Salesforce

Connecting Salesforce's hosted MCP server lets your agents query, create, update and delete records in your Salesforce org, follow related records, and read object schemas. Unlike most vendors, Salesforce needs an application that you create in your own org before you connect.

Read How MCP Servers Work in Outermind first if you have not connected an MCP server before.

Before you start

• Salesforce Enterprise edition or above. Developer Edition orgs are included.
• A Salesforce admin who can create an External Client App in your org.
• A Salesforce user for the connection to act as. The connection signs in as a named user, so agents can do what that user can do in Salesforce.
• A tenant admin in Outermind to run the wizard and grant the tools.
• Salesforce billing. Salesforce intends its hosted MCP server for customers with Flex Credits and may bill for it; see Billing notes.

Prepare Salesforce

Salesforce has no automatic registration for MCP clients, so you create the client application yourself.

1. In your Salesforce org, create a new External Client App. Connected Apps are not supported for the hosted MCP server.
2. Turn on OAuth for the app and add the Outermind redirect URIs below as its callback URLs.
3. Give the app the OAuth scopes mcp_api and refresh_token.
4. Require PKCE for the app.
5. In the app's OAuth settings, under Security, tick Issue JSON Web Token (JWT)-based access tokens for named users. The hosted MCP server accepts only JWT access tokens; without this setting the connection cannot sign in.
6. Save the app, then copy its consumer key and consumer secret. Keep the secret safe.

https://us-api.outermind.ai/api/mcp-oauth/callback
https://uk-api.outermind.ai/api/mcp-oauth/callback
https://eu-api.outermind.ai/api/mcp-oauth/callback
https://au-api.outermind.ai/api/mcp-oauth/callback
https://qa-api.outermind.ai/api/mcp-oauth/callback
http://localhost:4071/api/mcp-oauth/callback

Outermind signs in through the URI for the region your Outermind organisation is hosted in, so that one is required. Adding the four production URIs (US, UK, EU and AU) covers every region. The QA and local development URIs, the last two above, serve only Outermind's own test environments, so add them only if Outermind support asks you to.

Then activate the hosted MCP server in your org. It is Inactive by default, and Outermind cannot reach it until it is active:

1. In Setup, go to Integrations, API Catalog, MCP Servers.
2. Open SObject All (API name platform.sobject-all) and click Activate.

Salesforce shows "You might be billed for Salesforce MCP server usage" on this page; see Billing notes.

Connect in Outermind

1. Open the Capabilities hub, click MCP Servers under Tool Management, and click Add MCP server.
2. Under Known server, pick Salesforce (api.salesforce.com). The endpoint https://api.salesforce.com/platform/mcp/v1/platform/sobject-all is filled in, the wizard shows "Create an External Client App in your org with these redirect URIs and paste its consumer key and secret." and the expected sign-in is OAuth sign-in. Optionally edit Purpose, the one-line description agents see beside this server. Click Next.
3. On Credential, the wizard says "This provider needs an application created in your own account; you will supply its client ID and secret." When asked, paste the app's consumer key as the client ID and its consumer secret as the client secret. Click Connect, sign in to Salesforce as the user the connection should act as, and approve.
4. On Summary, Outermind discovers Salesforce's tools and makes them active. Under Grant tools to agents, pick an agent to choose an access level for each one; to leave a tool out, use the connection page afterwards.

If the connection fails

Two Outermind messages point to a step missed in Prepare Salesforce:

Outermind shows	Cause	Fix
"This connection needs to be reconnected."	The External Client App does not issue JWT access tokens, so Salesforce's MCP server refuses the sign-in ("JWT Token is required"). Reconnecting does not help until the app is changed.	Tick Issue JSON Web Token (JWT)-based access tokens for named users on the app (step 5), save it, then click Reconnect on the connection page.
"The MCP server request failed."	The SObject All MCP server is not active in your org, so Salesforce answers that the server definition is not found.	Activate SObject All under Setup, Integrations, API Catalog, MCP Servers, then connect again, or click Re-sync if the connection is already saved.

What your agents can do

The sobject-all server offers 11 tools:

Tool	What it does
getObjectSchema	Reads an object's fields and structure
getUserInfo	Reads the signed-in user's details
soqlQuery	Runs a SOQL query
find	Searches records
listRecentSobjectRecords	Lists recently used records
getRelatedRecords	Reads records related to a record
create	Creates a record
update	Updates a record
updateRelated	Updates related records
delete	Deletes a record
deleteRelated	Deletes related records

Read actions start at tier low, and every other action starts at high; see Risk tiers. Keep delete and deleteRelated at high.

What is not available

• Deleted records. The earlier built-in Salesforce integration could query soft-deleted records (those in the Recycle Bin); the MCP server cannot.
• Record types by name. When creating a record, the earlier integration accepted a record type's name and looked up its ID. With the MCP server, the agent must supply the record type ID, which it can find with a query first.

Billing notes

Salesforce states that its hosted MCP server is intended for customers with Flex Credits and may be billed. When you activate the server, Salesforce warns "You might be billed for Salesforce MCP server usage", charged in Flex Credits. Check with your Salesforce account team how MCP calls are charged under your contract before you give agents broad access.