example SObject All for full CRUD plus query and search, or the narrower SObject Reads/SObject Mutations/SObject Deletes if you want read and write access split across separate gateway entries. Toggled servers can take up to two minutes to activate.
  2. Create an External Client App (ECA). From any page in Salesforce, click the gear icon in the top right and select Setup. In the Quick Find box, search for External Client Apps, open External Client App Manager, and select New External Client App. Fill in the basic information, then expand API (Enable OAuth Settings) and check Enable OAuth.
  3. Configure the app’s OAuth settings. Set the Callback URL to your Dtwo gateway’s OAuth redirect endpoint — look for it in the Configuration section for the gateway in the Dtwo UI. Under OAuth Scopes, add mcp_api (“Access MCP servers”) and refresh_token (“Perform requests at any time”). Under the app’s security settings, select Issue JSON Web Token (JWT)-based access tokens for named users and deselect the other token-issuance options.

2. Add the MCP server to your gateway config

In your gateway configuration add one mcp_servers entry per hosted server you enabled in Step 1.1.

For a production org:

  - name: salesforce-<SERVER_PATH>
    description: "Salesforce's official hosted MCP server."
    url: "https://api.salesforce.com/platform/mcp/v1/<SERVER_PATH>"
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      pkce_enabled: true
      scopes:
        - mcp_api
        - refresh_token
      client_id: "<CONSUMER_KEY>"
      client_secret: "<CONSUMER_SECRET>"
      authorization_url: "https://login.salesforce.com/services/oauth2/authorize"
      token_url: "https://login.salesforce.com/services/oauth2/token"
      redirect_uri: "<CALLBACK_URL>"

For a sandbox org:

  - name: salesforce-<SERVER_PATH>-sandbox
    description: "Salesforce's official hosted MCP server (sandbox)."
    url: "https://api.salesforce.com/platform/mcp/v1/sandbox/<SERVER_PATH>"
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      pkce_enabled: true
      scopes:
        - mcp_api
        - refresh_token
      client_id: "<CONSUMER_KEY>"
      client_secret: "<CONSUMER_SECRET>"
      authorization_url: "https://test.salesforce.com/services/oauth2/authorize"
      token_url: "https://test.salesforce.com/services/oauth2/token"
      redirect_uri: "<CALLBACK_URL>"

Replace the placeholder values:

  • <SERVER_PATH> — the endpoint path for the server this entry represents:
    • SObject All: platform/sobject-all
    • SObject Reads: platform/sobject-reads
    • SObject Mutations: platform/sobject-mutations
    • SObject Deletes: platform/sobject-deletes
    • Data 360: data360
    • Data 360 Legacy: data/data-cloud-queries
    • Headless 360: platform/headless-360
    • Archive Connect: no separate endpoint — its tools are reached through the Headless 360 server’s Discover tool at runtime, so use the platform/headless-360 path above
    • Tableau Next: analytics/tableau-next
  • <CONSUMER_KEY> and <CONSUMER_SECRET> — come from the External Client App you configured in step 1.2.
  • <CALLBACK_URL> — found in the Configuration section for the gateway in the Dtwo UI.

3. Deploy and verify

Save the configuration and deploy the gateway.

Then, in your AI client, ask it to authorize each Salesforce server via the gateway. This opens the Salesforce login screen — sign in as the user whose permissions the agent should inherit, and approve the consent prompt. Once authorized, confirm each server’s tools appear and run a quick call to make sure the connection works.

Having trouble? Email support@dtwo.ai.