Secure Salesforce access for AI agents

Query, search, and manage Salesforce records via SOQL/SOSL and object CRUD, using Salesforce's official Platform MCP server

Salesforce integration connects your agents to Salesforce records — Accounts, Contacts, Opportunities, Cases, and any custom object — via SOQL/SOSL search and object CRUD.

Server URL: https://api.salesforce.com/platform/mcp/v1/platform/sobject-all

Setup

Navigate to Resources and click Add Resource
Select Salesforce from the catalog
Provide your Salesforce Connected App credentials (see Bring your own app)
Click Add

Each user connects their own Salesforce account via OAuth when they first use a Salesforce tool. Salesforce's own role, profile, and field-level security controls what each user can reach — the gateway does not widen access beyond what the authenticated user could already do in Salesforce. Navigate to Connections to manage linked accounts.

Credential modes

Salesforce supports one mode:

Bring your own app: a Salesforce Connected App owned by your organization, registered in Salesforce Setup. Salesforce does not support dynamic client registration for this MCP server.

See Credential modes for the full comparison.

Bring your own app

A Salesforce administrator registers a Connected App in Setup → App Manager → New Connected App, then returns to SecureAuth with the Client ID (Consumer Key) and Client Secret (Consumer Secret).

In your AI Security workspace, go to Resources → Add Resource → Salesforce → Bring your own app and copy the redirect URI shown in the dialog.

In Salesforce Setup, on the Connected App's API (Enable OAuth Settings) section:

Enable OAuth settings and add the redirect URI you copied to Callback URL; it must use HTTPS
Add the mcp_api and refresh_token OAuth scopes
Copy the Consumer Key and Consumer Secret

Paste both back into the Salesforce resource dialog in your AI Security workspace, then click Add.

Authorization goes through Salesforce's generic login gateway (login.salesforce.com), which redirects to the authenticating user's own My Domain during sign-in — this works the same way across orgs without per-org configuration.

Available tools

Tool	Description
`soqlQuery`	Execute a SOQL query to retrieve records — the primary way to read data
`find`	Execute a SOSL text search across multiple objects at once
`getRelatedRecords`	Get child records related to a parent record by traversing relationships
`listRecentSobjectRecords`	Get records of a given type the user recently viewed or modified
`getObjectSchema`	Get schema information for one or more objects, or an index of all objects
`getUserInfo`	Get the current user's identity, role, and preferences
`createSobjectRecord`	Create a new record
`updateSobjectRecord`	Update an existing record by ID
`updateRelatedRecord`	Update a child record by navigating from a parent record through a relationship
`deleteSobjectRecord`	Permanently delete a record by ID
`deleteRelatedRecord`	Delete a child record by navigating from a parent record through a relationship

Required scopes

mcp_api: access to Salesforce's Platform MCP server
refresh_token: allows the gateway to refresh the user's access token without re-prompting for login

Policy examples

Read-only access: deny createSobjectRecord, updateSobjectRecord, updateRelatedRecord, deleteSobjectRecord, and deleteRelatedRecord
Search and read without writes: allow soqlQuery, find, getRelatedRecords, listRecentSobjectRecords, getObjectSchema, getUserInfo
Block deletes only: deny deleteSobjectRecord and deleteRelatedRecord